# Support Vector Machines under Adversarial Label Contamination

arXiv: https://arxiv.org/abs/2206.00352 · HTML: https://mlsanity.com/paper/2206.00352/

## Key facts

- Cited by 17 papers in the map (data through 14 Oct 2026).
- Builds on 4 of its 47 references that are in the map.
- First posted on arXiv 1 Jun 2022.

## Builds on (most cited first, 4 of 4)

- [Evasion Attacks against Machine Learning at Test Time](https://mlsanity.com/paper/1708.06131/) (2017)
- [Security Evaluation of Pattern Classifiers under Attack](https://mlsanity.com/paper/1709.00609/) (2017)
- [Is Data Clustering in Adversarial Settings Secure?](https://mlsanity.com/paper/1811.09982/) (2018)
- [Security Evaluation of Support Vector Machines in Adversarial Environments](https://mlsanity.com/paper/1401.7727/) (2014)

## Built on by (most cited first, 17 of 17)

- [Hidden Poison: Machine Unlearning Enables Camouflaged Poisoning Attacks](https://mlsanity.com/paper/2212.10717/) (2022)
- [Trustworthy Federated Learning: Privacy, Security, and Beyond](https://mlsanity.com/paper/2411.01583/) (2024)
- [Coresets for Wasserstein Distributionally Robust Optimization Problems](https://mlsanity.com/paper/2210.04260/) (2022)
- [Adversarial Training for Defense Against Label Poisoning Attacks](https://mlsanity.com/paper/2502.17121/) (2025)
- [Poisoning Bayesian Inference via Data Deletion and Replication](https://mlsanity.com/paper/2503.04480/) (2025)
- [New data poison attacks on machine learning classifiers for mobile exfiltration](https://mlsanity.com/paper/2210.11592/) (2022)
- [Systematic Testing of the Data-Poisoning Robustness of KNN](https://mlsanity.com/paper/2307.08288/) (2023)
- [Invisible Backdoor Attack Through Singular Value Decomposition](https://mlsanity.com/paper/2403.13018/) (2024)
- [Analyzing Fairness of Neural Network Prediction via Counterfactual Dataset Generation](https://mlsanity.com/paper/2602.10457/) (2026)
- [Federated Learning based on Defending Against Data Poisoning Attacks in IoT](https://mlsanity.com/paper/2209.06397/) (2022)
- [Abstract Interpretation-Based Feature Importance for SVMs](https://mlsanity.com/paper/2210.12456/) (2022)
- [Attacks on Online Learners: a Teacher-Student Analysis](https://mlsanity.com/paper/2305.11132/) (2023)
- [Manipulating hidden-Markov-model inferences by corrupting batch data](https://mlsanity.com/paper/2402.13287/) (2024)
- [Timber! Poisoning Decision Trees](https://mlsanity.com/paper/2410.00862/) (2024)
- [Robustness of Selected Learning Models under Label-Flipping Attack](https://mlsanity.com/paper/2501.12516/) (2025)
- [On the Optimality of the Median-of-Means Estimator under Adversarial Contamination](https://mlsanity.com/paper/2510.07867/) (2025)
- [On Robustness of Linear Classifiers to Targeted Data Poisoning](https://mlsanity.com/paper/2511.12722/) (2025)

## Abstract (arXiv)

Machine learning algorithms are increasingly being applied in security-related tasks such as spam and malware detection, although their security properties against deliberate attacks have not yet been widely understood. Intelligent and adaptive attackers may indeed exploit specific vulnerabilities exposed by machine learning techniques to violate system security. Being robust to adversarial data manipulation is thus an important, additional requirement for machine learning algorithms to successfully operate in adversarial settings. In this work, we evaluate the security of Support Vector Machines (SVMs) to well-crafted, adversarial label noise attacks. In particular, we consider an attacker that aims to maximize the SVM's classification error by flipping a number of labels in the training data. We formalize a corresponding optimal attack strategy, and solve it by means of heuristic approaches to keep the computational complexity tractable. We report an extensive experimental analysis on the effectiveness of the considered attacks against linear and non-linear SVMs, both on synthetic and real-world datasets. We finally argue that our approach can also provide useful insights for developing more secure SVM learning algorithms, and also novel techniques in a number of related research areas, such as semi-supervised and active learning.