{"id":"https://openalex.org/W2750650104","doi":"https://doi.org/10.1145/3128572.3140451","title":"Towards Poisoning of Deep Learning Algorithms with Back-gradient Optimization","display_name":"Towards Poisoning of Deep Learning Algorithms with Back-gradient Optimization","publication_year":2017,"publication_date":"2017-11-03","ids":{"openalex":"https://openalex.org/W2750650104","doi":"https://doi.org/10.1145/3128572.3140451","mag":"2750650104"},"language":"en","primary_location":{"id":"doi:10.1145/3128572.3140451","is_oa":false,"landing_page_url":"https://doi.org/10.1145/3128572.3140451","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 10th ACM Workshop on Artificial Intelligence and Security","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["arxiv","crossref","datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://arxiv.org/pdf/1708.08689","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5032718837","display_name":"Luis Mu\u00f1oz-Gonz\u00e1lez","orcid":"https://orcid.org/0000-0001-6093-5922"},"institutions":[{"id":"https://openalex.org/I47508984","display_name":"Imperial College London","ror":"https://ror.org/041kmwe10","country_code":"GB","type":"education","lineage":["https://openalex.org/I47508984"]}],"countries":["GB"],"is_corresponding":false,"raw_author_name":"Luis Mu\u00f1oz-Gonz\u00e1lez","raw_affiliation_strings":["Imperial College, London, United Kingdom","Imperial College, London (United Kingdom)"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Imperial College, London, United Kingdom","institution_ids":["https://openalex.org/I47508984"]},{"raw_affiliation_string":"Imperial College, London (United Kingdom)","institution_ids":["https://openalex.org/I47508984"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5008367647","display_name":"Battista Biggio","orcid":"https://orcid.org/0000-0001-7752-509X"},"institutions":[{"id":"https://openalex.org/I172446870","display_name":"University of Cagliari","ror":"https://ror.org/003109y17","country_code":"IT","type":"education","lineage":["https://openalex.org/I172446870"]}],"countries":["IT"],"is_corresponding":false,"raw_author_name":"Battista Biggio","raw_affiliation_strings":["University of Cagliari, Cagliari, Italy","University Of Cagliari, Cagliari, Italy"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of Cagliari, Cagliari, Italy","institution_ids":["https://openalex.org/I172446870"]},{"raw_affiliation_string":"University Of Cagliari, Cagliari, Italy","institution_ids":["https://openalex.org/I172446870"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5005227623","display_name":"Ambra Demontis","orcid":"https://orcid.org/0000-0001-9318-6913"},"institutions":[{"id":"https://openalex.org/I172446870","display_name":"University of Cagliari","ror":"https://ror.org/003109y17","country_code":"IT","type":"education","lineage":["https://openalex.org/I172446870"]}],"countries":["IT"],"is_corresponding":false,"raw_author_name":"Ambra Demontis","raw_affiliation_strings":["University of Cagliari, Cagliari, Italy","University Of Cagliari, Cagliari, Italy"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of Cagliari, Cagliari, Italy","institution_ids":["https://openalex.org/I172446870"]},{"raw_affiliation_string":"University Of Cagliari, Cagliari, Italy","institution_ids":["https://openalex.org/I172446870"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5031096722","display_name":"Andrea Paudice","orcid":"https://orcid.org/0000-0003-1098-662X"},"institutions":[{"id":"https://openalex.org/I47508984","display_name":"Imperial College London","ror":"https://ror.org/041kmwe10","country_code":"GB","type":"education","lineage":["https://openalex.org/I47508984"]}],"countries":["GB"],"is_corresponding":false,"raw_author_name":"Andrea Paudice","raw_affiliation_strings":["Imperial College, London, United Kingdom","Imperial College, London (United Kingdom)"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Imperial College, London, United Kingdom","institution_ids":["https://openalex.org/I47508984"]},{"raw_affiliation_string":"Imperial College, London (United Kingdom)","institution_ids":["https://openalex.org/I47508984"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5033678324","display_name":"Vasin