A BIC-Based Mixture Model Defense Against Data Poisoning Attacks on Classifiers

Data Poisoning (DP) is an effective attack which degrades a trained classifier’s accuracy through covert injection of attack samples into the training set. We propose an unsupervised Bayesian Information Criterion (BIC)-based mixture model defense against DP attacks that: 1) addresses the most challenging embedded DP scenario wherein, if DP is present, the poisoned samples are an a priori unknown subset of the training set, and with no clean validation set available; 2) applies a mixture model to both well-fit potentially multi-modal class distributions and capture poisoned samples within a small subset of the mixture components; 3) jointly identifies poisoned components and samples by minimizing the BIC cost defined over the whole training set. Our experimental results demonstrate the effectiveness of our defense under strong DP attacks, as well as its superiority over other works.