Stronger data poisoning attacks break data sanitization defenses

Machine learning models trained on data from the outside world can be corrupted by poisoning attacks that inject malicious points into models’ training sets. A common defense against these is sanitization: first filter out anomalous before model. In this paper, we develop three bypass a broad range of sanitization defenses, including anomaly detectors based nearest neighbors, loss, and singular-value decomposition. By adding just 3% poisoned data, our successfully increase test error Enron spam detection dataset 3 to 24% IMDB sentiment classification 12 29%. contrast, existing which do not explicitly account for defenses are defeated them. Our two ideas: (i) coordinate place near one another, (ii) formulate each attack as constrained optimization problem, with constraints designed ensure evade detection. As involves solving an expensive bilevel correspond different ways approximating influence functions; minimax duality; Karush–Kuhn–Tucker (KKT) conditions. results underscore need more robust attacks.