Stealthy Poisoning Attacks Bypass Defenses in Regression Settings

TL;DR

This paper addresses the vulnerability of regression models to data poisoning by introducing a stealthy, multiobjective bilevel attack that trades off attack effectiveness with detectability under soft constraints. It shows that state-of-the-art defenses often fail to mitigate such stealthy attacks, especially when the attacker poisons a larger fraction of the data. To counter this, the authors propose BayesClean, a defense based on Bayesian linear regression that uses predictive variance to reject suspicious points without requiring prior knowledge of the poisoning ratio or a trusted set. Empirical results on LR and DNNs across real-world datasets demonstrate the limitations of existing defenses and the robustness of BayesClean, particularly under high poisoning regimes. The work highlights the critical role of model uncertainty in defending regression systems and outlines a path toward uncertainty-aware defenses against poisoning threats.

Abstract

Regression models are widely used in industrial processes, engineering and in natural and physical sciences, yet their robustness to poisoning has received less attention. When it has, studies often assume unrealistic threat models and are thus less useful in practice. In this paper, we propose a novel optimal stealthy attack formulation that considers different degrees of detectability and show that it bypasses state-of-the-art defenses. We further propose a new methodology based on normalization of objectives to evaluate different trade-offs between effectiveness and detectability. Finally, we develop a novel defense (BayesClean) against stealthy attacks. BayesClean improves on previous defenses when attacks are stealthy and the number of poisoning points is significant.

Figures (14)

• Figure 1: Synthetic example showing the effect of constraining poisoning points against TRIM jagielski2018manipulating. The blue points represent the clean points, the green points are the poisoning points, the red crosses are the points rejected by TRIM, the black dashed line is the regression line learned using the original clean data, the green dotted line is the regression line learned with the complete poisoned training data, and the red solid line is the regression line learned after applying TRIM. Because the poisoning points are close to the clean points, TRIM fails to detect them.
• Figure 2: Effect of not normalizing the objective functions in a synthetic example. The blue points are clean points, the green points are poisoning points, and the two red points represent a poisoning point at the beginning and at the end of the optimization process. The magenta line shows the trajectory of this point during optimization. The white dashed line is the regression line learned under the original clean data, and the red solid line is the regression line learned under the complete poisoned training data. The colormap represents the value of the attacker's objective ($\mathcal{A}_d$) as a function of the location of the poisoning point. (a) $\alpha=1$. (b) $\alpha=0.6$. (c) $\alpha=0.4$. (d) $\alpha=0.2$. Note the sudden transition for the poisoning points from outliers ($\alpha=1$) to inliers ($\alpha=\{0.6,0.4,0.2\}$). This is because the detectability objective dominates the effectiveness objective.
• Figure 3: Effect of normalizing the objective functions in a synthetic example. The blue points are the clean points, the green points are the poisoning points, and the two red points represent a poisoning point at the beginning and at the end of optimization. The trajectory of this point is shown by the magenta line. The white dashed line is the regression line learned on clean data, and the red solid line is the regression line learned under poisoning. The colormap represents the value of the attacker's objective ($\mathcal{A}_d$) as a function of the location of the poisoning point. (a) $\alpha=1$. (b) $\alpha=0.6$. (c) $\alpha=0.4$. (d) $\alpha=0.2$. Compared to Fig. \ref{['fig:no_norm']}, normalizing the objective functions allows a smoother transition for the poisoning points from outliers ($\alpha=1$) to inliers ($\alpha=\{0.6,0.4,0.2\}$).
• Figure 4: Synthetic example showing the effect of stealthy poisoning against TRIM jagielski2018manipulating, for $\alpha=1$ and $\alpha=0.4$. The blue points are the clean points, the green points are the poisoning points, the red crosses are points rejected by TRIM, The black dashed line is the regression line learned on clean data, the green dotted line is the regression line learned on the complete poisoned training data, and the red solid line is the regression line learned on training data not rejected by TRIM. TRIM fails to detect stealthy poisoning points, because they are closer to the clean distribution.
• Figure 5: Test NMSE of LR when there is no defense deployed, for $\alpha=1$, $\alpha=0.5$, $\alpha=0.3$, and $\alpha=0.1$. (a) Loan. (b) Heart Disease.