The poison of dimensionality
Not on the map. Why?
Abstract (arXiv)
This paper advances the understanding of how the size of a machine learning model affects its vulnerability to poisoning, despite state-of-the-art defenses. Given isotropic random honest feature vectors and the geometric median (or clipped mean) as the robust gradient aggregator rule, we essentially prove that, perhaps surprisingly, linear and logistic regressions with D ≥ 169 H2/P2 parameters are subject to arbitrary model manipulation by poisoners, where H and P are the numbers of honestly labeled and poisoned data points used for training. Our experiments go on exposing a fundamental tradeoff between augmenting model expressivity and increasing the poisoners' attack surface, on both synthetic data, and on MNIST & FashionMNIST data for linear classifiers with random features. We also discuss potential implications for source-based learning and neural nets.
Key facts. Cited by 3 papers in the map (data through 7 Oct 2026). Builds on 52 of its 80 references that are in the map. First posted on arXiv 25 Sep 2024.
Builds on
52 of 80 references.
References · 52
- 2020Language Models are Few-Shot Learnerscited by 32,199
- 2022PaLM: Scaling Language Modeling with Pathwayscited by 5,304
- 2017Fashion-MNIST: a Novel Image Dataset for Benchmarking Machine Learning Algorithmscited by 4,283
- 2021Switch Transformers: Scaling to Trillion Parameter Models with Simple and Efficient Sparsitycited by 3,014
- 2016Understanding deep learning requires rethinking generalizationcited by 1,657
- 2018Reconciling modern machine learning practice and the bias-variance trade-offcited by 919
- 2016Practical Black-Box Attacks against Machine Learningcited by 893
- 2018Byzantine-Robust Distributed Learning: Towards Optimal Statistical Ratescited by 698
- 2019Deep Double Descent: Where Bigger Models and More Data Hurtcited by 667
- 2019Surprises in High-Dimensional Ridgeless Least Squares Interpolationcited by 508
- 2024Sleeper Agents: Training Deceptive LLMs that Persist Through Safety Trainingcited by 478
- 2017Wild Patterns: Ten Years After the Rise of Adversarial Machine Learningcited by 411
38 more
- 2019The generalization error of random features regression: Precise asymptotics and double descent curvecited by 410
- 2018The Hidden Vulnerability of Distributed Learning in Byzantiumcited by 324
- 2019Robust Aggregation for Federated Learningcited by 314
- 2018Manipulating Machine Learning: Poisoning Attacks and Countermeasures for Regression Learningcited by 219
- 2023Glaze: Protecting Artists from Style Mimicry by Text-to-Image Modelscited by 200
- 2019Two models of double descent for weak featurescited by 194
- 2018RSA: Byzantine-Robust Stochastic Aggregation Methods for Distributed Learning from Heterogeneous Datasetscited by 148
- 2020Byzantine-Robust Learning on Heterogeneous Datasets via Bucketingcited by 125
- 2019Harmless interpolation of noisy data in regressioncited by 121
- 2020Adversarial Machine Learning -- Industry Perspectivescited by 121
- 2022FLDetector: Defending Federated Learning Against Model Poisoning Attacks via Detecting Malicious Clientscited by 119
- 2020RAB: Provable Robustness Against Backdoor Attackscited by 115
- 2020MetaPoison: Practical General-purpose Clean-label Data Poisoningcited by 114
- 2020Deep Partition Aggregation: Provable Defense against General Poisoning Attackscited by 112
- 2020Certified Robustness to Label-Flipping Attacks via Randomized Smoothingcited by 103
- 2021Gradient Inversion with Generative Image Priorcited by 101
- 2020Intrinsic Certified Robustness of Bagging against Data Poisoning Attackscited by 90
- 2020Strong Data Augmentation Sanitizes Poisoning and Backdoor Attacks Without an Accuracy Tradeoffcited by 86
- 2020On the Effectiveness of Mitigating Data Poisoning Attacks with Gradient Shapingcited by 82
- 2019Data Poisoning against Differentially-Private Learners: Attacks and Defensescited by 75
- 2020Subpopulation Data Poisoning Attackscited by 68
- 2022Planting Undetectable Backdoors in Machine Learning Modelscited by 55
- 2020Collaborative Learning in the Jungle (Decentralized, Byzantine, Heterogeneous, Asynchronous and Nonconvex Learning)cited by 54
- 2022Improved Certified Defenses against Data Poisoning with (Deterministic) Finite Aggregationcited by 50
- 2018Residual Unfairness in Fair Machine Learning from Prejudiced Datacited by 49
- 2016Geometric Median in Nearly Linear Timecited by 38
- 2017ByRDiE: Byzantine-resilient distributed coordinate descent for decentralized learningcited by 36
- 2022Learning to Invert: Simple Adaptive Attacks for Gradient Inversion in Federated Learningcited by 30
- 2022On the Impossible Safety of Large AI Modelscited by 27
- 2023Robust Distributed Learning: Tight Error Bounds and Breakdown Point under Data Heterogeneitycited by 25
- 2023Exploring the Limits of Model-Targeted Indiscriminate Data Poisoning Attackscited by 23
- 2019Election Coding for Distributed Learning: Protecting SignSGD against Byzantine Attackscited by 20
- 2021Robust Training in High Dimensions via Block Coordinate Geometric Median Descentcited by 20
- 2023Gradient Descent with Linearly Correlated Noise: Theory and Applications to Differential Privacycited by 18
- 2021Persia: An Open, Hybrid System Scaling Deep Learning-based Recommenders up to 100 Trillion Parameterscited by 17
- 2022An Equivalence Between Data Poisoning and Byzantine Gradient Attackscited by 16
- 2022Lethal Dose Conjecture on Data Poisoningcited by 12
- 2020Data Poisoning Attacks on Regression Learning and Corresponding Defensescited by 10
50 most cited of 52 All 52 (JSON)
Built on by
Citing papers per year: 2025: 3.
3 papers.