Research map / Adversarial robustness and security / Attacks on text and graphs
Adversarial Training for Defense Against Label Poisoning Attacks
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes FLORAL, an SVM-based adversarial training defense against label poisoning that casts training as a non-zero-sum Stackelberg game solved with projected gradient descent, and integrates it with RoBERTa embeddings.
Problem
Robust classification under triggerless label poisoning attacks, where an adversary flips training labels to degrade model test accuracy; conventional adversarial training targets feature perturbations rather than labels.
Approach
Formulates adversarial training for label poisoning as a bilevel non-zero-sum Stackelberg game: the attacker flips labels of top-k influential support vectors (via dual variables, randomized top-k within budget B), and the kernel SVM model updates via projected gradient descent on the adversarially relabeled data, with a fixed-point projection for scalability.
Key results
- On Moon at 25% poisoning, FLORAL reaches 0.801 best / 0.768 last test accuracy versus 0.753 for vanilla SVM and 0.693 for NN.
- On IMDB at 40% adversarial labels, FLORAL achieves 0.8636 robust accuracy versus 0.7792 for fine-tuned RoBERTa and 0.8574 for SVM.
- FLORAL matches vanilla SVM clean accuracy (about 0.9113 on IMDB) while improving robustness under higher poisoning levels.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use Floral adversarial training instead of the strongest listed baseline | RBF SVM on Moon · Moon, 15% label poisoning | last accuracy: 0.858 -> 0.917 | Helped |
| Use Floral adversarial training instead of the strongest listed baseline | RBF SVM on Moon · Moon, 20% label poisoning | last accuracy: 0.853 -> 0.865 | Helped |
| Use Floral adversarial training instead of the strongest listed baseline | RBF SVM on Moon · Moon, 25% label poisoning | last accuracy: 0.721 -> 0.768 | Helped |
| Use Floral adversarial training instead of the strongest listed baseline | RoBERTa-embedding SVM head on IMDB · IMDB, 25% label poisoning | last accuracy: 0.8886 -> 0.8896 | Helped |
| Use Floral adversarial training instead of the strongest listed baseline | RoBERTa-embedding SVM head on IMDB · IMDB, 30% label poisoning | last accuracy: 0.8797 -> 0.8801 | Helped |
| Use Floral adversarial training instead of the strongest listed baseline | RoBERTa-embedding SVM head on IMDB · IMDB, 35% label poisoning | last accuracy: 0.8700 -> 0.8713 | Helped |
| Use Floral adversarial training instead of the strongest listed baseline | RoBERTa-embedding SVM head on IMDB · IMDB, 40% label poisoning | last accuracy: 0.8594 -> 0.8636 | Helped |
| Use Floral adversarial training instead of the strongest listed baseline | RBF SVM on Moon · Moon clean | last accuracy: 0.968 -> 0.966 | Hurt |
| Use Floral adversarial training instead of the strongest listed baseline | RoBERTa-embedding SVM head on IMDB · IMDB, 10% label poisoning | last accuracy: 0.9039 -> 0.9039 | No clear effect |
Surprising findings
- Conventional adversarial training (NN-PGD) does not adequately defend against label poisoning, despite its success against feature perturbations.
- FLORAL implicitly sanitizes roughly 25-35% of pre-existing poisoned training labels according to the authors' analysis.
Limitations
- Relies on a white-box attacker model with access to the model's dual parameters; black-box setting only sketched.
- Defense may not be universally effective against non-adaptive or other label attack types.
- Theoretical guarantees are local asymptotic stability under assumptions; global convergence requires additional conditions.
Experimental setup
Datasets: Moon IMDB MNIST
Benchmarks: Moon IMDB MNIST
Metrics: robust accuracy clean accuracy hinge loss
Baselines: SVM NN NN-PGD LN-SVM Curie LS-SVM K-LID RoBERTa
Builds on: adversarial training kernel SVM PGD-AT Stackelberg game
Closest papers by meaning
- Attack To Defend: Exploiting Adversarial Attacks for Detecting Poisoned Models (CVPR 2024 · similarity 0.87)
- Wicked Oddities: Selectively Poisoning for Effective Clean-Label Backdoor Attacks (ICLR 2025 · similarity 0.87)
- LimeAttack: Local Explainable Method for Textual Hard-Label Adversarial Attack (AAAI 2024 · similarity 0.85)
- Semantic-Aware Multi-Label Adversarial Attacks (CVPR 2024 · similarity 0.85)
- Soften to Defend: Towards Adversarial Robustness via Self-Guided Label Refinement (CVPR 2024 · similarity 0.85)
- Poisoning Attacks on LLMs Require a Near-constant Number of Poison Samples (NeurIPS 2026 · similarity 0.85)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.