Machine learning algorithms are vulnerable to poisoning attacks, where a
fraction of the training data is manipulated to degrade the algorithms'
performance. We show that current approaches, which typically assume that
regularization hyperparameters remain constant, lead to an overly pessimistic
view of the algorithms' robustness and of the impact of regularization. We
propose a novel optimal attack formulation that considers the effect of the
attack on the hyperparameters, modelling the attack as a \emph{minimax bilevel
optimization problem}. This allows to formulate optimal attacks, select
hyperparameters and evaluate robustness under worst case conditions. We apply
this formulation to logistic regression using $L_2$ regularization, empirically
show the limitations of previous strategies and evidence the benefits of using
$L_2$ regularization to dampen the effect of poisoning attacks.

本文提出了一种新的攻击策略，从而使训练数据集的一部分被操纵，降低机器学习算法的性能，研究结果表明，现行的方法过于悲观，提出的新方法可以作出优化攻击策略，选择最佳正则化参数，以及在最坏情况下评估模型的鲁棒性，实验结果表明，采用 $L_2$ 正则化可以缓解攻击的影响。