Adversarial Training for Defense Against Label Poisoning Attacks

TL;DR

This paper introduces FLORAL, an adversarial training method using SVMs within a bilevel optimization framework, to defend against label poisoning attacks that compromise model integrity.

Contribution

The paper presents a novel SVM-based adversarial training strategy with theoretical convergence analysis for defending against label poisoning attacks.

Findings

FLORAL outperforms robust baselines in various classification tasks.

It achieves higher robust accuracy under increasing attacker budgets.

Effective across diverse model architectures.

Abstract

As machine learning models grow in complexity and increasingly rely on publicly sourced data, such as the human-annotated labels used in training large language models, they become more vulnerable to label poisoning attacks. These attacks, in which adversaries subtly alter the labels within a training dataset, can severely degrade model performance, posing significant risks in critical applications. In this paper, we propose FLORAL, a novel adversarial training defense strategy based on support vector machines (SVMs) to counter these threats. Utilizing a bilevel optimization framework, we cast the training process as a non-zero-sum Stackelberg game between an attacker, who strategically poisons critical training labels, and the model, which seeks to recover from such attacks. Our approach accommodates various model architectures and employs a projected gradient descent algorithm with kernel SVMs for adversarial training. We provide a theoretical analysis of our algorithm's convergence properties and empirically evaluate FLORAL's effectiveness across diverse classification tasks. Compared to robust baselines and foundation models such as RoBERTa, FLORAL consistently achieves higher robust accuracy under increasing attacker budgets. These results underscore the potential of FLORAL to enhance the resilience of machine learning models against label poisoning threats, thereby ensuring robust classification in adversarial settings.