Abstract
With the rise of third parties in the machine learning pipeline, the service
provider in "Machine Learning as a Service" (MLaaS), or external data
contributors in online learning, or the retraining of existing models, the need
to ensure the security of the resulting machine learning models has become an
increasingly important topic. The security community has demonstrated that
without transparency of the data and the resulting model, there exist many
potential security risks, with new risks constantly being discovered.
In this paper, we focus on one of these security risks -- poisoning attacks.
Specifically, we analyze how attackers may interfere with the results of
regression learning by poisoning the training datasets. To this end, we analyze
and develop a new poisoning attack algorithm. Our attack, termed Nopt, in
contrast with previous poisoning attack algorithms, can produce larger errors
with the same proportion of poisoning data-points. Furthermore, we also
significantly improve the state-of-the-art defense algorithm, termed TRIM,
proposed by Jagielsk et al. (IEEE S&P 2018), by incorporating the concept of
probability estimation of clean data-points into the algorithm. Our new defense
algorithm, termed Proda, demonstrates an increased effectiveness in reducing
errors arising from the poisoning dataset through optimizing ensemble models.
We highlight that the time complexity of TRIM had not been estimated; however,
we deduce from their work that TRIM can take exponential time complexity in the
worst-case scenario, in excess of Proda's logarithmic time. The performance of
both our proposed attack and defense algorithms is extensively evaluated on
four real-world datasets of housing prices, loans, health care, and bike
sharing services. We hope that our work will inspire future research to develop
more robust learning algorithms immune to poisoning attacks.