Adversarial Training for Defense Against Label Poisoning Attacks
Authors: Melis Ilayda Bal
Volkan Cevher
Michael Muehlebach
Venue: ICLR 2025 Poster (2025)
Keywords: adversarial machine learning
label poisoning attacks
support vector machines
adversarial training
robust classification
bilevel optimization
projected gradient descent
data poisoning
Stackelberg game
Primary area: unsupervised, self-supervised, semi-supervised, and supervised representation learning

Abstract: As machine learning models grow in complexity and increasingly rely on publicly sourced data, such as the human-annotated labels used in training large language models, they become more vulnerable to label poisoning attacks.
These attacks, in which adversaries subtly alter the labels within a training dataset, can severely degrade model performance, posing significant risks in critical applications.
In this paper, we propose $\textbf{Floral}$, a novel adversarial training defense strategy based on support vector machines (SVMs) to counter these threats. 
Utilizing a bilevel optimization framework, we cast the training process as a non-zero-sum Stackelberg game between an $\textit{attacker}$, who strategically poisons critical training labels, and the $\textit{model}$, which seeks to recover from such attacks. 
Our approach accommodates various model architectures and employs a projected gradient descent algorithm with kernel SVMs for adversarial training. 
We provide a theoretical analysis of our algorithm’s convergence properties and empirically evaluate $\textbf{Floral}$'s effectiveness across diverse classification tasks.
Compared to robust baselines and foundation models such as RoBERTa, $\textbf{Floral}$ consistently achieves higher robust accuracy under increasing attacker budgets.
These results underscore the potential of $\textbf{Floral}$ to enhance the resilience of machine learning models against label poisoning threats, 
thereby ensuring robust classification in adversarial settings.

Published as a conference paper at ICLR 2025
ADVERSARIAL TRAINING FOR DEFENSE AGAINST LABEL POISONING ATTACKS
Melis Ilayda Bal'; Volkan Cevher²., Michael Muehlebach' Max Planck Institute for Intelligent Systems, Tübingen, Germany
PIINS,, EPFL 3 'AGI Foundations, Amazon (mbal, mi michaelm) @ etuebingenn mpg...p.......... de, volkan, wwwwereeefllleeooe ch, volkcevi@amazzon.
ABSTRACT
As machine learning models grow in complexity and increasingly rely on publicly sourced data, such as the auman-annotated labels used in training large language models, they become more vulnerable to label poisoning attacks. These attacks, in which adversaries subtly alter the labels within a training dataset, can severely degrade model performance, posing significant risks in critical applications. In this paper, we propose FLORAL, a novel adversarial training defense strategy based support vector machines (SVMs) to counter these threats. Utilizing bilevel op- timization framework, we cast the training process as a non-7ero-sum Stackelherg game between attacker, who strategically poisons critical training labels, and the model, which seeks to recover from such attacks. Our approach accommodates various model architectures and employs projected gradient descent algorithm with kernel SVMs for adversarial training. We provide a theoretical analysis of our algorithm's 's convergence properties and empirically evaluate FLORAL'S effectiveness across diverse classification tasks. Compared to robust baselines and foundation models such RoBERTa, FLORAL consistently achieves higher robust accuracy under increasing attacker budgets. These results underscore the potential of FLORAL enhance the resilience of machine learning models against label poisoning threats, thereby ensuring robust classification in adversarial settings.
INTRODUCTION
The susceptibility of machine learning models the integrity of their training data is a growing concern, particularly as these models become more complex and reliant on large volumes of publicly sourced data, such as the annotatd labels used training large language models (Kumar et al., 2020; Cheng et al., 2020; Wang et al., 2023). Any compromise in training data can severely undermine a model's performance and reliability (Dalvi et al., 2004; Szegedy et al., 2013), with potentially catastrophic consequences in high-stakes domains including fraud detection (Fiore et al., 2019), medical diagnosis (Finlayson et al., 2019), biological design (Bal et al., 2024b), and autonomous driving (Deng et al., 2020).
One of the most insidious forms of threat the data poisoning (causative) attacks (Barreno et al., 2010), where adversaries subtly manipulate a subset of the training data, causing the model to learn erroneous input- associations. These attacks can involve either feature or label perturbations. Unlike feature poisoning, which alters the input data itself, (Iriggerless) label poisoning is particularly challenging to detect because only the labels are modified, leaving the input data unchanged, as illustrated in Figure Deep learning models are inherently vulnerable to random label noise (Zhang et al., 2017). and this susceptibility is magnified when the noise is adversarially crafted to be more damaging. Figure 1b illustrates this vulnerability: The RoBERTa model (Liu al., 2019) fine-tuned for sentiment analysis suffers substantial performance degradation under label poisoning attacks (Zhu et al., 2022), with severity growing as the attacker's budget increases. contrast, Figure Ic highlights FLORAL's 's effectiveness in mitigating these attacks. Here, the adversarially labelled dataset is generated by poisoning the labels the most influential training points (see Appendix C.3 for details).
"Corresponding author, Code is available at ptttps///githuie com/ me1 is laydabal /floral

---

Published as a conference paper at ICLR 2025
Dual parameters Ar-
0.20
0.30
Accumiiy
0.00
Nonlinear SVM
Attacker
8:76
adversarial training via PGD:
& Di
poison labels points vin randomized top KLA, rufe
0.00
0:70
1030
2003
1000
630
0:57
270
022
1370
Adversarial da
(b) RoBERTa,
(c) FLORAL.
(a) FLORAL illustration.
20%
27%
Adv 20%
Adc: 37%
Ady 10%
Figure 1: (a): The illustration of FI.ORAL. defense, adversarial training under label poisoning attacks. (b): The test accuracy degradation of RoBERTa fine-tuned on the IMDB dataset with adversarial labels, showing its vulnerability to such attacks. (c): FLORAL effectively mitigates the impact of label poisoning in (b), achieving significantly higher robust accuracy.
line of work has addressed label poisoning through designing triggerless attacks against SVMs (Big- gio et al., 2012; Xiao et al., 2012; 2015), backdoor attacks in vision contexts (Chen et al., 2022: Jha et al., 2023) or combining label poisoning with adversarial attacks (Fowl et al., 2021; Geiping et al., 2021). Defense mechanisms typically focus on filtering (sanitization) techniques (Laishram & Phoha, 2016; Paudice et al., 2018), kernel correction (Biggio et al., 2011), 1), intrinsic dimensionality--oe ple weighting (Weerasinghe al., 2021) robust learning (Steinhardt et al., 2017). Adversarial train- ing (AT) (Goodfellow et al., 2015; Madry et al., 2017) a widely adopted empirical defense against data poisoning- particuuatllry for feature perturbations framing the interaction and training models on adversarially perturbed data (Huang et al., 2015; Kurakin et al., 2016). How- ever, shown in our experiments (Section 4. 4,,,, conventional AT does not adequately defend against label poisoning attacks, and its direct application to label poisoning remains largely unexplored.
sam-
zero-sum game
In this paper, we address robust classification under label poisoning attacks and introduce FL.RRLL (Flipping Labels for Adversarial Learning), an SVM-based adversarial training defense that can be seamlessly adapted other model architectures. We formulate our defense strategy as a bilevel optimization problem (Robey et al., 2024), enabling computationally efficient generation of optimal label attacks, and forming non-zero-sum Stackelberg game between an attacker (or adversary), targeting critical training labels, and the model, recovering from such attacks. We propose a projected gradient descent algorithm tailored for kernel SVMs to solve the bilevel optimization problem. Our experiments on various classification tasks demonstrate that FLORAL improves robustness in the face of adversarially manipulated labels by effectively leveraging the inherent robustness of SVMs combined with the strengths of adversarial training, achieving enhanced model resilience against label poisoning while maintaining a balance with classification accuracy.
Contributions. Our main contributions are the following.
We propose FLORAL, support vector machine-based adversarial training strategy that defends against label poisoning attacks. To the best of our knowledge, this is the first work to introduce adversarial training as a defense specifically for label poisoning attacks. We consider kernel SVMs in our formulation, however, as we show in our experiments, the method can be easily integrated with other models such neural networks.
We utilize a bilevel optimization formulation for the robust learning problem, leading to a non-zero-sum Stackelberg game between an attacker who poisons the labels of influential training points and the model trying to recover from such attacks. We provide a projected gradient descent (asD) algorithm to solve the game efficiently.
We theoretically analyze the local asymptotic stability of our algorithm by proving that its iterative updates remain bounded and characterizing its convergence to the Stackelherg equilibrium.
We empirically analyze FLORAL'S 's effectiveness through experiments various classification tasks against robust baselines as well as foundation models such as RoBERTa. Our results demonstrate that as the attacker's budget increases, FLORAL maintains higher robust accuracy compared to baselines trained on adversarial data.
Finally, we show the generalizability of FLORAL against attacks from the literature, al fa, alfa-tilt (Xiao et al., 2015) and LFA (Paudice et al., 2018), which aim to maximize the difference in empirical risk between classifiers trained on tainted and untainted label sets.
2

---

Published as a conference paper at ICLR 2025
less robust
all vulnerable
more robust more robust
classifier
feature attack
label attack
Figure 2: Sensitivity of the decision boundary to label poisoning attacks. The vulnerability of data points differs between feature perturbation and label poisoning attacks. Given a perfect classifier, points near the decision boundary are less robust to feature attacks (Zhang et al., 2021; Xu et al., 2023), leading to localized shifts in classification regions when the attack is performed. In contrast, the decision boundary has a broader sensitivity with respect to label poisoning attacks which can affect both near-boundary and distant points. By injecting incorrect labels, these attacks can create more widespread disruption and an overall degradation in classifier performance across the input space.
2 PROBLEM STATEMENT AND BACKGROUND
We tackle the problem of robust binary classification in the presence of label poisoning attacks (see Section 3 for an extension to multi-class classification). Given a training dataset D { M4) E (X. (X))))== where X' C Rd are the input features and {=1} are the binary labels (potentially in- volving adversarial labels), we consider kernel SVM classifier fx(x) == sign( (E ,, x,) +b), parametrized by À E In and bias b E I, which assigns a label to each data point and is derived from the following quadratic program (dual formulation) (Boser et al., 1992; Hearst et al., 1998):
D(fiD): min AER" -TTQA-1" - 1
subject y OSASC,
(2)
where Q _ is positive semi-definite matrix, with elements Qij y.y and 1 is the n-dimensional vector of all ones. Here, K is the Gram matrix with entries Kij = k(x,, ((),,y), 22), Vi E [n] == {1...., n), derived from kernel function k. A common kernel choice the radial basis function (RBF), given as xz) = exp(-y |z; - =,)l²), with width parameter The parameter C' > 0 is regularization term, balancing the trade-off between maximizing the margin and minimizing classification errors. In this formulation, each dual variable X, i E [m] corresponds to the Lagrange multiplier associated with the misclassification constraint for the training point T;
3 THE FLORAL APPROACH
In the context of label poisoning attacks, the attacker's objective is maximize the model's test classification error by subtly altering the labels in the training dataset to an optimal adversarial configuration. Adversarial training (Goodfellow et al., 2015; Madry et al., 2017) can be extended to counter these attacks and minimize model sensitivity to disruptive labels by actively optimizing for robustness under worst-case scenarios. this setting, the attacker generates the optimal label attack within budget of l flips to maximize the model's 's loss, while the model seeks parameters that minimize this worst-case loss. A straightforward, yet naive (Robey et al., 2024), way to implement this approach would be to use the following minimax formulation:
min VL
max (= i.El]
C (fx(x)).
XER
ExEM
where L denotes a loss function, which in the case of the kernel SVM is related the hinge loss (Smola & Schölkopf, 1998), and ÿ represents the adversarial label set. This formulation is problematic for multiple reasons:
Misaligned objectives: The loss is only a surrogate for the test accuracy, which the actual quantity of interest to both the leamner and the attacker. However, from an optimization perspective, maximizing an upper bound (such as the hinge loss in SVMs) on the classification error as in (3) is not meaningful as such a bound does not represent the true objective of the attacker. Hence, a non zero-sum formulation would allow for a more nuanced representation of the attacker's objectives (Yasodharan & Loiseau, 2019).
3

---

Published as a conference paper at ICLR 2025
Algorithm FLORAL
1: Input:
Initial kernel SVM model fxa training dataset Do {1r,, M= attacker budget B E ..). parameter k. where k < B, learning rate 1) > 0.
J; E RRd, yi E (+1),
2: for round ,....: T do
3: 8' < Solve (7-9) via randomized top-k randomly selecting i points from top B w.r.t X */ Adversarial dataset with selected i poisoned labels
4: Dj {x )
5: Compute gradient of the objective (4), V (fA.... based on A Dr as given in (10),
6: Take PGD step X + PROX s(5t)(A D(xe D:)), based on (11-12).
AT
7: end for
8:
return fxT
Ineffective defense against critical points: the case of an SVM-based classifier, the minimax formulation would only safeguard against attacks targeting data points with the largest hinge loss, i.e., those farthest from the decision boundary. These attacks are casily distinguishable (Xiao al., 2012) as, e.g., soft margin SVMs shown to be robust to outliers (Smola & Schölkopf, 1998). contrast, attacks targeting the critical points that define the decision boundary (support vectors) would be more effective degrading the classifier's performance.
Combinatorial explosion: Even if bilevel formulation is employed where the attacker minimizes the margin, the problem remains computationally challenging. Ordering data points by their margin and then searching for the best adversarial label set within a budget constraint results in vast combinatorial space.
As result of these, we formulate our adversarial training routine as non-zero-sum Stackelberg game (Von Stackelherg, 2010; Conitzer & Sandholm, 2006) and propose FI.ORAI. defense using the bilevel optimization formulation (Bard, 2013):
D(fx:D) min XER" 2 A - A
where ((A) E arg
max y/ y'EY" (0,
XTu
(7)
(4)
subject to
v.1 wi(1 2u.), Vi E
[n]]
(8)
subject to
7 ;()) =0
(5)
Σ 1 + 4/4 k. iE|n]
(9)
0 ACASC
(6)
In the outer (model's) problem, defined by (4-6), the SVM classifier is derived under an adversarial label set. The key difference from the formulation in Section 2 is that the elements of Q are defined as Q., = ū.Ü; K.j. Meanwhile, the inner (attacker's) problem, given by (7-9) identifies the top-k most influential data points affecting the model's decision boundary. The intuition behind this approach is similar to identifying the most responsible training points for the model's prediction in (Koh & Liang, 2017). However, rather than relying on influence functions (Hampel, 1974), the attacker leverages the dual variables X, which provides direct access to such influential points. These points correspond to the support vectors, and the higher the value of dual variable, the more critical that data point is in determining the model's decision boundary.
We address the bilevel optimization problem in (4-9) as a non-zero-sum Stackelberg game (Von Stackelberg, 2010) between the learning model, and the attacker acting as the leader and follower, respectively, as shown in Figure la. The game begins with an initial kernel SVM model SA, and training dataset Do. and proceeds iteratively. In each round I, the model shares its dual parameters with the attacker, who then generates an adversarially labelled dataset D, using a randomized top-k rule. That is. the attacker identifies the top-B data points based their A values, (constrained by the budget B) and flips the labels of k randomly chosen points among them. We incorporate randomization account for the attacker's budget and reduce the risk of settling in local optima. Adversarial training is performed via a projected gradient descent step using A and D,, after which the updated parameters, Åe, are shared with the attacker. This iterative interplay between the attacker and defender model forms a soft-margin kernel SVM robust to adversarial label poisoning. Our overall approach is detailed in Algorithm 1.
4

