Defending Support Vector Machines Against Data Poisoning Attacks

• Published in: IEEE transactions on information forensics and security 2021, Vol.16, p.2566-2578
• Main Authors: Weerasinghe, Sandamal, Alpcan, Tansu, Erfani, Sarah M., Leckie, Christopher
• Format: Article
• Language: English
• Subjects: Detectors; Kernel; Label flip attack; local intrinsic dimensionality; Optimization; poisoning attack; Resistance; Support vector machines; Training; Training data
• ISSN: 1556-6013; 1556-6021
• DOI: 10.1109/TIFS.2021.3058771

Support Vector Machines (SVMs) are vulnerable to targeted training data manipulations such as poisoning attacks and label flips. By carefully manipulating a subset of training samples, the attacker forces the learner to compute an incorrect decision boundary, thereby causing misclassifications. Considering the increased importance of SVMs in engineering and life-critical applications, we develop a novel defense algorithm that improves resistance against such attacks. Local Intrinsic Dimensionality (LID) is a promising metric that characterizes the outlierness of data samples. In this work, we introduce a new approximation of LID called K-LID that uses kernel distance in the LID calculation, which allows LID to be calculated in high dimensional transformed spaces. We introduce a weighted SVM against such attacks using K-LID as a distinguishing characteristic that de-emphasizes the effect of suspicious data samples on the SVM decision boundary. Each sample is weighted on how likely its K-LID value is from the benign K-LID distribution rather than the attacked K-LID distribution. Experiments with benchmark data sets show that the proposed defense reduces classification error rates substantially (10% on average).