Wongrassamee","orcid":null},"institutions":[{"id":"https://openalex.org/I47508984","display_name":"Imperial College London","ror":"https://ror.org/041kmwe10","country_code":"GB","type":"education","lineage":["https://openalex.org/I47508984"]}],"countries":["GB"],"is_corresponding":false,"raw_author_name":"Vasin Wongrassamee","raw_affiliation_strings":["Imperial College, London, United Kingdom","Imperial College, London (United Kingdom)"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Imperial College, London, United Kingdom","institution_ids":["https://openalex.org/I47508984"]},{"raw_affiliation_string":"Imperial College, London (United Kingdom)","institution_ids":["https://openalex.org/I47508984"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5065619732","display_name":"Emil Lupu","orcid":"https://orcid.org/0000-0002-2844-3917"},"institutions":[{"id":"https://openalex.org/I47508984","display_name":"Imperial College London","ror":"https://ror.org/041kmwe10","country_code":"GB","type":"education","lineage":["https://openalex.org/I47508984"]}],"countries":["GB"],"is_corresponding":false,"raw_author_name":"Emil C. Lupu","raw_affiliation_strings":["Imperial College, London, United Kingdom","Imperial College, London (United Kingdom)"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Imperial College, London, United Kingdom","institution_ids":["https://openalex.org/I47508984"]},{"raw_affiliation_string":"Imperial College, London (United Kingdom)","institution_ids":["https://openalex.org/I47508984"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5065359946","display_name":"Fabio Roli","orcid":"https://orcid.org/0000-0003-4103-9190"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Fabio Roli","raw_affiliation_strings":["University of Cagliari, Cagliari, United Kingdom","University of Cagliari, Cagliari, United Kingdom#TAB#"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of Cagliari, Cagliari, United Kingdom","institution_ids":[]},{"raw_affiliation_string":"University of Cagliari, Cagliari, United Kingdom#TAB#","institution_ids":[]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":2,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":4.1527,"has_fulltext":false,"cited_by_count":98,"citation_normalized_percentile":{"value":0.96001134,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":94,"max":100},"biblio":{"volume":null,"issue":null,"first_page":"27","last_page":"38"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.9991000294685364,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.9991000294685364,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11512","display_name":"Anomaly Detection Techniques and Applications","score":0.9577999711036682,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11775","display_name":"COVID-19 diagnosis using AI","score":0.9089999794960022,"subfield":{"id":"https://openalex.org/subfields/2741","display_name":"Radiology, Nuclear Medicine and Imaging"},"field":{"id":"https://openalex.org/fields/27","display_name":"Medicine"},"domain":{"id":"https://openalex.org/domains/4","display_name":"Health Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.7845643162727356},{"id":"https://openalex.org/keywords/machine-learning","display_name":"Machine learning","score":0.7543771266937256},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.7430603504180908},{"id":"https://openalex.org/keywords/adversarial-system","display_name":"Adversarial system","score":0.6385016441345215},{"id":"https://openalex.org/keywords/deep-learning","display_name":"Deep learning","score":0.5693668127059937},{"id":"https://openalex.org/keywords/algorithm","display_name":"Algorithm","score":0.5542848110198975},{"id":"https://openalex.org/keywords/class","display_name":"Class (philosophy)","score":0.542005717754364},{"id":"https://openalex.org/keywords/malware","display_name":"Malware","score":0.5255228877067566},{"id":"https://openalex.org/keywords/artificial-neural-network","display_name":"Artificial neural network","score":0.5226609110832214},{"id":"https://openalex.org/keywords/fraction","display_name":"Fraction (chemistry)","score":0.4496963620185852},{"id":"https://openalex.org/keywords/adversarial-machine-learning","display_name":"Adversarial machine