Adversarial Poisoning Attacks and Defense for General Multi-Class Models
  Based On Synthetic Reduced Nearest Neighbors
  State-of-the-art machine learning models are vulnerable to data poisoning
attacks whose purpose is to undermine the integrity of the model. However, the
current literature on data poisoning attacks is mainly focused on ad hoc
techniques that are only applicable to specific machine learning models.
Additionally, the existing data poisoning attacks in the literature are limited
to either binary classifiers or to gradient-based algorithms. To address these
limitations, this paper first proposes a novel model-free label-flipping attack
based on the multi-modality of the data, in which the adversary targets the
clusters of classes while constrained by a label-flipping budget. The
complexity of our proposed attack algorithm is linear in time over the size of
the dataset. Also, the proposed attack can increase the error up to two times
for the same attack budget. Second, a novel defense technique based on the
Synthetic Reduced Nearest Neighbor (SRNN) model is proposed. The defense
technique can detect and exclude flipped samples on the fly during the training
procedure. Through extensive experimental analysis, we demonstrate that (i) the
proposed attack technique can deteriorate the accuracy of several models
drastically, and (ii) under the proposed attack, the proposed defense technique
significantly outperforms other conventional machine learning models in
recovering the accuracy of the targeted model.
