提出四种防御方法，有效应对破坏数据线性可分性的贝塔投毒攻击。
Defending Against Beta Poisoning Attacks in Machine Learning Models
- 基于投毒样本聚集且靠近目标类均值的特性设计防御机制。
- 在MNIST和CIFAR-10上，KPB与MDT实现完美准确率与F1分数。
- 适用于关注模型训练阶段安全的实践者，尤其适合对抗数据污染场景。
投毒攻击通过恶意篡改机器学习模型的训练数据，对模型安全构成严重威胁。贝塔投毒是一种新提出的攻击方式，其通过使训练数据线性不可分来降低模型精度。本文提出四种防御策略：基于kNN近邻的防御（KPB）、邻域类别比较（NCC）、基于聚类的防御（CBD）以及均距阈值法（MDT）。这些方法基于对贝塔投毒生成样本特征的观察，如投毒样本彼此接近且集中于目标类均值附近。在MNIST与CIFAR-10数据集上的实验表明，KPB与MDT能实现完美准确率与F1分数，而CBD与NCC也展现出强大防御能力。此外，通过分析不同参数下的表现，提供了防御策略在不同条件下的行为洞察。
原文摘要 · Abstract (English)
Poisoning attacks, in which an attacker adversarially manipulates the training dataset of a machine learning (ML) model, pose a significant threat to ML security. Beta Poisoning is a recently proposed poisoning attack that disrupts model accuracy by making the training dataset linearly nonseparable. In this paper, we propose four defense strategies against Beta Poisoning attacks: kNN Proximity-Based Defense (KPB), Neighborhood Class Comparison (NCC), Clustering-Based Defense (CBD), and Mean Distance Threshold (MDT). The defenses are based on our observations regarding the characteristics of poisoning samples generated by Beta Poisoning, e.g., poisoning samples have close proximity to one another, and they are centered near the mean of the target class. Experimental evaluations using MNIST and CIFAR-10 datasets demonstrate that KPB and MDT can achieve perfect accuracy and F1 scores, while CBD and NCC also provide strong defensive capabilities. Furthermore, by analyzing performance across varying parameters, we offer practical insights regarding defenses' behaviors under varying conditions.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。