通过扰动远离决策边界的异常样本，实现对多分类模型的灰盒投毒攻击。
Outlier-Oriented Poisoning Attack: A Grey-box Approach to Disturb Decision Boundaries by Perturbing Outliers in Multiclass Learning
- 针对远离决策边界的异常样本进行标签篡改，干扰模型边界学习。
- 15%投毒下KNN和GNB准确率下降超20%，错误率最高升至40.45%。
- 数据类别越多越抗攻击，不平衡数据会加剧攻击影响，适合关注安全性的研究者。
投毒攻击是机器学习模型的主要威胁之一，通过操纵训练数据集来破坏其性能与可靠性。本文提出一种新型攻击——异常样本导向投毒（OOP），通过篡改距离决策边界最远的样本标签来干扰模型学习。研究在多分类场景下分析了该攻击对不同机器学习算法的影响，评估了不同投毒程度（5%-25%）下的方差、准确率、精确率、召回率、F1分数及假阳性率。实验基于IRIS、MNIST和ISIC三个公开数据集，结果表明：在IRIS数据集15%投毒下，KNN和GNB准确率分别下降22.81%和56.07%，假阳性率升至17.14%和40.45%；而决策树与随机森林最为稳健，准确率仅下降12.28%和17.52%。分析还发现，模型性能退化与数据集类别数呈负相关，类别越多，退化越小；此外，数据分布不均会放大攻击效果。
原文摘要 · Abstract (English)
Poisoning attacks are a primary threat to machine learning models, aiming to compromise their performance and reliability by manipulating training datasets. This paper introduces a novel attack - Outlier-Oriented Poisoning (OOP) attack, which manipulates labels of most distanced samples from the decision boundaries. The paper also investigates the adverse impact of such attacks on different machine learning algorithms within a multiclass classification scenario, analyzing their variance and correlation between different poisoning levels and performance degradation. To ascertain the severity of the OOP attack for different degrees (5% - 25%) of poisoning, we analyzed variance, accuracy, precision, recall, f1-score, and false positive rate for chosen ML models.Benchmarking our OOP attack, we have analyzed key characteristics of multiclass machine learning algorithms and their sensitivity to poisoning attacks. Our experimentation used three publicly available datasets: IRIS, MNIST, and ISIC. Our analysis shows that KNN and GNB are the most affected algorithms with a decrease in accuracy of 22.81% and 56.07% while increasing false positive rate to 17.14% and 40.45% for IRIS dataset with 15% poisoning. Further, Decision Trees and Random Forest are the most resilient algorithms with the least accuracy disruption of 12.28% and 17.52% with 15% poisoning of the IRIS dataset. We have also analyzed the correlation between number of dataset classes and the performance degradation of models. Our analysis highlighted that number of classes are inversely proportional to the performance degradation, specifically the decrease in accuracy of the models, which is normalized with increasing number of classes. Further, our analysis identified that imbalanced dataset distribution can aggravate the impact of poisoning for machine learning models
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。