# Detection of Adversarial Training Examples in Poisoning Attacks through Anomaly Detection

arXiv: https://arxiv.org/abs/1802.03041 · HTML: https://mlsanity.com/paper/1802.03041/

## Key facts

- Cited by 46 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 8 Feb 2018.

## Built on by (most cited first, 30 of 46)

- [Rethinking the Backdoor Attacks' Triggers: A Frequency Perspective](https://mlsanity.com/paper/2104.03413/) (2021)
- [Data Collection and Quality Challenges in Deep Learning: A Data-Centric AI Perspective](https://mlsanity.com/paper/2112.06409/) (2021)
- [Data Poisoning Attacks to Deep Learning Based Recommender Systems](https://mlsanity.com/paper/2101.02644/) (2021)
- [PoisonedEncoder: Poisoning the Unlabeled Pre-training Data in Contrastive Learning](https://mlsanity.com/paper/2205.06401/) (2022)
- [De-Pois: An Attack-Agnostic Defense against Data Poisoning Attacks](https://mlsanity.com/paper/2105.03592/) (2021)
- [What Doesn't Kill You Makes You Robust(er): How to Adversarially Train against Data Poisoning](https://mlsanity.com/paper/2102.13624/) (2021)
- [Defense Against Reward Poisoning Attacks in Reinforcement Learning](https://mlsanity.com/paper/2102.05776/) (2021)
- [Subnet Replacement: Deployment-stage backdoor attack against deep neural networks in gray-box setting](https://mlsanity.com/paper/2107.07240/) (2021)
- [Poisoning Attacks and Defenses on Artificial Intelligence: A Survey](https://mlsanity.com/paper/2202.10276/) (2022)
- [Potion: Towards Poison Unlearning](https://mlsanity.com/paper/2406.09173/) (2024)
- [Lethal Dose Conjecture on Data Poisoning](https://mlsanity.com/paper/2208.03309/) (2022)
- [Accumulative Poisoning Attacks on Real-time Data](https://mlsanity.com/paper/2106.09993/) (2021)
- [Temporal Robustness against Data Poisoning](https://mlsanity.com/paper/2302.03684/) (2023)
- [Game-Theoretic Defenses for Robust Conformal Prediction Against Adversarial Attacks in Medical Imaging](https://mlsanity.com/paper/2411.04376/) (2024)
- [Regularization Can Help Mitigate Poisoning Attacks... with the Right Hyperparameters](https://mlsanity.com/paper/2105.10948/) (2021)
- [A Survey on Responsible Generative AI: What to Generate and What Not](https://mlsanity.com/paper/2404.05783/) (2024)
- [FocusedCleaner: Sanitizing Poisoned Graphs for Robust GNN-based Node Classification](https://mlsanity.com/paper/2210.13815/) (2022)
- [Efficient Anomaly Detection Using Self-Supervised Multi-Cue Tasks](https://mlsanity.com/paper/2111.12379/) (2021)
- [Enhancing the Antidote: Improved Pointwise Certifications against Poisoning Attacks](https://mlsanity.com/paper/2308.07553/) (2023)
- [SoK: Unintended Interactions among Machine Learning Defenses and Risks](https://mlsanity.com/paper/2312.04542/) (2023)
- [Pre-trained Encoders in Self-Supervised Learning Improve Secure and Privacy-preserving Supervised Learning](https://mlsanity.com/paper/2212.03334/) (2022)
- [Backdoor Learning for NLP: Recent Advances, Challenges, and Future Research Directions](https://mlsanity.com/paper/2302.06801/) (2023)
- [Proof-of-Learning with Incentive Security](https://mlsanity.com/paper/2404.09005/) (2024)
- [PANDA : Perceptually Aware Neural Detection of Anomalies](https://mlsanity.com/paper/2104.13702/) (2021)
- [Explainable Data Poison Attacks on Human Emotion Evaluation Systems based on EEG Signals](https://mlsanity.com/paper/2301.06923/) (2023)
- [Hyperparameter Learning under Data Poisoning: Analysis of the Influence of Regularization via Multiobjective Bilevel Optimization](https://mlsanity.com/paper/2306.01613/) (2023)
- [Fine-grained Anomaly Detection via Multi-task Self-Supervision](https://mlsanity.com/paper/2104.09993/) (2021)
- [Influence Based Defense Against Data Poisoning Attacks in Online Learning](https://mlsanity.com/paper/2104.13230/) (2021)
- [Defend Data Poisoning Attacks on Voice Authentication](https://mlsanity.com/paper/2209.04547/) (2022)
- [On the Robustness of Random Forest Against Untargeted Data Poisoning: An Ensemble-Based Approach](https://mlsanity.com/paper/2209.14013/) (2022)

## Abstract (arXiv)

Machine learning has become an important component for many systems and applications including computer vision, spam filtering, malware and network intrusion detection, among others. Despite the capabilities of machine learning algorithms to extract valuable information from data and produce accurate predictions, it has been shown that these algorithms are vulnerable to attacks. Data poisoning is one of the most relevant security threats against machine learning systems, where attackers can subvert the learning process by injecting malicious samples in the training data. Recent work in adversarial machine learning has shown that the so-called optimal attack strategies can successfully poison linear classifiers, degrading the performance of the system dramatically after compromising a small fraction of the training dataset. In this paper we propose a defence mechanism to mitigate the effect of these optimal poisoning attacks based on outlier detection. We show empirically that the adversarial examples generated by these attack strategies are quite different from genuine points, as no detectability constrains are considered to craft the attack. Hence, they can be detected with an appropriate pre-filtering of the training dataset.