🤖 AI Summary
This work addresses the vulnerability of existing regression models to stealthy data poisoning attacks, which often evade detection under unrealistic threat assumptions prevalent in prior research. We present the first systematic characterization of covert poisoning attacks across varying detectability levels and introduce a target-normalization-based evaluation framework to rigorously quantify the trade-off between attack efficacy and detectability, enabling the construction of optimal stealthy attacks. To counter this threat, we propose BayesClean, a novel Bayesian defense mechanism that integrates robust regression with Bayesian inference. Extensive experiments demonstrate that BayesClean significantly outperforms state-of-the-art defenses under high-stealth, large-scale poisoning scenarios and effectively mitigates attacks that circumvent current defense strategies.
📝 Abstract
Regression models are widely used in industrial processes, engineering and in natural and physical sciences, yet their robustness to poisoning has received less attention. When it has, studies often assume unrealistic threat models and are thus less useful in practice. In this paper, we propose a novel optimal stealthy attack formulation that considers different degrees of detectability and show that it bypasses state-of-the-art defenses. We further propose a new methodology based on normalization of objectives to evaluate different trade-offs between effectiveness and detectability. Finally, we develop a novel defense (BayesClean) against stealthy attacks. BayesClean improves on previous defenses when attacks are stealthy and the number of poisoning points is significant.