2/20/2024

1

Presentation Outline

Demonstrating Data Poisoning Attacks onML Models with Multi-Sensor Inputs• Background• Poisoning Attack

Shyam Maisuria

Yuichi Ohsita• Experiment

Masayuki Murata• Results• Conclusion

2/22

1

2

Background1• Many Machine Learning(ML) based systems uses multiple sensors• It is possible that some sensors are hacked by the attacker• The ML model can also be attacked from the hacked sensors

Background• Kurniawan et al demonstrated the possibility of this kind of attacks as an adversarial examples

Sensors not hacked[1] Ade Kurniawan, Yuichi Ohsita, and Masayuki Murata. Experiments on Adversarial Examples for Deep Learning Model Using Multimodal Sensors. Sensors,22(22):8642, nov 2022.

3

4/22

4Goal of ResearchObjective: Investigate data poisoning attacks and their profound impact on machine learningmodels.

What is Data Poisoning Attacks?

Why Focus on Data Poisoning Attacks?







Poisoning Attack

Machine learning model is trained using compromised data.

Significant Impact: These attacks can severely compromise model integrity, making them acritical concern.
Long-Term Consequences: Once attacked, models may remain vulnerable over an extended
period.

Our Research Aims To:
Demonstrate the possibility of the data poisoning attack from a part of sensors
5/22

561

2/20/2024

Poisoning Attack Scenario

Generation of attacks• The attacker installs an attacker• Attacker’s ability•

An attacker hacked a part of sensors•generator model that changes theSensors hacked

output of sensors.

Attacker can obtain the values of the hacked sensors•• The attack generator model isAttacker cannot obtain the values of the othersensors•

trained in advance by using theAttacker can change the values of the hacked

knowledge of the attacker

sensors before the values are sent to the model•

We assume that the attacker has enough knowledge
about the target model
7/22

7

8/22

8

How to train the generator2•Input for Attack Generator
Model: Hacked sensor dataExperiments•Output from Attack Generator
Model: Generated poisoned
data•Training Objective: Minimize
loss function A to degrade
target model accuracy[2] Luis Mu˜noz-Gonz´alez, Battista Biggio, Ambra Demontis, Andrea Paudice, Vasin Wongrassamee, Emil C. Lupu, and Fabio Roli. Towards poisoning of deep learningalgorithms with back-gradient optimization. AISec 2017 - Proc. 10th ACM Work. Artif. Intell. Secur. co-located with CCS 2017, pages 27–38, 2017.

9/22

910Target Model4

Secure Water Treatment Plant (Swat)3

Definition of Anomaly Score• Secure Water Treatment (Swat) is a water treatment site forcybersecurity research• 11 days of continuous operation:• 7 days under normal operation• 4 days with attack scenarios• 51 sensors and actuators• Total of 6 different water treatment processors[3]Jonathan Goh, Sridhar Adepu, Khurum Nazir Junejo, and Aditya Mathur. A dataset to support research in the design of secure water treatment systems. Lect. Notes
11/22
Comput. Sci. (including Subser. Lect. Notes Artif. Intell. Lect. Notes Bioinformatics), 10242 LNCS(October):88–99, 2017.

11•Anomaly Score was used as a metric•

Dt is prediction error•••

S is anomaly score
H and L are 90 and 20 percentile values of Dt
S is greater than 0.3 anomaly is detected[4]Jonguk Kim, Jeong Han Yun, and Hyoung Chun Kim. Anomaly detection for industrial control systems using sequence-to-sequence neural networks. Lect.
Notes Comput. Sci. (including Subser. Lect. Notes Artif. Intell. Lect. Notes Bioinformatics), 11980 LNCS:3–18, 2020.

12/22

122

2/20/2024

Attackers' objective

Target Model• Objective function = weighted sum loss function• Each model is based on each process from Swat••dataset= generator models objective = target models• We only focused on process 5objective• Which has total of 13 sensors and actuators• Alpha(α) controls the importance of each of the objective• Target model is trained using those 13 sensors

functionand actuators• Model accuracy: 71%• Alpha(α) = low : prioritize evading detection• Found attacks: 5/7• Alpha(α) = high: prioritize effectiveness of attack

13/22

13

14/22

14

Target Model – Features

Hacked Sensors

15/22

15

16/22

16

Anomaly Scores of Target ModelResults

18/22

17183

2/20/2024

Anomaly Scores with varied data points

Anomaly Scores with varied alpha values• Alpha = 0.5 is constant• Number of datapoints is constant at 7000sec• As number of datapoints increase anomaly scores decrease• As alpha value increases the anomaly score decreases• Shows poisoning attack is successful if we use more datapoints• Shows poisoning attack is successful when we increase the alpha value

19/22

19

20/22

20Conclusion

Check if Target Model detects Poisoned Attack• Alpha values determine if attack is detected or not• Machine learning algorithms are vulnerable to data poisoning (compromising• Higher alpha values = attack gets detected and poisoning attack is stronger

data collection), including Deep Learning systems.

• Lower alpha values = avoid attack detection and poisoning attack is weaker• Target model is based on Swat anomaly detection• Poisoning attack is generated using part of hacked sensors.
• Tested and attack was successful• Next research objective is to work on countermeasures

21/22

2122/22224