Geometric Algorithms for $k$-NN Poisoning

Recent developments in machine learning have spiked the interest in robustness, leading to several results in adversarial machine learning [1, 2, 11]. A central goal in this area is the design of algorithms that are able to impair the performance of traditional learning methods by adversarially perturbing the input [3, 17, 19]. Adversarial attacks can be exploratory, such as evasion attacks, or causative, poisoning the training data to affect the performance of a machine learning algorithm or attack the algorithm itself. Backdoor poisoning is a type of causative adversarial attack, in which the attacker has access to the whole or a portion of the training data that they can perturb. Cleanlabel poisoning attacks are a type of backdoor poisoning attack that perturb only the features of the training data leaving the labels untouched, so as to make the poison less detectable.