# Cybersecurity for AI Systems: A Survey
## 3 AI Attacks and Defense Mechanisms
### Poisoning Attack
#### 3.3.2 Data Poisoning Defense Mechanisms
However, this strategy fails to detect attacks in which the subsets of poisoning points are close. An outlier detection scheme was proposed in [99] for classification tasks. In this strategy, the outlier detectors for each class are trained with a small fraction of trusted data points. This strategy is effective in attack scenarios where the hacker does not model specific attack constraints. For example, if the training dataset is poisoned only by flipping the labels, then this strategy can detect those poisoned data points which are far from the genuine ones. Here, it is important to keep in mind that outlier detectors used in this technique need to first be trained on small curated training points that are known to be genuine [99]. In many studies, the defense strategies are for the time of filtering of data during anomaly detection (i.e., before the model is trained). [PERSON], [PERSON], and [PERSON] [84] considered data sanitization defenses of five different types, from the perspective of anomaly detection, each with respective anomaly detection parameters \(\beta\) and parametrized scores\(s_{\beta}\) which identify the degree of anomaly. \(D_{clean}\) and \(D_{poison}\) are the datasets for clean and poisoned instances \(D=D_{clean}\cup D_{poisin}\) and \(\beta\) is derived from \(D\). (1) **L-2 Defense:** This type of defense discards the instances that are distant from the center of the corresponding class they belong to, from the perspective of the L-2 distance measure. The outlier detection parameter and parametrarized score for the L-2 defense are expressed as:  
\[\beta_{y}=Expectation_{D}(x|y)\]  
\[S_{\beta}(x,y)=\ \left|\left|x-\ \beta_{y}\right|\right|_{2}\]  
(2) **Slab Defense:** Slab defense [81] draws the projections of the instances on the lines or planes joining the class centers and discards those that are too distant from the centers of the classes. Unlike the L-2 defense, this mechanism considers only the distances between the class centers as pertinent dimensions. The outlier detection parameter and parametrarized score for the slab defense are expressed as:  
\[\beta_{y}=Expectation_{D}(x|y)\]  
\[S_{\beta}(x,y)=\left|\left(\beta_{1}-\beta_{-1}\right)^{T}\left(x-\ \beta_{y}\right)\right|\]  
where \(\theta\) is the learning parameter that minimizes the training loss, \(x\) denotes the data point and \(y\) is the class. (3) **Loss Defense:** Loss defense removes points that are not fitted well by the trained model on \(D\). The feature dimensions are learned based on loss function \(l\). The outlier detection parameter and parametrarized score for the loss defense are expressed as:  
\[\beta_{y}=argmin_{\theta}Expectation_{D}l_{\theta}(x|y)]\]  
\[S_{\beta}(x,y)=l_{\beta}(x|y)\]  
(4) **SVD Defense :** SVD defense is the mechanism that works on the basis of sub-space assumption [100]. In this defense mechanism the normal instances are assumed to lie in low-ranked sub-space while the tampered instances have components that are too large to fit into this sub-space. The outlier detection parameter and parametrarized score for the loss defense are expressed as:  
\[\beta=\left|M\right|_{RSV}^{k}\]  
\[S_{\beta}(x,y)=\ \left|\left|\left(I-\ \beta\beta^{T}\right)x\right|\right|_{2}\]  
The term \(\left|M\right|_{RSV}^{k}\) is the matrix of \(S_{\beta}(x,y)=\ \left|\left(\left(I-\ \beta\beta^{T}\right)x\right|\right|_{2}\) right singular vector of data matrix d.  
(5) **K-NN Defense:** The K-NN defense discards data instances that are distant from the \(K\) nearest neighbors. The outlier detection parameter and parametrarized score for the k-NN defense are expressed as:  
Figure 3:0  
Figure 3:1[PERSON], [PERSON], and [PERSON] [84] have tested these 5 types of data sanitization defenses on four types of datasets: The MNIST dataset [101], Dogfish [102], Enron spam detection [103] and the IMDB sentiment classification datasets [104]. The first two datasets are image datasets.