Online AutoML: Evaluating Poisoning Attacks on Adversarial Training Defense Strategy in IoT Networks
Study tests adversarial training against label-flip and noise poisoning of streaming AutoML models for IoT.
The paper evaluates adversarial training against label-flip and noise-injection poisoning in an online AutoML pipeline for IoT networks. Streaming learners tested are Hoeffding Tree, Leveraging Bagging, Adaptive Random Forest, Hoeffding Adaptive Tree, and Streaming Random Patches. At poisoning rate 1.0, adversarially trained Streaming Random Patches scored F1 0.904 on label flips, while Leveraging Bagging scored F1 0.933 on noise injection. Drift-detection methods were used for rolling accuracy and prequential evaluation.
- Evaluates label-flip and noise-injection poisoning on streaming learners
- AT-SRP reached F1 0.904 against label flips at rate 1.0
- AT-LB reached F1 0.933 against noise injection at rate 1.0
- Drift detectors supported rolling accuracy and prequential evaluation
Full article197 words · extracted from arxiv.org · click to collapse
Machine learning (ML)-powered poisoning attack vectors are adversarial maneuvers whereby an attacker intentionally inserts, corrupts, or alters training data to distort an ML model's learning process. The objective is to diminish model efficacy, instill biases, induce misclassifications, or include concealed backdoors that may be attacked during implementation. In streaming contexts, poisoning attacks pose significant risks since models perpetually update based on incoming streams of data. An assailant may incrementally introduce harmful samples into this data stream, leading the model to assimilate erroneous features over time without timely identification. Therefore, this study is aimed at evaluating the efficacy of the adversarial training (AT) defense approach against poisoning attacks (label flip and noise injection) using an online AutoML pipeline for Internet of Things (IoT) networks. Specifically, poisoning attacks (label flip and noise injection) were applied to streaming-capable AutoML learners (Hoeffding Tree (HT), Leveraging Bagging (LB), Adaptive Random Forest (ARF), Hoeffding Adaptive Tree (HAT), and Streaming Random Patches (SRP)). Under the strongest poisoning rate (PR = 1.0), AT-SRP achieved the highest F1-score against label flip poisoning (0.904), while AT-LB achieved the highest F1-score against noise-injection poisoning (0.933). Finally, several drift detection methods were used for rolling accuracy and prequential evaluation.
Text extracted automatically; images, tables and formatting may be missing. Original: https://arxiv.org/abs/2610.05810