Support Vector Machines (SVMs) are vulnerable to targeted training data
manipulations such as poisoning attacks and label flips. By carefully
manipulating a subset of training samples, the attacker forces the learner to
compute an incorrect decision boundary, thereby cause misclassifications.
Considering the increased importance of SVMs in engineering and life-critical
applications, we develop a novel defense algorithm that improves resistance
against such attacks. Local Intrinsic Dimensionality (LID) is a promising
metric that characterizes the outlierness of data samples. In this work, we
introduce a new approximation of LID called K-LID that uses kernel distance in
the LID calculation, which allows LID to be calculated in high dimensional
transformed spaces. We introduce a weighted SVM against such attacks using
K-LID as a distinguishing characteristic that de-emphasizes the effect of
suspicious data samples on the SVM decision boundary. Each sample is weighted
on how likely its K-LID value is from the benign K-LID distribution rather than
the attacked K-LID distribution. We then demonstrate how the proposed defense
can be applied to a distributed SVM framework through a case study on an
SDR-based surveillance system. Experiments with benchmark data sets show that
the proposed defense reduces classification error rates substantially (10% on
average).