Adversarial Attacks on Machine Learning and How to Defend Against Them
The claim
No single control stops all four attacks on a trained model, so its defense has to be layered across training, release and the queries it answers.
The paper examines four ways to attack a trained machine learning model: poisoning it while it trains, evading it with a doctored input, inverting it to reconstruct what it learned, and inferring whose data it was trained on. Drawing on primary research, it shows each one working against realistic systems, often by an attacker who cannot see inside the model.
“A trained model, in essence, is a compressed record of everything used to build it: the data, the effort spent labeling it, and the computing time spent training.”
Read the first page. Full publication released upon request.