learning","score":0.4431697130203247},{"id":"https://openalex.org/keywords/process","display_name":"Process (computing)","score":0.43503430485725403},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.16012659668922424}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7845643162727356},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.7543771266937256},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.7430603504180908},{"id":"https://openalex.org/C37736160","wikidata":"https://www.wikidata.org/wiki/Q1801315","display_name":"Adversarial system","level":2,"score":0.6385016441345215},{"id":"https://openalex.org/C108583219","wikidata":"https://www.wikidata.org/wiki/Q197536","display_name":"Deep learning","level":2,"score":0.5693668127059937},{"id":"https://openalex.org/C11413529","wikidata":"https://www.wikidata.org/wiki/Q8366","display_name":"Algorithm","level":1,"score":0.5542848110198975},{"id":"https://openalex.org/C2777212361","wikidata":"https://www.wikidata.org/wiki/Q5127848","display_name":"Class (philosophy)","level":2,"score":0.542005717754364},{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.5255228877067566},{"id":"https://openalex.org/C50644808","wikidata":"https://www.wikidata.org/wiki/Q192776","display_name":"Artificial neural network","level":2,"score":0.5226609110832214},{"id":"https://openalex.org/C149629883","wikidata":"https://www.wikidata.org/wiki/Q660926","display_name":"Fraction (chemistry)","level":2,"score":0.4496963620185852},{"id":"https://openalex.org/C2778403875","wikidata":"https://www.wikidata.org/wiki/Q20312394","display_name":"Adversarial machine learning","level":3,"score":0.4431697130203247},{"id":"https://openalex.org/C98045186","wikidata":"https://www.wikidata.org/wiki/Q205663","display_name":"Process (computing)","level":2,"score":0.43503430485725403},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.16012659668922424},{"id":"https://openalex.org/C178790620","wikidata":"https://www.wikidata.org/wiki/Q11351","display_name":"Organic chemistry","level":1,"score":0.0},{"id":"https://openalex.org/C185592680","wikidata":"https://www.wikidata.org/wiki/Q2329","display_name":"Chemistry","level":0,"score":0.0},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.0}],"mesh":[],"locations_count":5,"locations":[{"id":"doi:10.1145/3128572.3140451","is_oa":false,"landing_page_url":"https://doi.org/10.1145/3128572.3140451","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 10th ACM Workshop on Artificial Intelligence and Security","raw_type":"proceedings-article"},{"id":"pmh:oai:arXiv.org:1708.08689","is_oa":true,"landing_page_url":"http://arxiv.org/abs/1708.08689","pdf_url":"https://arxiv.org/pdf/1708.08689","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},{"id":"mag:2750650104","is_oa":true,"landing_page_url":"https://arxiv.org/pdf/1708.08689","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"arXiv (Cornell University)","raw_type":null},{"id":"pmh:oai:spiral.imperial.ac.uk:10044/1/54926","is_oa":false,"landing_page_url":"http://arxiv.org/abs/1708.08689v1","pdf_url":null,"source":{"id":"https://openalex.org/S4306401396","display_name":"Spiral (Imperial College London)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I47508984","host_organization_name":"Imperial College London","host_organization_lineage":["https://openalex.org/I47508984"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"","raw_type":"Journal Article"},{"id":"doi:10.48550/arxiv.1708.08689","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.1708.08689","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"pmh:oai:arXiv.org:1708.08689","is_oa":true,"landing_page_url":"http://arxiv.org/abs/1708.08689","pdf_url":"https://arxiv.org/pdf/1708.08689","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},"sustainable_development_goals":[],"awards":[{"id":"https://openalex.org/G1181013235","display_name":null,"funder_award_id":"EP/L022729/1","funder_id":"https://openalex.org/F4320334627","funder_display_name":"Engineering and Physical Sciences Research Council"}],"funders":[{"id":"https://openalex.org/F4320334627","display_name":"Engineering and Physical Sciences Research