---

Published as a conference paper at ICLR 2025
FLORAL'S 's effectiveness. FLORAL iteratively exposes the model to learn adversarial configurations of the decision boundary. Hence, when the training data is clean, the training process proactively adjusts the model to be less sensitive to the influence of individual poisoned labels. In cases where poisoned labels are already present in the initial training data, FL.RRAI effectively neutralizes their impact by implicitly sanitizing the corrupted labels. This behavior is evaluated empirically and detailed in Section 4.1 and Appendix D.
The attacker's capability. The attacker solves (7-9) with respect to the shared model parameters A, generating label attacks by targeting the most influential support vectors. This white-box attack (Wu et al., 2023) assumes that the attacker can access model parameters. To reflect practical constraints, we limit the attacker's budget most B label poisons per round. from which & points are randomly selected. While this scenario may still seem to give the attacker significant power, notably, (i) relying on secrecy for security generally considered poor practice (Biggio et al., 2013), and (it) our method is designed to defend against the strongest possible attacker. Even in black-box attack scenarios, where the attacker lacks parameter access, FLORAL remains effective for generating transferable attacks (Zheng et al., 2023). In such cases, the attacker could fit a kernel SVM on the available data and apply a similar selection rule to craft adversarial labels.
Gradient of the objective (4). In each round, the adversarial training PGD step requires computing the gradient DxD(f D) of the objective (4) based on λ and D,, which is defined as
VxD(fa
Q 1,
(10)
where Q is the matrix with entries Qu, = D1o Vi,j E [n). detailed in Appendix B.
Projection. The feasible set S changes in each round t depending on the adversarial label set ÿ' (see (6)). We introduce the variable 25 := Ar-1 - V DfA.. and define the projection operator (ROXS(G)(2() R R" as follows:
1
(ROXS(3))(1) de arg min AER
2 || 2/12
(11)
subject to Ø'x=0, 0 OSASC.
(12)
However, solving this quadratic program for large-scale instances is computationally challenging unless the specific problem structure is exploited. Therefore, we provide a scalable and efficient implementation of Algorithm 1 that relies on a fixed point iteration strategy detailed in Section 3.2.
A form of geometry-aware AT. FL.RAL aligns with geometry- aware AT principles (Zhang et al., 2021). Support vectors with large Lagrange multipliers (A) play a critical role in defining the decision boundary (Hearst et al., 1998). In FLORAL, the attacker strategically identifies these points using a randomized top-k rule. This method inherently integrates the geometric proximity to the decision boundary into the label attack, targeting points that significantly impact the hinge loss.
Robust multi-class classification. We extend our algorithm to multi-class classification tasks, as detailed in Algorithm 3 in Appendix F. The primary modification involves adopting a one-vs-all approach and considering multiple attackers, each corresponding to different class.
3.1 STABILITY ANALYSIS
We theoretically analyze the stability of FLORAL (Algorithm 1) by (i) demonstrating that its iterative updates are bounded and (ii) characterizing its convergence to the Stackel- berg equilibrium. For simplicity of notation, let us define the update rule round as
X := FiRoSsim)fee (2e) = PROX (Ar-1 - 17 v Vt),, where PROx is defined in (11-12). We use the operator LFLIP: X y + y to define label poisoning attack formulated in (7-9).
Lemma 1. Let (})) denote a Stackelberg equilibrium, i.e.. {(}) = LFLIP(A) and ==
PROX s()())) (2) = PROX S)0 (² v/V (Â, (()))) and (NeYT-o be the sequence of iterates
generated by FLORAL (Algorithm l). The following bound holds for the iterates:
1|+ مol S 1| E|1oo + Kyy . ())
(13)
where Ky is a constant defined by the PROX operator and index set corresponding to X E (0, as detailed in Appendix A. and || oo denotes the infinity norm.
Proof. See Appendix A.I for the proof.
5

---

Published as a conference paper at ICLR 2025
Lemma 2. Let (*, (()) denote the Stackelberg equilibrium before. The following bound holds for the non non-projected iterates {2t {2t of FLORAL (Algorithm 1):
2| 00 S kxll - Alloc + Kly lylle o())lloo
(14)
where KA and kiy are kernel dependent constants that are below 1 for small enough
Proof. See Appendix A.2 for the proof.
Theorem 3.1 (s-local asymptotic stability). The Stackelberg equilibrium (2)) defined as before, is E-locally asymptotically stable for the Stackelberg game solved via Algorithm 1 for a small enough step size n, This implies that for every E >> O, there exists 8 >> 0 such that
|1 01 = A /l < E, 4 and X
(15)
Proof (sketch). The proof relies on characterizing the distance between the update A at round t and the equilibrium using Lemma and Lemma 2, then leveraging the fact that the label flipping operator (L.FT.I) formulated in (7-9) returns the same adversarial label set when X is within an distance from the equilibrium. The complete proof is given in Appendix A.3, with the global convergence result discussed Appendix A.4.
3.2 LARGE-SCALE IMPLEMENTATION
We scale our algorithm for large problem instances by approximating the projection operation (step 6 Algorithm 1) via fixed-point iteration method, as outlined in Algorithm The key idea leverages the optimal X expression from Appendix A. and involves an iterative splitting of variables based on non-projected values within the range (0, C*.. each iteration, the variable updated using the expression in Appendix A.I until convergence to specified error is achieved.
Algorithm 2 PRODECTIONVIAAFFEEOOOOTTTTAAAAT
1: Input: Non-projected λØ adversarial label set (ūs hn V/ E (+1), parameters {C, e) > 0.
2: Initialize Au = 0.
3: for round 1, ... moi do 14-19)
4: A CL.P
#/ Clip to satisfy constraint in (12)
5: if AxΦ 0 then
6: return A
7:
end if
8:
Ic,I, I. t indices of d 2 C, d (0,C)
*/ Variable splitting */ To avoid empty Ig case
9:
7 f max I.
- T- M + (Eitoo Cit, + +iET, \(1i)
10:
11:
if 14 M4-1 I then
12:
return CLIP - m4ū)
13: end if
14:
end for
3.3 RELATED WORK
Label poisoning. Biggio et al. (2012) first analyzed label poisoning attacks, showing that flipping a small number of training labels severely degrades SVM performance. Xiao et al. (2012) later formalized optimal label flip attacks under budget constraints a bilevel optimization problem. which then expanded to transferable attacks on black-box models (Zhao et al., 2017), considering arbitrary attacker objectives. Beyond SVMs, recent works have explored label poisoning backdoor attack scenarios, where adversaries inject triggers alter triggerless data with poisoned labels in multi-label settings (Jha et al., 2023; Chen et al., 2022). In contrast, our approach focuses on triggerless poisoning attacks.
Defenses against these attacks include heuristic-basee kernel correction (Biggio et al., 2011). which expectation for Q in (4), though assuming independent label flipping with equal probability condition not guaranteed practice. Other defenses such as clustering based filtering (Laishram Phoha, 2016; Tavallali al., 2022), data complexity analysis (Chan al., 2018), re-labeling (Paudice

---

Published as a conference paper at ICLR 2025
et al., 2018) and label smoothing (Rosenfeld et al., 2020) offer straightforward solutions, however, they do not scale well to bigh-dimensional or large datasets. Sample weighting based on local intrinsic dimensionality (LID) (Weerasinghe et al., 2021; Ma et al., 2018) shows promise, but relies on accurate and computationally expensive L.ID estimation. Our approach, however, avoids strong assumptions about the data distribution or the attacker, preserves feasibility, and scales effectively to large-scale problem instances as demonstrated in Section 4. Additionally, while learning under noisy labels (Frénay & Verleysen, 2013; Natarajan et al., 2013; Hallaji al., 2023; Zhang al., 2024) may seem relevant, our work focuses specifically on adversarial label noise (Biggio et al., 2011), where the adversary intentionally crafts the most damaging label perturbations.
Adversarial training (AT). Adversarial examples, introduced by Szegedy et al. (2013), revealed how small perturbations cause misclassification in deep neural networks (DNNs). Building on this, AT (Goodfellow et al., 2015) emerged as prominent defense, training models both original and adversarially perturbed data. Defenses have utilized adversarial examples generated by methods such as the Fast Gradient Sign Method (FGSM) (Goodfellow et al., 2015), PGD (Madry et al., 2017). Carlini & Wagner attack (Carlini & Wagner, 2017), among others (Chen et al., 2017; Moosavi-Dezfooli et al., 2015). For SVMs. Zhou et al. (2012) formulated convex AT for linear SVMs, later extended to kernel SVMs by Wu et al. (2021) via doubly stochastic gradients under feature perturbations. Despite this progress, AT for label poisoning remains underexplored. AI. fills this gap, by leveraging AT specifically for label poisoning scenarios, using PGD to train models on poisoned datasets rather than generating adversarial examples.
In parallel, game-theoree theoretceoeei approaches have modeled adversarial interactions as simultaneous games (Bal et al., 2024a), where classifiers and adversaries select strategies independently (Dalvi et al., 2004), or Stackelberg games with a leader-follower dynamic (Brückner & Scheffer, 201 I; Zhou et al., 2019; Chivukula et al., 2020). AT has further linked these concepts. particularly in simultancous zero-sum games (Hsich et al., 2019; Pinot al., 2020; Pal & Vidal, 2020) to non-zero-sum formulations (Robey et al., 2024). We adopt a sequential setup, using the Stackelberg framework where the leader commits strategy and the follower responds accordingly.
4 EXPERIMENTS
In this section, we showcase the effectiveness of FLORAL across various robust classification tasks, utilizing the following datasets:
Moon (Pedregosa et al., 2011): We employed synthetic benchmark dataset, D {Ix;, y.) )))) 2,000
where Iy E R and y/s E [+1]. Adversarial versions are generated by flipping the labels of points farther from the decision boundary of linear classifier trained on the clean dataset, using label poisoning levels (%) of {5, 10, 15, 20, 25). The details on the adversarial datasets are given in Appendix C.I.
IMDB (Maas al., 2011): A benchmark review sentiment analysis dataset with D {z,, }) ) where 2, E IR 768 and yi E [=1]. For SVM training, we extracted 768- dimensional embeddings from the fine-tuned RoBERTa (Liu et al., 2019). We created adversarial datasets by fine-tuning the RoBERTa-base model on the clean dataset to identify influential train-
ing points based on the gradient with respect the inputs, then flipping their labels at poisoning levels (%) of { {10, 25, 30, 35, 403.
MNIST (Deng, 2012): In Appendix E.3, we provide the additional experiments with the MNIST dataset in detail.
Experimental setup. For all of C' and 7. We conducted five replications with different train/test splits, including the corresponding adversarial datasets for each dataset. In all FL.ORAI. experiments, we constrain the attacker's s capability with a limited budget. That is, the attacker identifies the most influential candidate points, with B = 2k, from the training set and randomly selects & E 21, 5, 10, 25) to poison, where k represents the % of points relative to the training set size. Detailed experimental configurations are provided in Appendix C (see Table 3).
methods, we used RBF kernel, exploring various values
Baselines. We benchmark FL.ORA against the following baselines:
(Vanilla) SVM with an RBF kernel, which serves as basic benchmark (Hearst et al., 1998).
2. LN-SVM (Biggio et al., 2011) applies a heuristic-based kernel matrix correction.
7

---

Published as a conference paper at ICLR 2025
Table 1: Test accuracies of methods trained on the Moon dataset, averaged over five runs. Highlighted values indicate the best performance in the "Best" (peak accuracy during training) and "Last" (final accuracy after training) columns. This notation is consistently applied in the subsequent tables. FLORAL outperforms baselines in most of the settings, providing a particularly robust defense in highly adversarial scenarios. See Appendix E.1 (Table for the results of other settings.
Method
Setting
FLORAL
SVM
NN
NN--CGD
LN-SVM
Cari
LS-SVM
K-LID
Best
Last
Dest
Last
Best
Last
Dest
Last
Best
Last
Best
Last
Best
Last
Best
Last
10,7
01940
0.911
0.881
3%
C- 10.7
0.966
0.966
0.965
0.957
0.926
0.925
0.964
0.977
0.940
0.940
0.033
0:003
0.831
0.881
0.964
par 10%
C= 10.7
0.924
0.507
0.912
0.900
0.859
0.855
0.927
0.853
0.859
0.888
0.907
0.907
0.894
0.891
0.908
0.907
2it 10%
6' 10. -
0.924
0.917
0.892
0.233
0.826
0.526
0.571
0.571
0.893
0.829
0.905
0.838
0.892
0.823
0.383
0.526
Da 20%
C- 10.0
0,875
0.565
0.840
0.771
0.788
0.787
0.854
0.855
0.839
0.758
0.859
0.763
0.540
0.771
0.830
0.755
2 20%
C- 10,7
0,501
0.768
0.753
0.717
0.693
0.647
0.540
0.655
0.754
0.693
0.779
0.607
0.766
0.721
0.747
0,500
Table 2: Test accuracies of methods trained on the IMDB dataset, averaged over five replications. FL.ORAT. demonstrates superior robustness compared to baselines, particularly in more adversarial scenarios. See also Figures lb-lc.
Method
Netting
FLORAL.
RoRERTa
SVM
I.N.SMM
Curic
1S-SVM
K-I.ID
Best
Last
Rest
1ast
Best
1.st
Bost
1ast
Rest
1ast
Best
1
Best
Last
Clean
0,9113
0.9113
0,9119
0,9110
0.9113
0.9113
0.9113
0.9113
0.9116
0.9113
0.9108
0.9108
0.91
0.9115
1jsh
10%6
0.90199
0.9039
0.9048
0:90331
0.9039
0:9039
0.5022
0.9028
0.9039
0.9039
0.9010
0.9010
035039
0.9679
25%
0.8827
0.8887
0.8886
0.8860
0.8860
0.8889
D
30%
0.8801
0.8801
0.8675
0,8357
0.8792
0.8792
0.8771
0.8711
0.8797
0.8797
0.8325
0.8324
0.8795
0.8795
7) 35%
0,8713
0.8713
0.8270
0.8053
0.8660
0.8660
0.8646
0.8646
0.8695
0.8695
0.7667
0.7667
0,8700
0.8700
40%5
0.8636
0.7792
0.7717
0.8584
0.8515
0.8515
0.8589
0.7060
0.7060
0.8594
Curie (Laishram & Phoha, 2016), utilizes the DBSCAN clustering (Ester et al., 1996) identify and filter-out poisoned data points.
4. LS-SVM (Paudice et al., 2018) applies label sanitization based on k-NN (Cover & Hart, 1967).
5. K-LID (Weerasinghe et al., 2021), a weighted SVM based on kernel local intrinsic dimensionality.
6. NN: A DNN trained using the SGD optimizer with momentum, serving as a non-linear baseline.
7. NN-PGD: A DNN trained with PGD-AT (Madry et al., 2017), to evaluate a robust model designed to withstand feature perturbation attacks under label poisoning.
8. RoBERTa (Liu al., 2019), used in experiments with IMDB dataset to assess fine-tuned munsformer-based language model's robustness under label poisoning.
Appendix G includes further comparisons with a least squares classifier using randomized smoothing (Rosenfeld et al., 2020) and filtering-out defense based on regularized synthetic reduced nearest neighbor (Tavallali et al., 2022) on the Moon and MNIST datasets.
Performance metrics. We assess our method using two key metrics: robust and clean accuracy, tracked over a test set with clean labels during training. Unlike feature perturbation studies, where robust accuracy is gauged on adversarially perturbed test examples (Yang et al., 2020), in our study, robust accuracy reflects model performance tested on clean labels using adversarially labelled training data, thereby indicating the models' resilience and generalization capabilities under poisoning. Conversely, clean accuracy measures the performance of models trained and tested on clean-labelled data, offering benchmark for comparison under both adversarial and aovessreraliial conditions. We additionally report hinge loss on the clean-labelled test data (see Appendix E.2) experiments with the IMDB dataset.
4.1 EXPERIMENT RESULTS
In this section, we report the performance of FL.ORAL against the baseline methods on the Moon dataset, followed by the results its integration with RoBERTa on the IMDB dataset.
Moon. As reported in Table and Figure 3, FLORAL achieves higher robust accuracy across almost all settings compared to baseline methods. Notably, in scenarios with more severe poisoning levels, FLORAL significantly outperforms all baselines, which experience a marked drop in their accuracy. We report results under various kemee hyperparameters in Appendix E, (see Table 4 and
8

