Adversarial Label Flips Attack on Support Vector Machines

To develop a robust learning algorithm in the adversarial setting, it is important to understand the adversary's strategy. We address the problem of label flips attack where an adversary contaminates the training data through flipping labels. We analyze the objective of the adversary and formulate an optimization problem for finding the optimal label flips under a given budget. An attack algorithm targeting support vector machines (SVMs) is derived. Experiments demonstrate that the performance of SVMs is significantly degraded under the attack.