A number of online services nowadays rely upon machine learning to extract
valuable information from data collected in the wild. This exposes learning
algorithms to the threat of data poisoning, i.e., a coordinate attack in which
a fraction of the training data is controlled by the attacker and manipulated
to subvert the learning process. To date, these attacks have been devised only
against a limited class of binary learning algorithms, due to the inherent
complexity of the gradient-based procedure used to optimize the poisoning
points (a.k.a. adversarial training examples). In this work, we rst extend the
de nition of poisoning attacks to multiclass problems. We then propose a novel
poisoning algorithm based on the idea of back-gradient optimization, i.e., to
compute the gradient of interest through automatic di erentiation, while also
reversing the learning procedure to drastically reduce the attack complexity.
Compared to current poisoning strategies, our approach is able to target a
wider class of learning algorithms, trained with gradient- based procedures,
including neural networks and deep learning architectures. We empirically
evaluate its e ectiveness on several application examples, including spam
ltering, malware detection, and handwritten digit recognition. We nally show
that, similarly to adversarial test examples, adversarial training examples can
also be transferred across di erent learning algorithms.

该论文提出了一种基于反向梯度优化的毒化攻击算法，能够对梯度优化训练的广泛学习算法进行攻击，并在实际应用中进行了有效性评估。