---

Published as a conference paper at ICLR 2025
Texl Accaracy
Teal Severety
Tex MA
Teal Accerery
0.50
3.14
2.A
2073
0000
577
0.08
4:70
660
(a) Clean.
(b) Duly
10%.
(c) Dudy 15%
(d)
Duh 20%.
(e) D
25%
FLORAL
Vanilla SVM
NN
NN-PGD
Curie
K-LID
Figure 3: Test accuracy of methods on the Moon dataset under varying label poisoning levels. For SVM models, C = 10, = 1 are used. See Appendix E (Figure 7) for results with other settings. As the label poisoning level increases, the accuracy of methods generally declines, however, FI.ORAL maintains higher robust accuracy across all adversarial settings, without compromising clean accuracy.
Figure 7). We additionally visualize the decision boundaries of trained methods on the test dataset in Figure 4, which shows that FLORAL produces a smoother decision boundary compared to the baselines, promoting generalization (see Figure 18 Appendix E for the complete results).
When the initial training data is clean, FLORAL provides proactive defense by introducing adversarial labels during training, thereby effectively reducing the model's sensitivity to potential label attacks. Notably, FLORAL matches performance par with vanilla SVM on clean data, demonstrating that its robust framework maintains high accuracy without compromising clean accuracy. In scenarios with already poisoned training data, FLORAL achieves robustness through two key mechanisms: (i) implicitly sanitizing corrupted labels, while (ii) introducing additional adversarial labels to further reduce model sensitivity to attacks. We analyze this sanitization effect in detail in Appendix D and show that FLORAL sanitizes 25- - 35% portion of the initial poisoned training labels. Furthermore, FLORAL operates dynamically evolving adversarial datasets during training, unlike baselines that are trained on fixed adversarially labelled datasets. This dynamic strategy introduces new adversarial labels in each round, further testing and enhancing the model's robustness. These capabilities position FL.ORAL AT as a superior defense over baselines, particularly in maintaining robust accuracy under more challenging adversarial scenarios.
FLORAL offers several distinct advantages over existing baselines, e.g., unlike LN-SVM, FLORAL does not rely on the strong assumption that training labels are independently flipped with equal probability. Compared to Curie, FL.RRA avoids filter-out system that risks discarding data with valuable feature representations. Further, in terms of scalability, Curie's dependence on distance metrics makes it vulnerable to the curse of dimensionality, diminishing its clustering performance in dine--iimnsionall and complex datasets. To ensure a fair comparison, we calibrated the noise, confidence level, and threshold value parameters of LN-SVM, Curie, and LS-SVM baselines, aligning them with the poisoning level in each dataset. This ensures that the baselines are at their strongest configurations, highlighting the robustness and scalability of FLORAL.
We integrate FLORAL as robust classifier head for RoBERTa. The test performance on the IMDB dataset, shown in Table and Figures lb-lc, reveals that FLORAL significantly improves ro- bustness, outperforming fine-tuned RoBERTa along with other baselines. Our approach also converges faster lower loss values, in more adversarial scenarios (see Table and Figure in Appendix E.2).
IMDB.
In Appendix E.2, we analyze the changes in influential training points those that most affect model predictions- -weeioonsswwhenneee applying FLORAL to RoBERTa-extracted embeddings (see Figures 9-10). The results reveal some overlap in the identified points, under clean train data scenario. However, as the training data becomes more adversarial, AL.ORA. identifies different critical points, which effectively shape the decision boundary and contribute improved robust accuracy.
Adaptability. As shown with the IMDB experiments, FLORAL integrates seamlessly with other model architectures (e.g., RoBERTa, NNs) by utilizing the last-layer embeddings for training. We additionally demonstrate this in Appendix I, FLORAL integrated with an NN learns more robust representations and achieves higher robust accuracy the Moon and MNIST datasets.

---

Published as a conference paper at ICLR 2025
Peoture
(a) FL.ORAI. (Clean).
ndyy 5%
D 10%.
D 25%.
Prsture
Pretbr
Preture
(b) SVM (Clean).
D 5%.
D 10%.
D 25%.
Pestarn
Pestarm
Pestars
Bromiin 3
Peoture D 5%
Protuen
(c) NN (Clean).
D 10%
D 25%
Deaturn
Postum
Posture
NN-PGD (Clean).
july 5%
Dudy 10%.
Dudl 25%.
Figure 4: The decision boundaries the Moon test dataset under varying label poisoning levels. SVM models use an RBF kernel with C' 10 and y = 0.3. FLORAL generates smooth decision boundary compared to baseline methods, which show drastic changes due to adversarial training label manipulations. For the complete results with other baselines, see Appendix E (Figure 18).
Sensitivity analysis. We further examined the sensitivity of our approach the attacker's budget, and the results are detailed in Appendix E.4 with Figure 12.
Generalizability. We demonstrate the effectiveness FLORAL under different attacks: a fa. alfa-tilt (Xiao al., 2015) and LFA (Paudice al., 2018) in Appendix H. Our experiments on the Moon and MNIST (Deng. 2012) datasets again confirmed that FLORAL can also defend and achieve higher robust accuracy in the presence of other types of label attacks.
Limitations. Defense strategies may not be universally effective against all label poisoning attacks due to their non-adontteee -dn-adaptive nature (Papernot et al., 2016). Our defense strategy relies on a white-bor attack, where the attacker access the model. While also show the performance of our approach under various label attacks from the literature, its efficacy may vary under different attack scenarios.
5 CONCLUSION
In this paper, we address the vulnerability of machine learning models to label poisoning attacks and propose FLORAL, an adversarial training defense strategy based on kernel SVMs. We formulate the problem using bilevel optimization and frame the adversarial interaction between the learning model and the attacker as a non-zero-sum Stackelberg game. To compute the game equilibrium that solves the optimization problem, we introduce projected gradient descent-based algorithm and analyze its local stability and convergence properties. Our approach demonstrates superior empirical robustness across various classification tasks compared to robust baseline methods.
Future research includes exploring SVM-based transfer attacks or integrating our approach to robust fine-tuning of foundation models for supervised downstream tasks. Additionally, detailed analysis of how FL.ORAL alters the most influential training points for model predictions, e.g. when integrated with foundation models such RoBERTa could provide interesting insights.
10

---

Published as a conference paper at ICLR 2025
ACKNOWLEDGEMENTS
This research was supported by the Max Planck & Amazon Science Hub. We also thank the German Research Foundation for the support and Zhiyu He for the helpful comments on the manuseript. The work was conducted during Volkan Cevher's s time Amazon.
REFERENCES
Melis Ilayda Bal, Cem lyigun, Faruk Polat, and Huseyin Aydin. iapulation-based exploration in reinforcement learning through repulsive reward shaping using eligibility traces. Annals of Operations Research, pp. 1-33, 2024a.
Melis Ilayda Bal, Pier Giuseppe Sessa, Mojmir Mutny, and Andreas Krause. Optimistic games for combinatorial bayesian optimization with application to protein design. arXiv preprint arXiv:2409. 18582, 2024b.
Jonathan F Bard. Practical bilevel optimizaaion: algorithms and applications. Springer Science & Business Media, 2013.
Marco Barreno, Blaine Nelson, Anthony D Joseph, and J Doug Tygar. The security of machine learning, Machine Learning, 81:121-148, 2010.
Battista Biggio, Blaine Nelson, and Pavel Laskov. Support vector machines under adversarial label noise. Asian Conference on Machine Learning, pp. 97-112, 2011.
Battista Biggio, Blaine Nelson, and Pavel Laskov. Poisoning attacks against support vector machines. International Conference on Machine Learning, pp. 1467-1474, 2012.
Battista Biggio, Giorgio Fumera, and Fabio Roli. Security evaluation of pattern classifiers under attack. IEEE Transactions on Knowledge and Data Engineering, 26(4):984 9964 2013.
Bernhard Boser, Isabelle M Guyon, and Vladimir Vapnik. training algorithm for optimal margin classifiers. Proceedings of the 5th Annual Workshop Computational Learning Theory, pp. 144-152, 1992.
Michael Brückner and Tobias Scheffer. Stackelberg games for adversarial prediction problems. Proceedings of the ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, pp. 547-555, 2011.
Nicholas Carlini and David Wagner. Towards evaluating the robustness of neural networks. IEEE Symposium on Security and Privacy, pp. 39-57, 2017.
Patrick PK Chan, Zhi-Min He, Hongjiang Li, and Chien-Chan Hsu. Data sanitization against adversarial label contamination based on data complexity. International Journal of Machine Learning and Cybernetics, 9:1039-1098 2018
Kangjic Chen, Xiaoxuan Lou, Guowen Xu, Jiwei Li. and Tianwei Zhang, Clean-image backdoor: Attacking multi-label models with poisoned labels only. International Conference on Learning Representations, 2022.
Pin-Yu Chen, Huan Zhang, Yash Sharma, Jinfeng Yi, and Cho-Jui Hsich. Zoo: Zeroth order optimization based black-box attacks to deep neural networks without training substitute models. Proceedings of the ACM Workshop on Artificial Intelligence and Security, pp. 15-26, 2017.
Hao Cheng, Zhaowei Zhu, Xingyu Li, Yifei Gong, Xing Sun, and Yang Liu, Learning with instance- dependent label noise: A sample sieve approach. ArXiv, 2010.02347, 2020.
Aneesh Sreevallabh Chivukula, Xinghao Yang. Wei Liu, Tianqing Zhu, and Wanlei Zhou Game theoretical adversarial deep learning with variational adversaries. IEEE Transactions on Knowledge and Data Engineering. 33(1 1):3568-3588 2020.
Vincent Conitzer and Tuomas Sandholm. Computing the optimal strategy to commit to. Proceedings of the ACM Conference Electronic Commerce, pp. 82-90, 2006.

---

Published as a conference paper at ICLR 2025
Thomas Cover and Peter Hart. Nearest neighbor pattern classification. IEEE Transactions Information Theory, 13(1):21-27, 1967.
Nilesh Dalvi, Pedro Domingos, Mausam, Sumit Sanghai, and Deepak Verma. Adversarial classifica- tion. Proceedings of the ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, pp. 99-108, 2004.
Li Deng. The mnist database of handwritten digit images for machine learning research. IEEE Signal Processing Magazine, 29(6):141114) 2012.
Yao Deng, Xi Zheng, Tianyi Zhang, Chen Chen, Guannan Lou, and Miryung Kim. An analysis of adversarial attacks and defenses on autonomous driving models. IEEE International Conference on Pervasive Computing and Communiccations, pp. 1-10, 2020.
Martin Ester, Hans-Peter Kriegel, Jörg Sander, Xiaowei Xu, et al. A density-basee based algorithm for discovering clusters in large spatial databases with noise. Knowledge Discovery and Data Mining, 96(34):226-231, 1996.
Samuel G. Finlayson, John D. Bowers, Joichi Ito, Jonathan L. Zittrain, Andrew L. Beam, and Isaac S. Kohane. Adversarial attacks on medical machine learning. Science, 363(6433):1287-128,, 2019.
Ugo Fiore, Alfredo De Santis, Francesca Perla, Paolo Zanetti, and Francesco Palmieri. Using generative adversarial networks for improving classification effectiveness in credit card fraud detection. Information Sciences, 479:448-455, 2019.
Liam Fowl, Micah Goldblum, Ping-yeh Chiang, Jonas Geiping, Wojeiech Czaja, and Tom Goldstein. Adversarial examples make strong poisons. Advances in Neural Information Processing Systems, 34:30339-30351, 2021.
Benoît Frénay and Michel Verleysen. Classification in the presence of label noise: survey. IEEE Transactions on Neural Networks and Learning Systems, 25(5):845- 2013.
Jonas Geiping, Liam Fowl, Gowthami Somepalli, Micah Goldblum, Michael Moeller, and Tom Goldstein. What doesn't 't kill you makes you robust (er): How adversarially train against data poisoning. ArXiv, 112..1624,, 2021.
Ian J. Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. ArXiv, 1412.6572, 2015.
Ehsan Hallaji, Roozbeh Razavi-Far, Mehrdad Saif, and Enrique Herrera- Viedaa. Label noise analysis meets adversarial training: A defense against label poisoning federated learning. Knowledge- Based Systems, 266: 10384, 2023,
Frank R Hampel. The influence curve and its role in robust estimation. Journal of the American Statistical Association, 69(3446)383-3999 1974.
Marti A. Hearst, Susan T Dumais, Edgar Osuna, John Platt, and Bernhard Scholkopf. Support vector machines. IEEE Intelligent Systems and Their Applications, 13(4):18-28, 1998.
Ya-Ping Hsieh, Chen Liu, and Volkan Cevher. Finding mixed nash equilibria of generative adversarial networks. International Conference on Machine Learning, pp. 2810-2819 2819, 2019.
Chih-Wei Hsu and Chih-Jen Lin. A comparison of methods for multiclass support vector machines. IEEE Transactions on Neural Networks, 13(2):415-425, 2002.
Ruitong Huang, Bing Xu, Dale Schuurmans, and Csaba Szepesvári. Learning with a strong adversary. ArXiv, 1511003334 2015.
Rishi D. Jha, Jonathan Hayase. and Sewoong Oh. Label poisoning is all you need. Advances in Neural Information Processing Systems, 36:71029-71052, 2023.
Pang Wei Koh and Percy Liang. Understanding black-box predictions via influence functions. International Conference Machine Learning, pp. 1885-1894, 2017.
12

