What Distributions are Robust to Indiscriminate Poisoning Attacks for Linear Learners?
This work addresses the vulnerability of machine learning models to data poisoning attacks, providing theoretical insights into dataset characteristics that enhance robustness, though it is incremental as it builds on existing attack frameworks.
The paper investigates whether linear learners can be inherently robust to indiscriminate poisoning attacks, finding that robustness occurs when class-wise data distributions are well-separated with low variance and the constraint set for poisoning points is small.
We study indiscriminate poisoning for linear learners where an adversary injects a few crafted examples into the training data with the goal of forcing the induced model to incur higher test error. Inspired by the observation that linear learners on some datasets are able to resist the best known attacks even without any defenses, we further investigate whether datasets can be inherently robust to indiscriminate poisoning attacks for linear learners. For theoretical Gaussian distributions, we rigorously characterize the behavior of an optimal poisoning attack, defined as the poisoning strategy that attains the maximum risk of the induced model at a given poisoning budget. Our results prove that linear learners can indeed be robust to indiscriminate poisoning if the class-wise data distributions are well-separated with low variance and the size of the constraint set containing all permissible poisoning points is also small. These findings largely explain the drastic variation in empirical attack performance of the state-of-the-art poisoning attacks on linear learners across benchmark datasets, making an important initial step towards understanding the underlying reasons some learning tasks are vulnerable to data poisoning attacks.