Council","ror":"https://ror.org/0439y7842"}],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":22,"referenced_works":["https://openalex.org/W1551848773","https://openalex.org/W1968998685","https://openalex.org/W2006903949","https://openalex.org/W2007562169","https://openalex.org/W2038296020","https://openalex.org/W2082190528","https://openalex.org/W2089103284","https://openalex.org/W2095577883","https://openalex.org/W2105037940","https://openalex.org/W2112796928","https://openalex.org/W2125908420","https://openalex.org/W2134063365","https://openalex.org/W2144906988","https://openalex.org/W2151298633","https://openalex.org/W2162552722","https://openalex.org/W2166107799","https://openalex.org/W2180612164","https://openalex.org/W2224750461","https://openalex.org/W2543927648","https://openalex.org/W2603766943","https://openalex.org/W3103836116","https://openalex.org/W4236045902"],"related_works":["https://openalex.org/W2964043980","https://openalex.org/W3192801748","https://openalex.org/W2914158293","https://openalex.org/W2755252132","https://openalex.org/W3135626921","https://openalex.org/W2908130370","https://openalex.org/W2943919788","https://openalex.org/W2030611346","https://openalex.org/W3090048791","https://openalex.org/W2949152835","https://openalex.org/W3122766170","https://openalex.org/W2963162645","https://openalex.org/W770810907","https://openalex.org/W2782946658","https://openalex.org/W2768862435","https://openalex.org/W3006620186","https://openalex.org/W2905442364","https://openalex.org/W2187013920","https://openalex.org/W2782796106","https://openalex.org/W3183228686"],"abstract_inverted_index":{"A":[0],"number":[1],"of":[2,27,38,66,75,97,114,122,153],"online":[3],"services":[4],"nowadays":[5],"rely":[6],"upon":[7],"machine":[8],"learning":[9,22,52,68,131,154,165,203],"to":[10,24,49,71,80,100,118,133,140,148,190],"extract":[11],"valuable":[12],"information":[13],"from":[14],"data":[15,28,41],"collected":[16],"in":[17,34],"the":[18,25,39,45,51,72,76,82,95,112,120,130,136],"wild.":[19],"This":[20],"exposes":[21],"algorithms":[23],"threat":[26],"poisoning,":[29],"i.e.,":[30,117],"a":[31,36,63,106,150],"coordinate":[32],"attack":[33,137],"which":[35],"fraction":[37],"training":[40,87,195],"is":[42,146],"controlled":[43],"by":[44],"attacker":[46],"and":[47,163,181],"manipulated":[48],"subvert":[50],"process.":[53],"To":[54],"date,":[55],"these":[56],"attacks":[57,99],"have":[58],"been":[59],"devised":[60],"only":[61],"against":[62],"limited":[64],"class":[65,152],"binary":[67],"algorithms,":[69,155],"due":[70],"inherent":[73],"complexity":[74],"gradient-based":[77,158],"procedure":[78,132],"used":[79],"optimize":[81],"poisoning":[83,98,108,142],"points":[84],"(a.k.a.":[85],"adversarial":[86,191,194],"examples).":[88],"In":[89],"this":[90],"work,":[91],"we":[92],"first":[93],"extend":[94],"definition":[96],"multiclass":[101],"problems.":[102],"We":[103,167,185],"then":[104],"propose":[105],"novel":[107],"algorithm":[109],"based":[110],"on":[111,172],"idea":[113],"back-gradient":[115],"optimization,":[116],"compute":[119],"gradient":[121],"interest":[123],"through":[124],"automatic":[125],"differentiation,":[126],"while":[127],"also":[128,198],"reversing":[129],"drastically":[134],"reduce":[135],"complexity.":[138],"Compared":[139],"current":[141],"strategies,":[143],"our":[144],"approach":[145],"able":[147],"target":[149],"wider":[151],"trained":[156],"with":[157],"procedures,":[159],"including":[160,176],"neural":[161],"networks":[162],"deep":[164],"architectures.":[166],"empirically":[168],"evaluate":[169],"its":[170],"effectiveness":[171],"several":[173],"application":[174],"examples,":[175,193],"spam":[177],"filtering,":[178],"malware":[179],"detection,":[180],"handwritten":[182],"digit":[183],"recognition.":[184],"finally":[186],"show":[187],"that,":[188],"similarly":[189],"test":[192],"examples":[196],"can":[197],"be":[199],"transferred":[200],"across":[201],"different":[202],"algorithms.":[204]},"counts_by_year":[{"year":2025,"cited_by_count":6},{"year":2024,"cited_by_count":6},{"year":2023,"cited_by_count":16},{"year":2022,"cited_by_count":23},{"year":2021,"cited_by_count":17},{"year":2020,"cited_by_count":18},{"year":2019,"cited_by_count":10},{"year":2018,"cited_by_count":2}],"updated_date":"2026-07-29T14:22:42.915294","created_date":"2025-10-10T00:00:00"}