---

Published as a conference paper at ICLR 2025
Ram Shankar Siva Kumar, Magnus Nyström, John Lambert, Andrew Marshall, Mario Goertzel, Andi Comissoneru, Matt Swann, and Sharon Xia. Adversarial machine barning-indussee perspectives. IEEE Security and Privacy Workshops, pp. 69-75, 2020.
Alexey Kurakin, lan J Goodfellow, and Samy Bengio. Adversarial examples in the physical world. International Conference on Learning Representations, 2016.
Ricky Laishram and Vir Virander Phoha. Curie: A method for protecting svm classifier from poisoning attack. ArXiv, 1606.01584, 2016.
Yinhan Liu, Myle Ott, Naman Goyal, Jingfei Du, Mandar Joshi, Danqi Chen, Omer Levy, Mike Lewis, Luke Zettlemoyer, and Veselin Stoyanov. RoBERTa: A robustly optimized BERT pretraining approach. ArXiv, 1907. 1692, 2019.
Xingjun Ma, Bo Li, Yisen Wang. Sarah M Erfani, Sudanthi Wijewickrema, Grant Schoenebeck, Dawn Song, Michael E Houle, and James Bailey. Characterizing adversarial subspaces using local intrinsic dimensionality, ArXiv, 1801 .26113, 2018
Andrew L. Maas, Raymond E. Daly, Peter T. Pham, Dan Huang, Andrew Y. Ng. and Christopher Potts. Learning word vectors for sentiment analysis. In Proceedings of the 49th Annual Meeting of the Association for Computational Linguistics: Human Language Technologies, pp. 142-150, 2011.
Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant adversarial attacks. ArXiv, 1706.06083, 2017.
Seyed-Mohsen Moosavi-Dezfoolli Alhussein Fawzi, and Pascal Frossard. Deepfool: A simple and accurate method to fool deep neural networks. IEEE Conference on Computer Vision and Pattern Recognition, pp. 2574-2582, 2015.
Nagarajan Natarajan, Inderjit S Dhillon, Pradeep K Ravikumar, and Ambuj Tewari. Learning with noisy labels. Advances in Neural Information Processing Systems, 26, 2013.
Ambar Pal and René Vidal. game theoretic analysis of additive adversarial attacks and defenses. Advances in Neural Information Processing Systems, 33:1345-1355, 2020.
Nicolas Papernot, Patrick McDaniel, and Ian Goodfellow. Transferability in machine learning: from phenomena to black-box attacks using adversarial samples. ArXiv, 1605.07277, 2016.
Andrea Paudice, Luis Muñoz-Gonzáles and Emil C Lupu. Label sanitization against label flipping poisoning attacks. ArXiv, 1803.00992, 2018
Fabian Pedregosa, Gaël Varoquaux. Alexandre Gramfort, Vincent Michel, Bertrand Thirion, Olivier Grisel, Mathieu Blondel, Peter Prettenhofer, Ron Weiss, Vincent Dubourg, et al. Scikit-learn: Machine learning in Python. Journal Machine Learning Research, 12:2825-2830. 2011.
Rafael Pinot, Raphael Ettedgui, Geovani Rizk, Yann Chevaleyre, and Jamal Atif. Randomization matters how to defend against strong adversarial attacks. International Conference on Machine Learning, pp. 7717-7727, 2020.
Alexander Robey, Fabian Latorre, George Pappas, Hamed Hassani, and Volkan Cevher. Adver- sarial training should be cast as a non-zero-sum game. International Conference on Learning Representations, 2024.
Elan Rosenfeld, Ezra Winston, Pradeep Ravikumar, and Zico Kolter. Certified robustness label- flipping attacks via randomized smoothing. International Conference on Machine Learning, pp. 8230-8241, 2020.
Alex J Smola and Bernhard Schölkopf. Learning with kernels, volume 4. Citeseer, 1998.
Jacob Steinhardt, Pang Wei W Koh, and Percy S Liang. Certified defenses for data poisoning attacks. Advances in Neural Information Processing Systems, 30:3520-3532. 2017.
Christian Szegedy, Wojeiech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. Intriguing properties of neural networks. ArXiv, 1312.619, 2013.
13

---

Published as a conference paper at ICLR 2025
Pooya Tavallali, Vahid Behzadan, Azar Alizadeh, Aditya Ranganath, and Mukesh Singhal. Adversar- ial poissonng attacks and defense for general multi-class models based on synthetic reduced nearest neighbor. IEEE International Conference Image Processing, pp. 3717-3722, 2022.
Heinrich Von Stackelberg. Market structure and equilibrium. Springer Science & Business Media, 2010.
Song Wang, Zhen Tan, Ruocheng Guo, and Jundong Li. Noise-robust fine-tuning of pretrained language models via external guidance. Findings of the Association for Computational Linguistics, pp. 12528-12540, 2023.
Sandamal Weerasinghe, Tansu Alpcan, Sarah M. Erfani, and Christopher Leckie. Defending support vector machines against data poisoning attacks. IEEE Transactions on Information Forensics and Security, 16:2566-2577 2021.
Baoyuan Wu, Zihao Zhu, Li Liu, Qingshan Liu, Zhaofeng He, and Siwei Lyu. Attacks in adversarial machine learning: A systematic survey from the life-cycle perspective. ArXiv, 2302.09457, 2023.
Huimin Wu, Zhengmian Hu, and Bin Gu. Fast and scalable adversarial training of kernel svm via doubly stochastic gradients. Proceedings of the AAAI Conference on Artificial Intelligence, 35(12): 10329-10337, 2021.
Han Xiao, Huang Xiao, and Claudia Eckert. Adversarial label flips attack on support vector machines. European Conference on Artificial Intelligence, pp. 870-875, 2012.
Huang Xiao, Battista Biggio, Blaine Nelson, Han Xiao, Claudia Eckert, and Fabio Roli. Support vector machines under adversarial label contamination. Neurocomputing, 160:53-62, 2015,
Yuancheng Xu, Yanchao Sun, Micah Goldblum, Tom Goldstein, and Furong Huang. Exploring and exploiting decision boundary dynamics for adversarial robustness. International Conference Learning Representations, 2023.
Yao-Yuan Yang, Cyrus Rashtchian, Hongyang Zhang, Russ R Salakhutdinov, and Kamalika Chaud- huri. A closer look at accuracy vs. robustness. Advances in Neural Information Processing Systems, 33:8588- 8601, 2020.
Sarath Yasodharan and Patrick Loiseau. Nonzero-sum adversarial hypothesis testing games. Advances in Neural Information Processing Systems, 32:11, 2019.
Chiyuan Zhang, Samy Bengio, Moritz Hardt, Benjamin Recht, and Oriol Vinyals. Understanding deep learning requires rethinking generalization. ArXiv, 1611.03530, 2017.
Jingfeng Zhang, Jianing Zhu, Gang Niu, Bo Han, Masashi Sugiyama, and Mohan Kankanhalli. Geometry-aware reweihh-re adversarial training. International Conference on Learning Representations, 2021.
Peng-Fei Zhang, Zi Huang, Kin-Shun Xu, and Guangdong Bai. Effective and robust adversarial training against data and label corruptions. IEEE Transactions Multimedia, 26:9477, 2024.
Mengchen Zhao, Bo An, Wei Gao, and Teng Zhang. Efficient label contamination attacks against black-box learning models. International Joint Conference on Artificial Intelligence, pp. 3945- 3951, 2017.
Meixi Zheng, Xuanchen Yan, Zihao Zhu, Hongrui Chen, and Baoyuan Wu. Blackboxhench: A comprehensive benchmark of black-box adversarial attacks. ArXiv, 2312.16977 2023.
Yan Zhou, Murat Kantarcioglu, Bhavani M. Thuraisingham, and Bowei Xi. Adversarial support vector machine learning. Knowledge Discovery and Data Mining, pp. 1059-1067, 2012.
Yan Zhou, Murat Kantarcioglu, and Bowei Xi. A survey of game theoretic approach for adversarial machine learning. Wiley Interdisciplinary Reviews: Data Mining and Knowledge Discovery, 9(3): e1259, 2019.
D. Zhu, Michael A. Hedderich, Fangzhou Zhai. David Ifeoluwa Adelani, and Dietrich Klakow. Is BERT robust to label noise? A study on learning with noisy labels in text classification. ArXiv, 2204.09371, 2022.
14

---

Published as a conference paper at ICLR 2025
Appendix
Table of Contents
A Theoretical Analysis Proofs
16
A.1 Proof of Lemma
16
A.2 Proof of Lemma 2
18
A.3 Proof of Theorem 3.1
19
A.4 Glohal convergence result
20
The Gradient the Objective (4)
Experiment Details
21
C.I Datasets
21
C.2 Baselines
22
C.3 RoBERTa Experiment Details
22
D Effectiveness Analysis of FLORAL Defense
22
E
Additional Experimental Results
24
E.1 Moon
24
E.2 IMDB
24
E.3 MNIST
28
E,4 Sensitivity Analysis
28
F Extension to Multi-class Classification
29
G Comparison Against Additional Methods
29
H Experiments Under Different Label Attacks
30
H.1 Experiments with the a fa-til1 attack
31
H.2 Experiments with the alfa attack
32
H.3 Experiments with the LFA attack
32
Integration with Neural Networks
15

---

Published as a conference paper at ICLR 2025
A THEORETICAL ANALYSIS PROOFS
In this section, we present the proofs for the local asymptotic stability analysis of FLORAL (Algo- rithm 1). We begin by proving Lemma I in Section I.I, which establishes that the distance of the updates of Algorithm from the equilibrium of the game is bounded. In Section A.2, we prove Lemma 2, demonstrating that the distance of the non-proj non-projected updates from the equilibrium of the game is also bounded. Lastly, in Section A.3, we provide the proof of Theorem 3.1, which shows the local asymptotic stability our algorithm, with derivation of global convergence result presented in Section A.4.
A.1 PROOF OF LEMMA 1
Our objective is to prove that the distance of the iterates of Algorithm from the Stackelberg cquilibrium (A, (A)), specifically A is bounded. We begin by recalling the update rule at round A == S (zz) PRO) (Ap-1 1 1-))),,)))),,.)))))))))) where y/1 ((A-1)), S(ye) is the feasible region defined by constraints (12), using the labels at round t. The operator PROX is defined below.
Definition 1 (PROX operator). The operator PROXS (2) R" - R" denotes the projection of 2, E IR" onto the convex set S(y:) at round of Algorithum 1. PROX minimizes the Euclidean distance and is defined by the following optimization problem:
PROXS(()) de E arg min XER"
$|| - 11
(16)
subject
y1 X = 0 0 0sAsC
(17)
(18)
Equivalently, PROXS(g)) solves the following optimization problem:
min AER" OSASC
sup
T - 2 + X.
(19)
MER
Lemma 3 (Bounded iterates). The sequence {Me} generated by the iterative update rule A, =
(ROXS(u))2z) PR. - x Ut)) is bounded, i.e. Deello C,Vt 0.
Proof. This follows immediately from the definition of Syy.).
In the following, our aim is quantify the sensitivity of (19) with respect its arguments y/ and 24- Let A* denote the optimal solution to the projection operation. We can express this solution through the following steps. First, we simplify the expression by omitting the index & in (19). Then, we exploit the fact that the objective function is convex-concad with convex constraints, which allows us to interchange the order of the min and the sup. This yields
min XER" O5ASC
sup HER
2 || 2|12 + M
1 2/ 11y11
sup
min XER OSASC
G - myy
RE
At this stage, the optimization problem over À reduces to the minimization of a quadratic function over box constraints. We can therefore express X based on the optimal choice μ*' for p as follows:
if 2, n² 1= v)u 5
0 < 2, (z, y) < C } and choose (²(2,) y) such that y T 0,
xo = 2, - p 1,, v)y.
C,
if 2, n² (2, y)u; 2 C
Vi E n1). We use the notation μ² (z, v) to highlight the dependency of the multiplier μ²' on the variable a and the label y.
n3..
We introduce the CLIP (+) operator which clips the value of the given input to the interval [0, C7. This operator yields the following compact expression for A
X (I.P|p,o1 (z- n² (2, (z,))y), where μ² (z, y) is chosen such that y X 0. (20)
16

---

Published as a conference paper at ICLR 2025
By substituting the previous expression for X into the equality constraint, obtain y (o (z, v)y) O,
(21)
which provides an equation that implicitly defines μ² (z, y). We further simplify (21) by indexing the components of z n² (2, y)y with respect their values, which yields
0
Σ Cyi
Σ
Ve(Ez 1= (z, (z,1)
EE
IET,
Σ
Cy
Σ
2:36
Σ
(2.
EE
iEL.
IET,
Σ
Cy
Σ
2436 Σ (2,
(from y/ 1)
EE
IET.
iET.
where I. {i) X - -" y)y (0,C)} with cardinality Ig and Ic {i Ax 1¹ (2,8)81 2 C}. We further solve for μu, which yields
1 (=,
Σ JEZZ
Cy
23
Iz
VEI.
This equation implicitly defines μ (z, y), which represents the basis for the fixed point iteration introduced in Algorithm 2.
This equation will also be the basis for computing sensitivities, i.e. quantifying how X and μ² change when altering or A. We first compute
For a data point i, the following can be stated:
0s
Ox
c
(=.ul 82
Vis
if 2 (z, v)v E (0,
(22)
8z
else,
where eş the ith standard basis vector. Differentiating the constraint (17) yields
)(yT)*)
n
ax;
0
yi
Oz
Oz
i=1
0u
(z, (2. y
Σ İEI.
e Vi
Oz
Substituting v = 1 into the previous equation yields
Σ
T
Oμ² (2,9)
TET.
(23)
dz
Ig
where Ig with cardinality Ig
is defined previously. From (22) and (23), we have
Σ
cTu:
ax
Oz
cT
JEZ.
I.1
Vi
if I.
0,
if $ Ig.
Therefore, we conclude that
0xx
1 E [n],
(24)
Oz
where we have exploited the fact that E {+]}
We further note that the situation I, X E {0, C)2 a change or y will not affect X unless C + y. y. As a result, we have for I_ 0, 05
2 μu or
ax
By (a.e.).
We now compute
8A dy
For data point the following holds: (z.v) By
a
yi - c, (2,0))
ifel. I,
(25)
Oy
0.
if $ I..
17

---

Published as a conference paper at ICLR 2025
Differentiating the constraint (17) with respect to y yields
((y=x*)
n
x² +
dy
dy
y/
Op (z, 1)
y/11" (2,))e))
dy
IEZ
It follows from 1/,/²= = that
Ata 1 (2.y)
E yie!
pp (z,
(26)
dy
Ig
From (25) and (26), we obtain the following.
ULd T + (2,z)
U1 Σ
0x
JETZ
if I.
II
I
Oy
0,
if o I..
As result, conclude using Lemma 3 that the following bound holds vi [n]
0>g
|
(2,
+
(27)
Oy
I
I
Ny
where Ky is constant that only depends on C. and the features of the dataset. From (24) and (27), we conclude that
| D|loc = (2, v.) X (21, ((A)) + (* (2 (a))ll
S Kyyllve 0())llo 1| 21loo-
A.2 PROOF OF LEMMA 2
Our objective to prove that the distance the non-projected updates Algorithm from the Stackelberg equilibrium (Å, (())), specifically - 2, is bounded.
We begin by recalling the update rule at round A, :- PROXS( is the feasible set defined by constraints (12), using
PROXS(p.) (A:-1
Vf 31)), where y (() Syy) the labels round t. We further recall the Stackelberg equilibrium (2, (A)). i...
Å = PROX S(M())) (2) = PROx s(eA) (A (())))
(Â) (F),
where the operator LFLIP: X x y + y defines the label poisoning attack formulated in (7-9). We conclude the following:
A-1 V
$ = i - // VV, (())
2 2 A-1 Å- (V y.) - VA(()
We apply the mean value theorem for functions with multiple variables the previous expression which allows us to rewrite 2 as
A - A 17 V (Af(Ar-11 V m.) + Vxf(Ā. v)) Vxf(a, vxf().
= = - - (EA (0,( й) J( ((A))
where & E (ी, Ac and Ey E (f( (), 3²). The last equation can be restated as:
2 2/2 = (T- ( ux) (A -)-
(2, ,())),
(28)
18

