Model-Targeted Data Poisoning Attacks against ITS Applications with Provable Convergence

TL;DR

This work tackles model-targeted data poisoning in ITS by casting attacks as bi-level optimization with a constrained lower-level learning problem. It introduces Lipschitz continuity of the model solution and develops a semi-derivative descent to compute data perturbations, enabling convergence to any attainable target model even when differentiability fails due to constraints. The approach is validated on an SVM-based lane-change detector using real trajectory data, showing that semi-derivative attacks reliably steer the model toward a predefined target while gradient-based attacks may fail or be slower. The results highlight the vulnerability of constrained ITS models to sophisticated poisoning and offer a concrete framework for understanding and defending such systems.

Abstract

The growing reliance of intelligent systems on data makes the systems vulnerable to data poisoning attacks. Such attacks could compromise machine learning or deep learning models by disrupting the input data. Previous studies on data poisoning attacks are subject to specific assumptions, and limited attention is given to learning models with general (equality and inequality) constraints or lacking differentiability. Such learning models are common in practice, especially in Intelligent Transportation Systems (ITS) that involve physical or domain knowledge as specific model constraints. Motivated by ITS applications, this paper formulates a model-target data poisoning attack as a bi-level optimization problem with a constrained lower-level problem, aiming to induce the model solution toward a target solution specified by the adversary by modifying the training data incrementally. As the gradient-based methods fail to solve this optimization problem, we propose to study the Lipschitz continuity property of the model solution, enabling us to calculate the semi-derivative, a one-sided directional derivative, of the solution over data. We leverage semi-derivative descent to solve the bi-level optimization problem, and establish the convergence conditions of the method to any attainable target model. The model and solution method are illustrated with a simulation of a poisoning attack on the lane change detection using SVM.

Figures (2)

• Figure 1: Consider a bi-level optimization problem:$max_x G(x,\hat{y})=x+2\hat{y}$$s.t.$$|x| \leq 1$, $\hat{y} \in \operatorname{argmin}\{y: x+y\geq 0;y-x \geq 0\}$, the solution of lower problem is $\hat{y}=|x|$, and the upper objective function $G(x,\hat{y}(x))= x+2|x|$, as shown above , is non-differentiable. Though the gradient is nonexistent, the semi-derivatives at pristine data w.r.t. all possible perturbation directions (right or left) do exist, which can be used to define and solve attacks.
• Figure 2: A) Comparing convergence of the proposed attack with the gradient method. B) Poisoned model and data following the proposed attack.

Theorems & Definitions (10)

• Definition 1: Lipschitz continuity
• Definition 2: Semi-derivative Dontchev2009Implicit
• Theorem 1
• Definition 3: Attainable target model
• Definition 4: Feasible attack direction
• Corollary 1: Optimality condition
• Theorem 2
• Definition 5: Directional differentiability
• Definition 6: Twice directional differentiable
• Definition 7: Strong convexity