## 2 Background and Related Works
### The discussion on Poisoning Attacks
#### 2.3.2 Poisoning Attack on DNNs  
Poisoning attacks on DNNs can be categorized as either target attacks or paralysis attacks, depending on their particular effect. In target attacks, the aim is to cause the model to misclassify certain specific targets without reducing the overall accuracy of the whole system. By contrast, in paralysis attacks, the aim is to degrade the entire system. The following discussions describe three of the most common poisoning attacks on DNNs, namely, TensorClog [10], a form of paralysis attack; and Feature Collisions [6] and Convex Polytope [7], both of which are forms of target attack. * TensorClog [10] When updating a neural network model, the update amount of each weight is determined according to the weight gradient of the loss function. That is, \[dw=\
abla_{w}L(f\left(x,w\right),\,y)\] (4)  
The main idea of TensorClog is to make the weight gradient of the loss function approach zero by fabricating the input value in such a way as to achieve gradient descent of the loss function shown in Equation (5), where this loss function is the L2-norm of the weight gradient of the loss function plus a suppression term. \[L_{T}\left(x^{\prime},\,f\,\right)=\frac{1}{2}\sum_{l=0}^{n}dw_{l}^{2}+\lambda \left(x^{\prime}-x\right)^{2} \tag{5}\]  
As with any paralysis attack method, the aim of TensorClog is to reduce the overall accuracy of the neural network model. In contrast to poisoning attacks against non-DNN models, in which the attackers only require a small poisoning rate that is enough to cause a significant effect, poisoning attacks against DNN models attempt to poison the entire dataset. Consequently, launching poisoning attacks is more challenging. However, due to the scale and complexity of DNN models, they are also more difficult for the system operator to detect and guard against. * Feature Collisions [6] In general, the objective of ML attack models is to disrupt the parameters of the neural network in such a way to cause the loss function to perform badly. However, the Feature Collisions attack method breaks this mold and aims instead to manipulate the output of the penultimate layer of the neural network in such a way to produce feature collisions between the training dataset and the test dataset. Assume that \(x_{j}\) and \(y_{j}\) are data points in the training set and test set, respectively. Assume also that the output function of the penultimate layer is \(f(x)\). The aim of the feature collision attack is to make \(f(x_{j})\) close to \(f(y_{j})\), such that the neural network model believes that the two data points are the same. Equation (6) shows the objective function of such an attack, where a suppression term is deliberately used to alleviate the modification effect. \[L_{T}\left(x^{\prime},\,y\right)=\parallel f(x^{\prime})-f(y)\parallel_{2}^{2 }+\beta\parallel x^{\prime}-x\parallel_{2}^{2} \tag{6}\]  
In other words, the feature collision attack is an optimization problem based on the target function, and is generally solved using the forward-backward-splitting method. * Convex Polytope Attack [7] The convex polytope attack is similar in concept to the feature collisions attack in that it also tries to control the output of the penultimate layer of the neural network. Again, assume that \(x_{j}\) and \(y_{j}\) are data points in the training set and test set, respectively, and \(f(x)\) is the output function of the penultimate layer. The underlying principle of the convex polytope attack is that as long as \(f(y_{j})\) is a convex combination of \(f\big{(}x_{j,\ j=1,\ldots,n}\big{)}\), and all \(f(x_{j})\) are in the same category, \(f(y_{j})\) will also be classified as the same category. Note that convex combination is a special case of linear combination, in which all of the coefficients are non-negative and their sum is equal to one. In other words, the target point is enclosed in a polytope composed of multiple points. Compared with the feature collisions attack, the convex polytope attack aims to produce collisions between a single point and multiple points.