---

Published as a conference paper at ICLR 2025
where I denotes the identity matrix. We have defined the gradient of the objective in (10) as (xf(A, Q L. where Q is the matrix with entries Qij yı Vi,j [n]]. using the simplified notation. We express the second-orde orderr partial derivatives as:
() = ④ yy",
(29)
[Qx = K o y (K(OO(O))))
(30)
where K is the Gram matrix, / is the n x n identity matrix, 11 is the all-one vector and @ denotes the Hadamard product. From (28), (29) and (30), we obtain
- 2 = (1 - (K 2 vovi (A--1-A)
O + 11 (K(A (vo ((A)).
We take the infinity norm and conclude:
2| 2 = 11( - 7 (K @ wesi yey ((--1-))
- -17 K
"I +IO Ey)1 (y1 {(1)))
Ey (
||(I 7 (K
(| -
+ 1 K xT + (
Ey)1T) (ue {({))l (triangle inequality)
= |I(T 17 (K vith (A 2)1lo
+ || K 2 x + 1 (((A()))))))) (wr - b(A)i
(homogeneity)
(I( I (K o well m/ M|-11 -
XA
Il K KKO + 10 (0(K(()))))))
1oo0 llle u())loo..
(homogeneity)
This implies that
|| 2l S <allle-11 Aa1 + Klllue [))1l
We note that Kλ < 1 the learning rate 17 chosen small enough.
A.3 PROOF OF THROREM 3.1
Let (), (A)) denote the Stackelberg equilibrium, i.c., (2) = PROx suaAn (VVA((
Å = PROX (((()))
({} = (A),
where the operator LFLIP X' x y defines the label poisoning attack formulated in (7-9). We further assume that the LFLIP operator returns unique set of adversarial labels at the Stackelberg cquilibrium (й, (())), which implies that there are no ties with respect to values. As a result, there exists small enough constant 8' > 0 such that for any do with IA Rll 8', the corresponding (Aoo) satisfies ((o) v()). (Indeed, long as 8' is small enough, such that the top-k entries between Å and do agree, ((Ao) 5()) will be satisfied)
By combining Lemma 1 and Lemma we conclude
||^1 All I ky)l ()) + || alloo || 2ll0o S <x]|A> - -Allbo < Kx0",
where we used the fact that ((A)) (()). The learning rate 17 is chosen small enough, such that RΛ < 1 and therefore ||^, - Âlloc < KA6' < 8'. We therefore conclude by induction on / that || - ما n6,5' for all t > O. This readily implies X + Å. Moreover, choosing ò = minfc, 8'} concludes || Alloo < and concludes the proof.
19

---

Published as a conference paper at ICLR 2025
A.4 GLOBAL CONVERGENCE RESULT
The previous section provides the proof of Theorem 3.1, which provides a local stability and convergence result. Under additional assumptions on the constants Ky and Ky that capture the sensitivity of the iterates Å with respect to changes in the labels, one can derive global convergence result, summarized by the following proposition:
Proposition 1. Let (), (()) denote the Stackelberg equilibrium as before and let (A(e)
X(1+1)) 1/2 2 O, where X(1) denotes the largest entry of X, X²2) the second larges entry of X etc. Provided that
2(Ki + kiy): 8'
KX
holds and that the step-size 1) is chosen to be small enough, the iterates {Ne} of FLORAL are guaranteed to converge to \ from any initial condition Xo-
Proof. As a result of Lemma and Lemma 2 we conclude that
O0 S Ky (> 11) + || - 211oc
S (Kg + KLy) (15((e1)))) (())lloc + +elll-e-1 - Volloe.
We further take advantage the fact that (I() {())llx S 2k for any (at most k labels are flipped), which implies
1 bo1oo EnllAA-11 dooloo -2(K,, + KT)s.. The previous inequality is satisfied for all t, and can used to conclude that
|| Al|=c S xl مااا + 2(Ks, + KG,K
(31)
KY
holds for all & (this can be verified by an induction argument). As a result, there exists an integer > such that || ~llso < 8' for all / > L'. This implies, due to the choice of d', that ğ(Ae) O(A) for all t'. We therefore conclude that for all t t'
1|
oll S xx Ae- Åll
This readily implies A, 2, due the fact that Kλ < 1, and implies the desired result.
B THE GRADIENT OF THE OBJECTIVE (4)
We begin by recalling the kernel SVM dual formulation (Boser al., 1992; Hearst et al., 1998):
D(fx
min XER
1
Σ
n
n
AtAyyeBiK Kij
Σ x
n
2
i=1 j=1
n
subject to
A =
i=1
0
0 A; S C, E
where K represents the Gram matrix with entries Kij a,),, Vi,j E [n] == mm. derived from a kernel function k. We consider the 9hh data point and apply differentiation of a double summation to the objective, which yields
a (D(fa:D) @hp
Σ
Aemal Kip + Σ NoUpy, Kps
2
= Up
Ai
(from the symmetry of the kernel function)
1=1
In compact form, obtain the following.
VxD(fa;D) = QA 1,
where Q is the matrix with entries Qú yııı Kij, Vi.j E [m] and 1 is the vector of all ones.
20

---

Published as a conference paper at ICLR 2025
C EXPERIMENT DETAILS
For experiments, we set the hyperparameter values given in Table 3. We provide the experiment details as follows.
We initialize the model fxo with parameters set to O. In FLORAL, however, the attacker uses randomized top-k rule to identify the B most influential support vectors based on the À values. Due to the 0 initialization of X, warm-up period is required, which set round for all SVM-related methods.
To train kernel SVM classifiers for SVM-related methods other than FLORAL, we use our PGD- based Algorithm 1 with dummy attack, that is, eliminate the adversarial dataset generation step and employ vanilla PGD training.
For large datasets such as IMDB, we implement projection via fixed point iteration as given in Algorithm 2 in Section 3.2 instead of constructing quadratic program defined in (11-12).
Table Hyperparameter values.
Symbol
Hyperpurameter
The siro of the tniiinn disvel
Moon: 500, IMDR 20000
T
The sumber inaning munds
Moon: 500, IMDB: 1000
The sumber projectoon fited point iteration rounds
1000
The attncker budget
Moon: [10, 50, 2505, IMDB: (500, 2500, 5000, 12500)
The sumber lahels poisen
Moon: [5, 10, 50, 1354, IMDR (250, 1250, 2500, 62500)
C
Rezularizaion
soft margin SVM
Moon:
100). IMDB:10
7
RDI kemel parameter
Moon: (0.5. 10,, IMDD: 0.005
projection fixed poiat
Optimized
(3,0001, MI.
0,8005, (.OOIT)) RoBEXTi:
scheduler
Moon:
rounds (optimized), for RoBERTh linear scheduler loyers with
medel trchitectune aN NN-PGI
ponurbstion
step
SGD optimizer momentum value
C.I DATASETS
Moon is benchmark dataset for binary classification tasks, generated directly using the scikit-less library (Pedregosa et al., 2011). It contains two-dimensional input examples with each feature taking value in the range [-2.5, 2.5]. We generate its adversarial versions by flipping the labels of farthest points from the decision boundary of a linear classifier trained on the clean dataset, using label poisoning levels (%) of (5, 10, 15, 20, 25). We provide the visualizations of the Moon training dataset with clean and adversarial labels in Figure 5.
IMDB review sentiment analysis benchmark dataset (Maas et al., 2011) contains train and test datasets, each containing 25, 000 examples. We used randomly selected 20, 000 points from the training set as training examples, and the rest as validation examples. We fine-tuned the RoBERTa- base model (Liu al., 2019) on this dataset and extracted features (768-dimensional embeddings) to train SVM-related models on this dataset. We generated adversarially labelled datasets using the fine-tuned RoBERTa-Bee base model on the clean dataset. Specifically, we identified the most influential training points based on the gradient of loss with respect to the inputs and flipped their labels under various poisoning levels (%) (10, 25, 30, 35, 35.
Footare
Segture
Festure
(a) Clean. (b) Dav 5%
(c) Dady 10%.
(d) Davy
25%
Figure 5: Illustrations of the Moon training from example replication, using clean and adversarial labels with poisoning levels: 5%, 10% 25%.
'The pre-trained RoBERTa-hase model can be found in roberta- base...
21

---

Published as a conference paper at ICLR 2025
C.2 BASELINES
In our main experiments, we compared FLORAL against the baseline methods by carefully selecting their hyperparameters using the domain knowledge, which detail below.
LN-SVM (Biggio et al., 2011) applies heuristic-based kernel matrix correction by assuming that every label in the training is independently flipped with the same probability. It requires predefined noise parameter μ.. which we set to {0.05, 0.1, 0.15, 0.2, 0.25] } by leveraging the domain label poisoning knowledge, i.e. using the poisoning levels of the adversarial datasets.
For Curie (Laishram & Phoha, 2016), (0.95, 0.90, 0.85, 0.8, 0.75). To compute the average distance, we considered = 20 neighbors in the same cluster for the Moon dataset and k 1000 neighbors for the IMDB dataset experiments.
set the confidence parameter to
For LS-SVM (Paudice et al., 2018), we use the relaheling confidence threshold from (0.95, 0.90, 0.85, 0.8, 0.75), again aligning with the poisoning level of the adversarial datasets. For its k--N step, we considered & 20 and 1000 neighbors for the Moon and IMDB datasets, respectively.
NN baseline is fully connected multi-layer perceptron with two hidden layers with 32 units each, trained using the SGD optimizer with 0.9 momentum and binary cross-entropy loss. For additional experiments on the MNIST dataset, similar architecture with two hidden layers having {32, 10} units is employed.
NN-PGD is based on the same NN architecture as above, trained with PGD-AT (Madry al., 2017) using a standard perturbation budget of 8/255 and a step size of 2/255.
C.3 ROBERTA EXPERIMENT DETAILS
We fine-tune the RoBERTa-buse base model' on the IMDB review sentiment analysis dataset We fine- tune the model for three epochs with no warm-up steps, using the AdamW optimizer, weight decay 0.01, batch size 16, and learning rate 2e-05 with a linear scheduler, using single NVIDIA A100 40GB GPU. We extract the last layer embeddings of the trained model for experiments with FLORAL. integration.
D EFFECTIVENESS ANALYSIS OF FLORAL DEFENSE
As explained in Section 3, FLORAL takes a proactive defense when the initial training data is clean, iteratively adjusting the model to reduce sensitivity to potential label poisoning attacks by exposing to adversarial decision boundary configurations through adversarial training. Conversely, when the training data is already contaminated with adversarial labels, FLORAL mitigates their effect by implicitly sanitizing the corrupted labels.
To demonstrate how FLORAL defenses under already poisoned training data, further analyze the efficacy of FLORAL by measuring its "recovery" rate poisoned labels. That is, we quantify FLORAL'S 's rate of disrupting the initial attack (%) the adversarially labelled training sets, averaged over replications.
As reported in Figure 6a the adversarial Moon datasets, FLORAL able disrupt the initial label attack (already inherited in the training set), at a 25 35% rate. This contributes to the success of the FLORAL achieving higher robust accuracy in training with adversarial datasets. Moreover, we provide example illustrations (Figures 6b-6d) that show which poisoned data points are recovered by FLORAL under the randomized top-k attack.
TTh IMDB review sentiment dataset can be found in http::///oggiigaaaccco//// stanforénlp/inee
22

---

Published as a conference paper at ICLR 2025
% Identilted Poloneed Labela
% Identified
25
Feature
15
10
-2
C=10, gamma=1
10, gamma-aaa 0.5 Setting
C=100, gamma=10
Feature
(a) Average (%) poisoned labels recovered by FLORAL.
(b) A trace for recovered points on D 5%.
Feature
Feature
Feature
Feature
(c) trace for recovered points on Dat 10%.
(d) trace for recovered points on Dad 25%.
Figure 6: The average percentage of "recovered" poisoned labels by FLORAL over the adversarial Moon datasets containing (5. 10, 25} (%) poisoned labels. As shown in (a), FLORAL is able to recover, average, 25 35% of the poisoned labels. The plots (b)-(d) illustrate example traces, showing which poisoned data points are recovered by FLORAL.
23

---

Published as a conference paper at ICLR 2025
E ADDITIONAL EXPERIMENTAL RESULTS
We provide additional experimental results under various hyperparameter settings for the Moon dataset Appendix E. Appendix E.2, first report a comprehensive comparison of FLORAL against other baselines on the IMDB dataset, followed by an analysis of how FLORAL shifts the most influential training points for RoBERTa's 's predictions on the IMDB dataset. In Appendix E.3, provide experiments on the MNIST (Deng. 2012) dataset. Finally, we present sensitivity analysis with respect to the attacker's budget Appendix E.4.
MOON
We report the clean and robust test accuracy of methods under different (non-optimal) kernel hyper- parameter choices and considering label poisoning levels {5, 10, 25)(%% in Figure 7 and Table 4.
When the kernel hyperparameters not optimally chosen, NN-PGD shows superior performance in less adversarial scenarios compared to SVM-based methods. However, also demonstrates significant sensitivity label attacks in 25% adversarial settings, against all other baselines. FLORAL particularly advances by maintaining higher robust accuracy in more adversarial settings.
Accuracy
Accuracy
Accuracy
Accuracy
1.000
3.300
6.457
0.375
6.375
6.225
6,775
A-333
A-723
0.000
6.000
6.a50
6,700
20.15
0.315
6.223
6.530
0.33
0.533
0,75
6.52
0.500
110
0.500
110
0:757
110
0.57
Rounds
Bounds
Bounds
Rounds
(a) Clean.
(b) Dadr 5%.
(c) Dady 10%.
(d) Dady 25%.
Accuracy
Accuracy
Acturacy
Acturacy
0.375
0.375
0.723
6.75
0.350
0.350
0.300
0.000
6.453
20.75-
6.030
0450
6.000
0.000
0.300
0,750
6.30
Dounds
Dounds
Dounds
Rounts
(c) Clean.
(f) D
5%.
(g)
Daay 10%.
(h) Daly
25%.
FLORAL
Vanilla SVM
NN
NN-PGD
LN-SVM
Curie
L$ SVM
K-IID
Figure 7: Comparison of clean and robust test accuracy of methods trained on the Moon dataset under different kernel hyperparameter choices. For all SVM-related models, the first row corresponds setting (C = 10, 7 0.5), whereas the second row shows the setting (C' 100, 7 10). As the level of label poisoning increases, the accuracy of models trained on adversarial datasets generally declines. When the kernel parameters are not optimally chosen, FLORAL demonstrates superior performance, particularly under the 25% attack.
E.2 IMDB
We report the test accuracy and loss performance of FLORAL against RoBERTa on the IMDB dataset Figure 8 and Table As demonstrated, FLORAL consistently exhibits superior accuracy and smaller loss in more adversarial problem instances, without sacrificing the clean performance. This shows the effectiveness of FLORAL achieving robust classifiers when integrated with foundation models such RoBERTa.
24

