## 2 Background and Related Works
### The discussion on Poisoning Attacks
#### 2.3.1 Poisoning Attacks on Non-DNNs  
The following discussions introduce three classic non-DNN poisoning attack algorithms targeted at SVM [21], linear regression [16], and multiple ML models [22], respectively.  
* Poisoning Attacks against Support Vector Machines [21]  
SVMs are usually developed using the hinge loss function. The main objective of poisoning attacks against SVMs is to maximize this hinge loss with the addition of a poisoned point (\(x_{c}\), \(y_{c}\)) to a training dataset, as shown in Equation (1), where \(f_{x_{c}}(x_{k})\) is the output function of the SVM and \(y_{k}\) is the predicted label.  
\[\max_{x_{c}}\!L(x_{c})=\sum_{k=1}^{m}(1-y_{k}f_{x_{c}}(x_{k}))_{+} \tag{1}\]  
In a poisoning attack, the attack algorithm produces a new input, \(x_{c}^{(p)}=x_{c}^{(p-1)}+tu\), where \(u\) is a fabricated value. The optimization process of the SVM then obtains \(w=\sum_{i=1}^{n}\alpha_{i}y_{i}x_{i}\) under the KKT conditions. This outcome is then substituted into Equation (1) and partially differentiated with respect to \(u\). Finally, the result is projected onto a unit vector and used to update \(u\). The detailed attack process is described in [21], including the use of the KKT conditions and the LDU solutions, which is a gradient ascent method. (It is worth noting that \(w\) is a function of \(x\), and is obtained from the KKT conditions rather than the gradient descent method).  
* Poisoning Attacks against Linear Regression Models [17]  
In linear regression models, the system is updated in accordance with a particular loss function and the goal of the attacker is to maximize this function, as shown in Equation (2), where \(\ell(y_{i},f(x_{i}))\) is the loss function and \(\lambda\Omega(\mathbf{w})\) is the normalization term of linear regression.  
\[\max_{x_{c}}\!L(x_{c})=\frac{1}{m}\ \sum_{i=1}^{m}(\ell(y_{i},f(x_{i}))+ \lambda\Omega(\mathbf{w})) \tag{2}\]  
Through the KKT condition, we can obtain the weight and substitute it into the loss function. In a typical poisoning attack, techniques such as matrix manipulation are used to solve the partial differential and, having obtained this differential, the input value is updated in accordance with a particular operation to generate an attack. Generally speaking, the update method is similar to a gradient ascent method.  
* Poisoning Attacks against SVM, Linear Regression, and Logistic Regression Models [22]  
The authors in [22] designed an attack method that could be used against various ML models, including SVM, linear regression, and logistic regression. In contrast to the attack methods described above, the proposed method press target weights of the victim network model and then tries to make the current weights approach these weights by updating the network model iteratively in accordance with Equation (3). As shown, the attack aims to minimize \(O_{A}(D,\hat{\theta}_{D})\) subject to \(O_{L}(D,\theta)\) under the optimization conditions of \(g(\theta)\) and \(h(\theta)\), where \(D\) is the training data and \(\hat{\theta}_{D}\) is the learned model.  
\[\min_{D,\hat{\theta}_{D}} O_{A}(D,\hat{\theta}_{D}) \tag{3}\] \[s.t.\hat{\theta}_{D}\leq argmin_{\theta}O_{L}(D,\theta)\] \[s.t.g(\theta)\leq 0,h(\theta)=0\]Equation (3) is a bilevel optimization problem. In particular, the KKT conditions are used to reduce the optimization problem to a single-layer problem, and this problem is then solved by updating the input data using methods such as projecting the gradient values. Having solved the equation, it is used to produce attack data to corrupt the target model.