Broadly Applicable Targeted Data Sample Omission Attacks

TL;DR

This paper presents a new targeted data omission poisoning attack that can cause misclassification of specific test samples across various models and datasets, with high success rates and minimal impact on overall accuracy.

Contribution

It introduces a novel omission-based poisoning attack that is simple, effective, and applicable to multiple learning algorithms, supported by theoretical analysis.

Findings

Attack success rate exceeds 80% with low budget

Effective against diverse models including neural networks and decision trees

Minimal impact on overall model accuracy

Abstract

We introduce a novel clean-label targeted poisoning attack on learning mechanisms. While classical poisoning attacks typically corrupt data via addition, modification and omission, our attack focuses on data omission only. Our attack misclassifies a single, targeted test sample of choice, without manipulating that sample. We demonstrate the effectiveness of omission attacks against a large variety of learners including deep neural networks, SVM and decision trees, using several datasets including MNIST, IMDB and CIFAR. The focus of our attack on data omission only is beneficial as well, as it is simpler to implement and analyze. We show that, with a low attack budget, our attack's success rate is above 80%, and in some cases 100%, for white-box learning. It is systematically above the reference benchmark for black-box learning. For both white-box and black-box cases, changes in model accuracy are negligible, regardless of the specific learner and dataset. We also prove theoretically in a simplified agnostic PAC learning framework that, subject to dataset size and distribution, our omission attack succeeds with high probability against any successful simplified agnostic PAC learner.