---

Published as a conference paper at ICLR 2025
Table 4: Test accuracies of methods trained on the Moon dataset. Each entry shows an average of five runs. Highlighted values indicate the best performance in the "Best" (peak accuracy during training) and "Lastt" (final accuracy after training) columns.
Methed
Setting
FLORAL
SVM
NN
NN PGD
LN-SVM
Cune
LS-SVM
K- K-LID
Best
List
Bes
Loot
Ridd
1.xs
Bod
Lood
Reel
1.x4
Best
1.st
Boa
Ladd
Best
Last
10,5
10,5
0.573
0.559
0.227
0.568
0.889
0.374
0.88
0366
2 2536
Ch- 10,7
0.738
0.717
0.51
0.693
0.647
0.740
0.655
0.633
0.731
0.661
0.696
0.71
10,5
0.960
0.964
0.940
0.511
0966
10,5
0.940
0.51
Ch- 10,y
0.924
0.907
0.000
0.859
0.227
0.853
0.868
0.907
0.894
0.088
0.07
70th 2508
C= 10, =1
0.801
0.068
0.55
0.217
0.691
0.647
0.240
0.655
0.754
0.883
0.779
0.697
0.766
0.947
0.60
100
100.1
0.440
0.37
0.926
0.664
0.377
0.940
0888
0.977
0.445
0.91
0.400
100,
0.10
0.77
0874
0.859
0.85
0.927
0851
0.588
0.81
0.8%
0.855
0876
D 2076
C- 700.7-13
10
0,740
0.720
0.697
0.693
0
0.647
0.240
0.655
0.697
0.894
0,760
0.744
0.701
0.687
0.697
0.693
Table 5: Test accuracy and loss of methods trained on the IMDB dataset. Each entry shows an average of five replications. Highlighted values indicate the best performance in the "Best" (peak accuracy during training) and "Last" (final accuracy after training) columns. FLORAL demonstrates superior robust accuracy and lower test loss compared to RoBERTa, particularly in more adversarial scenarios.
Accuracy
Loss
Setting
FLURAL
RoBERTa
FLORAL
RoBERTa
Best
Last
Best
Last
Best
Last
Clean
0.911
0.911
0.91
0.196
0.216
0.229
0.282
Dal 10%
0.903
0.903
0.904
0.903
0.234
0.259
0.227
0.231
25%
0.889
0.889
0.882
0.861
0.310
0.333
0.337
0.365
Dal
30%
0.880
0.880
0.867
0.835
0,353
0.366
0.428
0.428
35%
0.871
0.871
0.827
0.805
0.381
0.395
0.496
0.496
Dal
40%
0.863
0,863
0.779
0.771
0.428
0.439
0,551
0.551
Test Accurecy
Teat Accuracy
Vest Luos
Veatt Lans
3.101
0.95
1.40
0.83
1.00
0.83
01701
413
6000
1006
206
1000
5t0g>
Steps
Stegs
Steps
(a) RoBERTa.
(b) FLORAL.
(c) RoBERTa.
(d) FLORAL.
RoBERTS Clean
Adv 10%
Adv 25%
Adv. 30%
Adv 35%
Adv. 40%
FLORAL Clean
Adv. 10%
Adv 25% Adv 30%
Adv 35%
Adv 40%
Figure& 8: Test accuracy ((a)-b))) and test loss ((c)-(d) of methods on the IMDB dataset. FLORAL integration outperforms fine-tuned RoBERTa in maintaining better test accuracy and converging faster to lower loss, even when trained on extracted embeddings with heavily adversarial labels.
25

---

Published as a conference paper at ICLR 2025
Analysis on influential training points. We further analyze how the influential training points (affecting the model's 's predictions) identified by FLORAL and RoBERTa change.
To illustrate, Figure 10 shows example from replication where both models are trained dataset with 40% adversarially labelled examples. We also provide the result for RoBERTa fine-tuned on the clean dataset. For FLORAL, the most influential points selected from the most important support vectors, while for RoBERTa, these are the points yielding the largest loss gradient with respect the input. The example clearly demonstrates that FLORAL, implemented on RoBERTa-extracted embeddings, shifts the most important training point for the model's decision boundary. FLORAL identified a more descriptive point compared others as given in Figure 10, however, further analysis is required to determine whether FLORAL consistently identifies such training points across all cases.
Additionally, we investigate the overlap in influential training points between the two methods. To this end, for each method, we extract the 25% most influential training points (for the model predictions) among the training dataset, and measure how much overlap between these two sets. In Figure 9, we report the percentage of "common" influential points identified from the IMDB dataset, averaged over replications, with error bars denoting the standard deviation. The left figure shows the percentage overlap between FLORAL trained on the IMDB dataset with different poison levels and RoBERTa fine-tuned on clean labels. Whereas, the right plot shows the overlap between both models trained on the dataset with different poison levels. On the clean dataset, although there are some differences, both methods almost identify the same set of influential points. However, as adversarial labels increase, the overlap decreases. This shows that FLORAL extracts more critical points that enhance the model's robustness in adversarial settings, as supported by its superior robust accuracy, already shown in Figure 8 in Section 4.1.
Commos influential "Truming Peints (15) Idcniffeddy by FLORAL and BuBEXt
Common Inflcentiol Training Phinss (4) Sdcatifled by FLORAL and RoBERTo
76
(80 commen points
10
(50) common
50
40
Adr. 8.1
Adf. 0,28
Ade 0.3
8.30
Aby 8.4
Clea
Ads 8.55
Adl 0.20
Adr 9.4
Ads
Abr
Databer
Datasey
(a) w.r.t. RoBERTa (clean).
(b) w.r.t. RoBERTa (adversarial).
Figure 9: The percentage of "common" influential points identified by FLORAL and RoBERTa from the IMDB dataset, averaged over replications, with error bars denoting the standard deviation. "Clean" shows the dataset with clean labels, whereas adversarial datasets contain {10, 25, 30, 35, 40)(%) poisoned labels. Even when both methods are fine-tuned on the clean dataset, slight differences emerge in the identified influential training points. The diserepancy increases the dataset becomes more adversarial, highlighting that FLORAL adjusts the influential training points affecting the model's predictions.
26

---

Published as a conference paper at ICLR 2025
FLORAL (Dadv=400)) :
Sitting down watch the Lith seasen the Bachelor ("On the kings of love") "
suitd be for "interesting" time. 2 satsted the previzus senscrs of the tnchelze in passing: autcting an apssnde or too and eissing the rest three or so rind that the Eachsior is otter arpeating and intrigudag, trough its quality and corality are otter Lacking..drr /oerr 1> the kings Love" detalis the fournay takes Iake 31 yaur teautiful girls froe over the fes s sinute conversatiats? lake tries to aske his thue Intenttions kremn froe the very beginsing least to the auffencee He aoted that te deesn't gist sont love good thee, but warts flance
tree thee bit,
sppeiiiclaly reality-dress
25
beglrs
de can only ssoure that has mode this clean to the wooen the conpectiiinn well. that tiper copprtinton
degrre, eight explatn, wothen whan tacceratting and warnings of "aarth out all thos that these wasen wereete there for good tiee aither hate soned that te use not just looking for one appeat, hur booking for consector.. sowerrr, the girls pulleed our all stops to try tepress lake with sald one appest, They sectiedd some sirls souned to waintein
they conf ieett
yet. Threats,
stitt to
cte foche polst only
sense decorany others iisved that soro that "ranny anyting. she got Flact from the other girls for het prosocative atcioonnt which shoved thiir take these situstions or /ide 1950, reality cotine stow couldn's i be that bol, could 1it Bazides the dbvioss iosse of sax driven actraction, thore and other issuss that our this sea ingly harnless show. is the right way
menzion skinpy drisses Beither low
altoarther.
extrene irsportions? turattyy hoaever, is the pronature cnotioral all ictactment which may of the girls board that holselles to Jake a fox gi-ls in particular secmal be ovrryy attachol.
sate; vying for
accontion by flanting lictle
giri uad "Ir doe't get that tiret taprasstce rose it will kill nel" as nesticted betore, they con't t even know tis yet and the was talking about spacitic rase, not just ore the rases ceep free caiig eitetrated.dd /scar caftchella, in partscular, asemd have issues with attachment outturst, Inarrocly
bean hare hour." Michelle
eventng the rirst other girls trought it was steply ridicsious. fnother giri also craed, but because sto ellminated dhr /oabr ssit began with surviser, and froe there country:
the Last
allaination cand extrrnntly emational about it.
it gust teot off Brexiity TV. stows our entertatemett inte restesta
weren't warching the
giving then gost ratings,
to queation: enough
trappings .ar /oer /othis that trows is to 187 Is in hecause ue see the siatlartetes to our san llves, on Is in because un sont to be sire that un are sore stable and lees than drows pamerti thas athers?? whatweer had; however, saytngg that
general) Loves reality and
it that
like reality TV? What it about it
struld careful
andta and internatoent that ue allow foste /oépteoder
our riteds. I'm entrique:
sayle all realitty Fptisaee
(negattue)
RoBERTa -n-need on clean): :
This cocurentary schlncinedster William Castle takes cheas shots vost--lost at the farny, stily people with the ghost-glasts---ter st's aiso arfectionate are ssvely, with particularly tright co comentrry froe 201n Naters, uns abunlutaly the target auttence such tntings at the time, and Castie's daughter, stored her and alse pretsy percaptiiv ottepring.)
natue 'Ses- 1G0s anutroneent in which be did ris eest characteriette
very goss, "Strolgte lacket"' odane taker, who looks great, and time Hele, shon she replaced at the iestigation of star Joan Crawford. larry] rickeen all but explodes into glagles at the hoppy mesory of morking with cascle on Tingler," " and there's is toough Footage to give is an 100s of the level of castle's talest--oot very righ, but very energette.. pleasart look tine when ausiences were eastly (posicive)
sorveting then brilllat,, and
been
handevkiing faeily
you sestalgic stapler wvit-geiin days.
RoBERTa (fine- on Dadv=400)
Somware actually gave this movie 2 atars. There's very righ chancs they need imsociate professional help anyone who doeat's is spend 30 seconds to ase real herrible (spart fron acting, plot,
scery.cbe
snuff movia with scebiss. the poebe soaatshing it is actuulll quite scary in taimuss; you' ro tarrified sonzone all; cow ever and you'll i1 never be stle to describs what and they' 13 ge way mainkinng you frese mar sarches home-aste anateur tornice utdens cometiing alorg these Tines che /oche fofln taten unitiing
sets, dizlogus and sound). vroulyy assumd it about
forper attwept being roeetable fate juct suffered, che Zoche 1St rste t've (nngactue)
1.6 rand heart) will
and
Figure 10: Note: Figure might contain offensive content. The most influential training point for the model's predictions, identified by FLORAL and RoBERTa from the IMDB dataset. FLORAL implemented on RoBERTa extracted-embeddingg changes the most important training point for the model's 's decision boundary.
27

---

Published as a conference paper at ICLR 2025
E.3 MNIST
To demonstrate the generalizability of FLORAL across diverse datasets, provide additional experiments on the MNIST dataset (Deng, 2012). Similar to (Rosenfeld et al., 2020), we consider classes 1 and which leads to dataset of 'D ((r,, ((), 12) where 2; TR784 and yi (+1), with 784 pixel values for each image.
We perform the randomized top-k label poisoning attack described in Section and report the clean and robust test accuracy performance of methods in Figure 11 and Table 6. The results show that FLORAL maintains a higher robust accuracy compared most of the baselines. While Curie behaves almost on par. FLORAL achieves higher robust accuracy. Although NN baselines perform better on clean and 5% adversarially labelled datasets, they show a significant accuracy decrease when the training dataset gets more adversarial.
Acturacy
Acsuracy
Accuracy
Accuraty
3.35
6:96
0.32
6:32
6.30
272
200
306
400
300
200
106
400
300
D72
210
100
400
300
100
230
Rounds
100
411
300
(a) Clean.
(b) Dad
5%.
(c) Dadv
10%.
(d) Dadv 25%.
PLORAL
Vanilla SVM
NN
NN.GGD
LN-SVM
Curic
LS-SVM
K-IID
Figure 11: Clean and robust test accuracy of methods trained on the MNIST- 1vs7 dataset. "Clean" refers to the dataset with clean labels, while the adversarial datasets contain {5, 10, 25} (%) poisoned labels. For all SVM-related models, the setting C 7 = 0.005 used. As the level of label poisoning increases, models trained adversarial datasets generally demonstrate decline accuracy. However, FLORAL maintains a higher robust accuracy level compared most of the baselines and behaving par with the Curie method.
Table 6: Test accuracies of methods trained over the MNIST-Ivs7 dataset. Each entry shows the average of five replications with different train/test splits. Highlighted values indicate the best performance in the "Best" (peak accuracy during training) and "Last" (final accuracy after training) columns.
Method
Setting
FLORAL
SVM
NN-PGDD
I.N-SVM
Curin
LS-SVM
K-I.D
Bol
List
Rol
Las
Bol
Las
Bes
Lind
Bel
Easd
Bol
Las
Bes
1asi
Boel
Lasl
0805
0.922
0.992
0.993
019944
0.987
01900
0.950
0.987
geb
5.5
0.00
0.988
0.844
0.980
0.974
0.969
0.982
0.939
0.929
0.919
0.579
0.954
0.979
0.788
0.977
0.979
0.919
ge
10%
B.
0.006
8.944
0.778
0.964
0.920
0.952
0.930
0.952
0.394
0.965
0.940
0.974
0.974
0978
0.977
0.966
0.945
7
25%
5
080
0853
0.800
0.341
0.541
0.738
0.738
0.263
0.700
0.712
0.712
0,887
0.822
0.796
0.795
0.112
0.712
E.4 SENSITIVITY ANALYSIS
In experiments with the Moon dataset under varying label poisoning levels, consider attacker budgets B = 2k under varying & values, and report the best performing setting in Figure in Section 4.1.
However, we further investigate the sensitivity of FLORAL to the attacker's budget B, by considering levels B E (5, 10, 25, 50, 125), with results presented in Figure 12. As demonstrated, FL.RAL shows superior performance under a constrained attacker budget the clean label scenario, as expected, since an increasing number of adversarially labelled examples during training degrades clean test accuracy. In contrast, baseline methods operate on a fixed dataset. However, as the dataset gets more adversarial, FLORAL outperforms under higher attacker budgets.
28

---

Published as a conference paper at ICLR 2025
Test Accuracy
Test Accuracy
Test Accuracy
Test Accuracy
6.75
(a) Clean.
(b) Day 5%.
(c) Dady 10%.
(d) Daay 25%.
FLORAL B=5
FLORAL B=10
FLORAL_B-10
FLORAL_B=H B=25
FLORAL B=50
FLORAL_ B=125
Figure 12: The sensitivity of FI.ORAL. the attacker's budget B. "Clean" refers to the dataset with clean labels, while the adversarial datasets contain (5, 10, 20,25))) poisoned labels. The performance under setting (C' 10, y is presented. As the level of label poisoning increases, FLORAL performs better under higher attacker budget settings.
F EXTENSION TO MULTI-CLASS CLASSIFICATION
We extend our algorithm multi-class classification tasks, detailed in Algorithm 3. The primary modification involves adopting a one-vs-all approach (Hsu & Lin, 2002) by employing kernel SVM model fi for each class m E M and associating multiple attackers Om, m E M for the corresponding classifiers. In each round the attackers identify the B,, most influential data points with respect to X/" values of the corresponding models under their constrained budgets Bm, and gather them into a set B,. Among the points in B,, the labels of top-k influential data points are poisoned according to a predefined label poisoning distribution q. The dataset with adversarial labels then shared with each kernel SVM model and local training is applied via PGD training step.
Algorithm 3 FLORAL-MultiClas
Input: Initial kernel SVM models f% for each class m M, training dataset Du = {(I;, m)))mn E Rd 1/
{=1}. attackers' budgets Bmd parameter k. where k < min MEM,, learning rate 77, a pre-defined label flip distribution q.
2: for round f = 1,...,,? do
3: Initialize B, 0.
4: for m E . do
5: BTTh Identify tm support vectors w.r.t. A values by solving (7-9).
6: end for
7:
B. UMEM B
8:
V' randomized top-k Randomly select è points among B, and poison their labels w.r.t g.
9:
D. < {(x,,0))
*/ Adversarial dataset with selected & poisoned labels
10:
for MM do
11:
Compute gradient of the objective (4), V ; based on A Dr as given in (10).
12: Take a PGD step X," + PROx (A - D(Ax D.)). */ Adversarial training
13:
end for
14:
end for
15: return { bMEM
G COMPARISON AGAINST ADDITIONAL METHODS
We additionally compare FLORAL against least squares classifier using randomized smoothing (RS) (Rosenfeld et al., 2020), and regularized synthetic reduced nearest neighbor (RSRNN) (Tavallali al., 2022) methods on the Moon and MNIST- datasets. RS provides robustness certification for a linear classifier under label-flipping attacks. Whereas, RSRNN, conceptually similar to Curie (Laishram & Phoha, 2016), provides a filtering-out defense based on clustering.
29

---

Published as a conference paper at ICLR 2025
We evaluated the performance under different noise (q) and regularization (A) hyperparameter values for the RS method suggested in (Rosenfeld et al., 2020), whereas we considered varying number of centroids K, penalty coefficient X, cost complexity coefficient a, for the RSRNN method, using referenced values in the study (Tavaalali et al., 2022) for the MNIST dataset.
The results presented in Tables 7-10 demonstrate that FLORAL consistently outperforms both RS and RSRNN across all datasets and experimental settings. While RSRNN achieves comparable performance on the MNIST dataset, still falls short of FLORAL. The performance of the RS method, which employs a linear classifier with a pointwise robustness certificate, aligns with expectations, as its simpler classifier limits its ability to capture complex patterns. In contrast, FLORAL utilizes kernel SVMs, enabling it to effectively model intricate patterns within the data and achieve superior results.
Table Test accuracies of FLORAL against randomized smoothing (RS) method (Rosenfeld et al., 2020) on the Moon dataset. Each entry shows an average of five runs. We evaluated the performance under different noise (g) values for RS.
Method
Setting
(5 0.00)) Ry 0.3,A
154,-004
Clean Faah
C 10
0.968
0.557
0.500
0.509
39
10,7
0,500
120h
25%
C= 10 0.77%
0,520
0.505
0.505
Table 8: Test accuracies of FL.ORAL against randomized smoothing (RS) method (Rosenfeld et al.,
2020) on the MNIST-1vs7 dataset. Each entry shows an average five runs. We evaluated the performance under different noise (g) and l2 regularization (A) hyperparameter values for RS, as suggested in (Rosenfeld et al., 2020).
Merhhel
Setting
Buy
1ith 109
8.7N
8/965
0.813
0.766
0.530
6/445
0,673
0th 20%6
m k. 0L0C5
8230
8.76
06833
0:60
0.548
0.994
0.96
Table 9: Test accuracies of FLORAL against regularized synthetic reduced nearest neighbor (RSRNN) (Tavallali et al., 2022) trained the Moon dataset. Each entry shows an average of five runs. We evaluated the performance under different hyperparameter values (number centroids K, penalty coefficient X, cost complexity coefficient a)) for the RSRNN method.
Mathol
FLAKKLL
JSHINN (A 22.
JOHNNN 10,0 GJBLA
RSHANN
96,0
RISINN
8.963
0.500
0.517
R601
0.512
1095
8.054
11500
0:517
B.556
300
C
86.
8.7%
0.464
0,34
0446
0.499
Table 10: Test accuracies of FLORAL against regularized synthetic reduced nearest neighbor (RSRNN) (Tavallali et al., 2022) trained on the MNIST-Ivs7 dataset. Each entry shows an average of five runs. We evaluated the performance under different cost complexity coefficient (a) values for the RSRNN method.
Setting
RSRNN(K
Clean
5,5
0,991
0.619
0.092
Dalr
5%
0.981
0.599
0.441
0,008
H EXPERIMENTS UNDER DIFFERENT LABEL ATTACKS
To show the generalizability of our approach in the presence of otherlabel poisoning attack types, we further compare FLORAL against baselines on adversarial datasets generated using the a fa, al fa-ti 1t (Xiao et al., 2015) and I.FA attacks (Paudice et al., 2018). 8).
30

---

Published as a conference paper at ICLR 2025
H.1 EXPERIMENTS WITH THE ALFA-TILI ATTACK
We further evaluate FLORAL'S performance in the presence of a alfa-tilt attack (Xiao et al., 2015) on the Moon and MNIST-IvS. datasets. We report the results on the Moon datasets in Table 11, whereas we present the results for MNIST-Ivs7 dataset Figure 13 and Table 12.
As shown with the results the Moon dataset, FLORAL is able to achieve higher "Best" robust accu- racy level throughout the training process. Furthermore, FLORAL'S effectiveness under a alfattit attack is best shown on the MNIST dataset. As reported in Figure 13 and Table 12, FL.ORAL achieves an outperforming robust accuracy level compared to baseline methods on all adversarial settings. This demonstrates the potential of FLORAL defense against other label poisoning attacks.
Table 11: Test accuracies of methods trained over the Moon dataset with adversarial labels generated by the alfa-tilt (Xiao et al., 2015) attack. Each entry shows the average of five replications. Highlighted values indicate the best performance in the "Best" (peak accuracy during training) and "Last" (final accuracy after training) columns.
Method
Setting
FLORAL
SVM
NN
NN-PCID
IN-SVM
Cariz
LS-SVM
K-LID
Best
Last
Best
Last
Best
Last
Best
Last
Bex
Last
Best
Last
Best
Last
Best
Last
Clean
10.2
0.968
0.966
0.958
0.948
0.900
0.560
0.966
0.954
0.940
0.40
0.941
0.941
0.881
0.881
0.965
0.960
p 5%
C 10.2
0,972
0.957
0.944
0,939
0.43
0998
0.962
0.943
0.956
0.956
0940
0.939
0.898
0.896
0:557
0.936
par 10%
C- 10,
0.971
0.908
0.910
0.866
0915
0.014
0.940
0.906
0.930
0.900
0.920
0.902
0.898
0.896
0.926
0.976
2 20%
C' 10.7
0.803
0.834
0.767
0.722
0.87
0.750
0.837
0.720
0.786
0.723
0.792
0.759
0.792
0.791
0.770
0.708
Table 12: Test accuracies of methods trained on the MNIST-Ivs7 dataset under alfa-tilt poi- soning attack (Xiao al., 2015). Each entry shows the average of five replications with different train/test splits. Highlighted values indicate the best performance in the "Best" (peak accuracy during training) and "Last" (final accuracy after training) columns.
Methed
Curic
Setting
Best
Best
Clean 1oth
C
0,005
0.992
0.99]
0.995
0.903
0,995
0.996
0.967
0.95
0,950
0.978
01957
0.987
0.990
0.958
0.955
0.97%
7ysh
10%
Dah
5,5
0.795
0.739
Tost Accuracy
Thst Accuracy
Thst Accuracy
Test Acturary
21.
6:37
6.50
152
200
206
4.0
500
200
360
4.00
566
200
360
400
56c
260
340
4.00
(a) Clean.
(b) Daay
5%.
Dady
10%.
(d) Duly 25%.
FLORAL
Vanilla SVM
NN
NN-PGD
LN-SVM
Curie
LS-SVM
K-LID
Figure 13: Clean and robust test accuracy of methods trained on the MNIST-1vs7 dataset under alfa-tilt poisoning attack (Xiao et al., 2015). "Clean" refers the dataset with clean labels, while the adversarial datasets contain (5, 10, 25) (%) poisoned labels. For all SVM-related models, the setting C 5, 7 0.005 is used. FL.RAL achieves outperforming robust accuracy level compared to baseline methods on all adversarial settings, clearly demonstrating the potential of
FLORAL as a defense against other types of label poisoning attacks.
31

---

Published as a conference paper at ICLR 2025
H.2 EXPERIMENTS WITH THE ALFA ATTACK
The flfa attack is generated under the assumption that the attacker can maliciously alter the training labels maximize the empirical loss of the original classifier the tainted dataset. From this, the attacker's s objective formulated as maximizing the difference between the empirical risk for classifiers under tainted and untainted label sets.
We experimented on the Moon dataset and considered label poisoning levels (%) of {5, 10, 25}. The illustrations of the Moon dataset with clean and a fa-ttake adversarial labels are given Figure 14. We report the results under al Ea attack in Figure 15 and Table 13. As shown, FLORAL especially effective against vanilla SVM in maintaining higher robust accuracy adversarial settings. NN-based methods again fail drastically as the dataset becomes more adversarial under al fa attack. Although LS-SVM shows premise moderate adversarial scenarios, fails to be effective considering clean and most adversarial performance. Furthermore, FLORAL demonstrates superior performance compared to baselines in the most adversarial setting (with 25% poisoned labels).
Peatare
zeatare
(a) Clean.
(b) D
5%.
(c) Dudv 10%.
(d) Dddy 25%.
Figure 14: Illustrations of the Moon training sets from an example replication, using clean and al alfa-attacked adversarial labels with poisoning levels: 5%, 10%, 25%.
Table 13:
Test accuracies methods trained over the Moon dataset with adversarial labels generated by the al fa attack. Each entry shows the average of five replications with different train/test splits. Highlighted values indicate the best performance in the "Best" (peak accuracy during training) and "Last" (final accuracy after training) columns.
Setting
IN-SVM
I.S.SVM
Cloan
C 10,
8.968
0.966
(1968
01968
0.60
0.560
0.965
0.964
0.940
0.94)
0144)
0.441
0.381
0.581
0.365
0.366
0%
10,
0.963
0.950
01954
D.945
0.875
0.575
0.963
0.958
0.942
0.942
0.34
0.933
0.964
0.964
0.942
0.342
Dah
10%
C 10,
0.954
0.902
0914
0.893
0.36
0316
0.918
0,865
0.914
0.907
0.15
0.14
0,955
0.954
0.914
0.907
25%
0.688
0.729
H.3 EXPERIMENTS WITH THE LFA ATTACK
We additionally evaluate FLORAL'S effectiveness compared baselines in the presence of LFA attack (Paudice et al., 2018) on the Moon dataset. As results are shown in Figure 16 and Table 14, FLORAL demonstrates significant performance when the label poisoning attack level high, i.e., 10% or 25%. However, under those settings, LS-SVM (Paudice et al., 2018) baseline shows faster convergence, which is expected as the LS LSS (Paudice al., 2018) method is specifically crafted against the attack. Considering that LS-SVM fails in clean test performance, it is clear that FLORAL provides a generalizable defense.
32

---

Published as a conference paper at ICLR 2025
Test Accuracy
Test Accuracy
Test Accuracy
Test Accuracy
0.350
0.350
29:70
0.60
6.450
300
500
0.302
300
460
500
200
360
4.0
260
360
4.0
(a) Clean.
(b) D
5%.
(c) Dadl
10%.
(d) D
25%
PLORAL
Vanilla SVM
NN NN-PGD
LN-SVM
Curie
L.S SVM
K-LID
Figure 15: Clean and robust test accuracy of methods trained on the Moon dataset under a alaa poisoning attack. "Clean" refers the dataset with clean labels, while the adversarial datasets contain (5, 10, 25)((%) poisoned labels. As the level of label poisoning increases, models trained on adversarial datasets generally demonstrate decline in accuracy. However, FLORAL demonstrates gradually improving robust accuracy performance, particularly when the attack intensity increases to 25%.
Test Acturaccy
Test Acturaity
Jest Acturatty
Test Accuraty
0.115
0.113
0.113
0.110
0.150
0.153
0.300
6.00
0.373
6.333
0.158
0.153
0.353
0.300
0.360
Bounds
Rounds
Roun
Rounds
(a) Clean.
(b) Dady
5%.
(c) Dydy 10%.
(d) D
25%.
PLORAL
Vanilla SVM
NN
NN-GGD
LN-SVM
Carle
LS-SVM
K-LID
Figure 16: Clean and robust test accuracy of methods trained on the Moon dataset under LFA poisoning attack (Paudice et al., 2018). "Clean" refers the dataset with clean labels, while the adversarial datasets contain (5, 10, 25} (%) poisoned labels. For all SVM-related models, the setting c= 1.0 is used. As the level of label poisoning increases, models trained on adversarial datasets generally demonstrate a decline in accuracy. However, FLORAL demonstrates gradually improving robust accuracy performance, particularly when the attack level is 10% or 25%.
Table 14: Test accuracies of methods trained over the Moon dataset with adversarial labels gener- ated by the LFA (Paudice al., 2018) attack. Each entry shows the average of five replications. Highlighted values indicate the best performance in the "Best" (peak accuracy during training) and "Last" (final accuracy after training) columns.
Setting
Cloan
10
03968
(1966
(1968
0.968
(1960
(196)
(1966
0.964
0.944
0.940
0344
[194)
01.81
0.581
0.966
0.366
Dah
C 10,
0.957
0.954
8.967
0.967
0.906
0.905
0.955
0.910
0.946
0.948
0.940
0.980
0.380
0.580
0.945
0.943
Dat-
10%
0.919
0.931
0.932
0.900
10
0.822
0.753
33

---

Published as a conference paper at ICLR 2025
I INTEGRATION WITH NEURAL NETWORKS
As demonstrated with the IMDB experiments Section 4.1, FLORAL can be integrated with complex model architectures, e.g. transformer-basee language model such as RoBERTa, serving as a robust classifier head that enhances model robustness on classification tasks.
Similarly, FLORAL embeddings (the 2, 's in Algorithm 1) as inputs. These extracted representations can then be trained using FLORAL. resulting in more robust feature representations. Notably, our theoretical analysis remains valid under this integration, ensuring the approach's 's soundness.
be directly incorporated into neural networks by utilizing the last-layer
To demonstrate this further, we performed additional experiments on the Moon and MNIST-Ivs7 (Deng, 2012) datasets, by integrating FLORAL with neural network.
From Figure 17, we can conclude that FLORAL integration achieves higher robust accuracy level compared to plain neural network training.
Test Accuracy
Test Accuracy
Test Acturacy
Test Acturacy
6-0
My
wm
6-4
0.5
0.50
100
20
Rounds
870
300
100
Rounds
15
271
100
230
150
271
107
270
4000
300
(a) Clean.
(b) Daly 5%.
(c) Dady 10%.
(d) Dudy 25%.
3.5
0.7
6.70
6:35
Roundo
Rounds
Rounds
Rounds
(e) Clean.
(f) Dadl 5%.
gg)
Dady 10%.
(h) Dddy 25%.
FLORAL
NN
Figure 17: Clean and robust test accuracy performance of neural network vs FI.OR Fi-ntre--nteerated neural network trained on the Moon (the first row) and MNIST-Ivs? (the second row) datasets. The results demonstrate that FLORAL integration helps to achieve higher robust accuracy level.
34

---

Published as a conference paper at ICLR 2025
Postur
Pesture
Peoture
Pastare 0
Prelden 9
Pellex 9
(a) FL.ORAL. (Clean).
(b) D gdl = 5%
(c) Dadly 10%.
D ddd
25%.
Pesters
Pasture
Pesturn
Pesture
Pesture 0
(d) SVM (Clean).
(e) Dudy 5%
(f) Dudr 10%.
(g) Dady 25%.
Teattrn
Peoture
Proture
Proturn
(h) NN (Clean).
(i) Duly 5%
(i) D 10%.
(k) D 25%
Desture
Prettur 0
Preticx 0
Prebacx 0
(I) NN-PGD (Clean).
(m) Dulv 5%
(n) Duul 10%.
(0) Duul 25%.
(p) LN-SVM (Clean).
D 5%.
D 10%.
D 25%.
Desture
Posture
Frohim
Froduer
Frotuen D 25%.
(q) Curie (Clean).
D 5%.
Dady 10%.
Pesture
Pesture
Reodure 3
Prsture 0 D pll
Pretuce 0
Pretbee 9
(r) LS-SVM (Clcan).
= 5%
D du = 10%.
Dddr 25%.
Palurr
Pesturm
Pesturn
Pesture 0
(s) K-LID (Clean).
5%
byd 10%
25%
Figure 18: The decision boundaries on the Moon test dataset with various label poisoning levels. SVM- related models use an RBF kernel with C 10 and y = 0.5. FLORAL generates a relatively smooth decision boundary compared to baseline methods, particularly in 25% adversarial setting, where baselines show drastic changes in their decision boundaries as a result adversarial manipulations.
35


Reviews:
[{"review_id": "VdReCRkEGb", "reviewer": "Reviewer_1cTC", "summary": "This paper aims to solve the label poisoning attacks by formulating an adversarial training defense strategy, FLORAL based on SVM. The adversarial training is cast to a non-zero-sum Stackelberg game with an attacker. The projected gradient descent (PGD) is proposed to solve this problem. The experiments on two datasets show the robustness of the proposed method.", "questions": "- What is meaning of $\\mathcal{I}_C$ and $\\mathcal{I}_z$ in Line 294?\n- More details about Moon dataset should be given. I especially interested in the multiple classification tasks and I hope more details about the experiment details can be given.", "limitations": "", "rating": 6, "confidence": 2, "soundness": 2, "presentation": 3, "contribution": 2, "strengths": "- The notation in this paper is generally clear, making the formula easy to follow.\n- The plot illustration is clear.\n- The theoretical proof and analysis is clear and promising.", "weaknesses": "- The experiments are limited. The datasets are relatively small. \n- The author claims that FLORAL can be integrated with neural network but I did not find it. The proof here is all based on SVM and I suspect the proof for neural network, especially for the non-convex neural network, will be different. If the framework can only work and guarantee on SVM-based classifier, the contribution will be decreased a lot.\n- Since it is a general method, the vision dataset, even MNIST, should be given. \n- One of the contribution is projected gradient descent. The discussion about why it works should be given.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "VPh5PgkYPL", "reviewer": "Reviewer_bjpg", "summary": "This paper presents FLORAL, an adversarial training defense strategy that utilizes support vector machines (SVMs) to mitigate label poisoning attacks. FLORAL frames the training process as a non-zero-sum Stackelberg game, positioning an attacker who strategically poisons key training labels against the model’s objective of resilience. The FLORAL employs a projected gradient descent algorithm with kernel SVMs to improve the robustness of adversarial training.", "questions": "1. Please use the reference citation format specified in ICLR.\n2. The datasets in this paper are all binary classification datasets. Does this approach apply exclusively to binary classification tasks, or could the authors provide additional results on non-binary classification datasets to expand the analysis?\n3. The Moon and IMDB datasets represent entirely different types of data. Could the authors clarify the preprocessing steps applied to each dataset in the experiments? Currently, it is unclear how the proposed method effectively applies to such diverse data types？\n4. The results in Table 1 show that the 1998 method, SVM, is the second-best performing method, following only the proposed approach. This is somewhat surprising, as more recent methods from 2021 or 2018 would be expected to outperform an older approach, especially given their likely state-of-the-art status upon publication. Could the authors provide an explanation for this finding?\n5. RoBERTa is widely regarded as a pre-trained language model in the NLP community. Could the authors explain the rationale for using RoBERTa as a baseline in this study?", "limitations": "", "rating": 3, "confidence": 3, "soundness": 2, "presentation": 3, "contribution": 2, "strengths": "1. The paper is well-presented, with clear and high-quality writing.\n2. The figures are visually appealing.\n3. The FLORAL achieves  SOTA  performance compared to the selected baselines.", "weaknesses": "1. All baselines examined in this paper were published before 2021. To support the claim of achieving state-of-the-art performance, the authors may consider including comparisons with more recent methods.\n2. Have the authors considered placing the figures and tables at the top of the current page?\n3. The authors mention using ``SVM with an RBF kernel, which serves as a basic benchmark (Hearst et al., 1998).'' Have more recent approaches been considered as benchmarks?\n4. Could the authors add a comparison with adversarial training methods?", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "grjTF4co8n", "reviewer": "Reviewer_t4Fm", "summary": "The paper introduces FLORAL, a defense mechanism against label-flipping poisoning attacks targeting machine learning (ML) models. The authors argue that these poisoning attacks, which alter the training data labels to mislead model learning, pose a more challenging defense problem than attacks based on feature manipulation.\n\nThe FLORAL defense is based on the formulation of the training problem as a non-zero-sum Stackelberg game. This novel approach transforms the learning problem under poisoning attacks into a bilevel optimization problem. The training is performed during several rounds, during which an attacker tries to maximize the damage induced by label flipping while the training algorithm minimizes the loss of the dataset poisoned by the attacker. FLORAL uses a projected gradient descent algorithm to solve this optimization problem, tailoring the solution specifically to support vector machines (SVMs) while indicating that it can be extended to neural networks. The authors provide theoretical proof that model parameter updates by FLORAL remain bounded and that the algorithm converges to the Stackelberg equilibrium.\n\nRegarding experimental validation, FLORAL is tested on both a synthetic dataset and the IMDB sentiment analysis dataset, using seven established defenses as baselines. On the synthetic dataset, a SVM protected by FLORAL significantly outperforms these baseline defenses, maintaining robustness even with 40% of poisoned labels. For the IMDB dataset, FLORAL-defended SVM is compared against a RoBERTa language model. The results demonstrate that an SVM trained with FLORAL on the poisoned IMDB subset performs more robustly than a poisoned RoBERTa model as the percentage of poisoned labels increases.", "questions": "- What are the motivations for employing an adversarial training procedure and formulating the defense problem as a non-zero-sum Stackelberg game? (See the Weaknesses section for further details.)\n- What precisely does the Stackelberg equilibrium represent within the FLORAL algorithm?\n- Could the algorithm described in Section 3.2 return a projection that does not satisfy Constraint 6 of the problem formulation? If so, what implications would this have for the convergence of the training algorithm?\n- Can the authors address the concerns regarding the experimental evaluation? (See the Weaknesses section for further details.)\n- Could the authors clarify the unclear and unsupported statements listed in the Weaknesses section?", "limitations": "", "rating": 6, "confidence": 3, "soundness": 3, "presentation": 2, "contribution": 2, "strengths": "Thanks to the authors for submitting this interesting work. The proposal of the paper is for sure original and novel since the problem of defending an ML model against a label flip poisoning attack is cast as an adversarial training problem for the first time. The specific formulation of the problem as a non-zero sum Stackelberg is also original and enables the design of a defense algorithm that outperforms existing defenses. Moreover, the theoretical analysis behind the convergence to the optimum of the proposed training algorithm is good. Finally, regarding the experimental evaluation, it is appreciable that the experimental evaluation considers several state-of-the-art defenses. In this way, it is possible to assess that the proposed defenses overcome several defenses and not some specific ones.", "weaknesses": "A key weakness of the paper lies in the lack of clarity about the motivation for using adversarial training to counter poisoning attacks and for formulating the problem as a non-zero-sum Stackelberg game. Adversarial training, particularly in the context of evasion attacks on ML models, typically aims to train the model on possible attacks to make it robust against test time attacks, as explained in Sections 1 and 3.3 in this paper. Instead, defenses against poisoning attacks often focus on removing or mitigating the impact of poisoned samples once the attack _has already been performed_. Given this distinction, the paper does not sufficiently explain why including a simulated poisoning attack within the training procedure should diminish the impact of already poisoned samples. The motivation seems clear when the training set is clean: the training procedure takes into account the worst attacks that the attacker can perform using the clean training set. However, in practice, the defense algorithm will most often be applied to an already poisoned dataset. In this scenario, the attacker in the game flips labels that can have _already_ been flipped, disrupting the initial attack performed to poison the dataset. If it is the reason behind the efficacy of the defense, the authors should state it clearly in the paper. Otherwise, they should provide an intuition behind the efficacy of the attack when it is applied to a poisoned training set. Moreover, it is not clear the meaning of the equilibrium of the game in the context of defending against poisoning attacks. The authors should also clarify this aspect. \n\nThe experimental evaluation also appears to have several notable shortcomings that should be addressed to strengthen the validation of the proposed defense. First, the attacks used to generate poisoned datasets do not represent the state-of-the-art. While the authors demonstrate that their defense outperforms existing defenses against the relatively simple attack on the synthetic dataset, FLORAL is less effective than the baselines against the Alfa attack (Xiao et al., 2015) when considering more realistic attack budgets (e.g., 5% and 10%). While it is reasonable that a single defense may not counter every attack type, the authors should examine if the defense is also less effective than other considered defenses when considering other attacks proposed in literature, like the ones in (Biggio et. al., 2011) and (Paudice et. al., 2018). Furthermore, the effectiveness of the defense against the baselines is shown only on two dataset. To demonstrate that the defense generalizes well, the authors should consider testing it on additional datasets, as done in (Biggio et al., 2011) and (Paudice et al., 2018). Finally, the comparison between the robustness of FLORAL-defended SVMs and RoBERTa on the IMDB dataset is not fair, in my opinion. The authors states that `Adversarial datasets were created by fine-tuning the RoBERTa-base model on the clean dataset to identify influential training points` (Section 5). This approach inherently biases the attack towards RoBERTa, as it is crafted specifically to target that model. Therefore, the finding that an SVM defended by FLORAL outperforms RoBERTa in terms of robustness on a poisoned dataset may not be reliable, as the attack is tailored to RoBERTa. I suggest that the authors perform the comparison in a fairer way, for example by creating adversarial datasets by flipping the most influencial points for an SVM trained on IMDB.\n\nFinally, the presentation of the paper is almost good, but there are a few unclear, unsupported, or potentially misleading statements that need clarification:\n- In the caption of Figure 2, the authors state that `label poisoning affects any point in the input space uniformly`. However, this statement seems counterintuitive. Intuitively, flipping the labels of points closer to the decision boundary should have a greater impact on shifting the boundary than flipping labels of points far from it.\n- In Section 3, the authors claim that `In the case of an SVM-based classifier, the minimax formulation would only safeguard against\nattacks that target data points very far from the decision boundary. These attacks are unlikely to alter the SVM classifier significantly, as such points are less likely to be support vectors, i.e. the critical data points that define the decision boundary.`. However, no references or further explanation are provided to substantiate this observation.\n- The authors describe the considered attacker in the game as white-box. However, they subsequently state that `However, in practice,\nthe attacker’s knowledge of the model may be limited. To account for this, we assume the attacker operates under a constrained budget, allowing the poisoning of at most B labels per round` (Section 3). This constraint does not limit the attacker’s knowledge (which remains white-box) but rather restricts the attacker’s capability to flip labels within a budget.\n\n**Update after authors' response**\nThe authors did a good job in responding to the questions below and clarifying the weaknesses described above. I will leave the weaknesses written to keep a trace, but the authors clarified them. In particular, the authors clarified the formalization of the problem as a non-zero-sum Stackelberg game, included other attacks in their evaluation with positive results, and clarified the experimental setting of the experiments with RoBERTa, as suggested. Moreover, they clarified other statements listed above.\n\n**Arguments for the score**\n\nThe formulation of the problem of defending against label flip attacks as a non-zero-sum Stackelberg game is novel, and the experimental results support the effectiveness of the proposed defense. However, there are still some limitations in the proposed approach, which are also highlighted by other reviewers. In particular, it is not clear if the proposed adversarial training method can be generalized to more popular model architectures, e.g., Neural Networks. Indeed, you have shown that you can attach your adversarially trained SVM as a head of a more complex model, but not if your adversarial training method generalizes. Finally, the proposed method does not always allow the model to achieve better accuracy under attack with respect to other baselines when the budget is realistic (5-10% of poisoned data), even though these cases are sporadic.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "e4CTZrqxjy", "reviewer": "Reviewer_jdAy", "summary": "This paper presents an adversarial training algorithm to mitigate label flipping attacks against Kernel SVM. Label flipping attacks aim to poison the training process of a Deep Neural Nets-based model via flipping the labels of training data. Similar as the vanilla adversarial training algorithm, the proposed method defines a bi-level optimization problem. The inner-layer problem is to choose the target training samples to flip their class label, in order to maximize the training loss of the classifier. The out-layer problem aims to minimize the worst-case classification loss facing the label flipping noise. This work presents a stability analysis to prove the convergence of the proposed method. Empirical study conducted over two datasets confirms the validity of the proposed method for enhancing the robustness of Kernelized SVM.", "questions": "1. Include more defensive baselines into the comparative study, especially [1] mentioned in the weakness comment. \n\n2. Clarify the bullet point 2 and 3 in the weakness comment. \n\n3. Justify if the proposed method can be exntended to other model architectures. If possible, please demonstrate how the proposed method can be generalized with further empirical evaluations.", "limitations": "", "rating": 3, "confidence": 4, "soundness": 2, "presentation": 2, "contribution": 2, "strengths": "It is interesting to use the framework of adversarial training to defend label flipping attacks. The design of the proposed is further enhanced with a theoretical proof the convergence of the proposed method.", "weaknesses": "1. Label flipping attacks have been extensively investigated in the past years. This study lacks a comprehensive comparison to the recent advance in this field. I list a few as below [1,2,3].\n\n[1]. Elan Rosenfeld, Ezra Winston, Pradeep Ravikumar, and J. Zico Kolter. 2020. Certified robustness to label-flipping attacks via randomized smoothing. In Proceedings of the 37th International Conference on Machine Learning (ICML'20)\n[2]. Andrea Paudice, Luis Muñoz-González, and Emil C. Lupu. 2019. Label Sanitization Against Label Flipping Poisoning Attacks. In ECML PKDD 2018 Workshops.\n[3]. P. Tavallali, V. Behzadan, A. Alizadeh, A. Ranganath and M. Singhal, \"Adversarial Label-Poisoning Attacks and Defense for General Multi-Class Models Based on Synthetic Reduced Nearest Neighbor,\" 2022 IEEE International Conference on Image Processing (ICIP), Bordeaux, France, 2022, pp. 3717-3722.\n\n2. Why Q is chosen as ${\\tilde{y}_i}{\\tilde{y}_j}K_{i,j}$ is not clearly justified. \n\n3. It is unclear why using the dual variables $\\lambda_i$ to choose training samples to flip their labels is better than using the influence function. \n\n4. The proposed method seems limited only to Kernelized SVM, yet not generalizable to other model architectures.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (Poster)