ChatComputer scientists spent decades defending software from malicious executable code; Battista Biggio proved that artificial intelligence can be corrupted by quietly spiking its training data. Published in 2012 when machine learning was still a niche academic field, this foundational paper founded the modern discipline of AI data security and model supply-chain defense.
In cybersecurity, firewalls and antivirus scanners were built to stop hackers from executing unauthorized software code on computer servers. When the world switched to artificial intelligence, developers naively assumed that feeding computers vast amounts of public web data was completely harmless.
Researchers proved that hackers could poison an AI without writing a single line of malicious code. By injecting a tiny handful of carefully crafted fake data points into the training dataset—like dropping an invisible drop of toxin into a municipal reservoir—an attacker can secretly blind the AI to specific threats.
Ignored before the deep learning boom, this paper founded the field of AI supply-chain security. By teaching engineers to sanitize training datasets, by defending autonomous vehicle vision systems from sabotage, and by protecting enterprise AI from backdoors, data poisoning defense safeguards artificial intelligence.
Poisoning Attacks against Support Vector Machines
We investigate a family of poisoning attacks against Support Vector Machines (SVM). Such attacks inject specially crafted training data that increases the SVM's test error. Central to the motivation for these attacks is the fact that most learning algorithms assume that their training data comes from a natural or well-behaved distribution. However, this assumption does not generally hold in security-sensitive settings. As we demonstrate, an intelligent adversary can, to some extent, predict the change of the SVM's decision function due to malicious input and use this ability to construct malicious data. The proposed attack uses a gradient ascent strategy in which the gradient is computed based on properties of the SVM's optimal solution. This method can be kernelized and enables the attack to be constructed in the input space even for non-linear kernels. We experimentally demonstrate that our gradient ascent procedure reliably identifies good local maxima of the non-convex validation error surface, which significantly increases the classifier's test error.
Telecommunication engineers believed that static noise permanently corrupted electrical signals; Claude Shannon proved that information can be transmitted with zero errors across noisy channels by converting meaning into binary bits. Published in 1948, Shannon’s masterwork founded information theory and created the digital language of the modern world.
Physical sensors in rockets and satellites are constantly corrupted by noise, vibration, and sensor drift; Rudolf Kalman developed an optimal mathematical filter that predicts true position by fusing imperfect sensor readings with equations of motion in real time. Published in 1960, the Kalman Filter guided the Apollo spacecraft to the Moon and is the mathematical brain powering every GPS receiver, autonomous drone, and commercial jetliner on Earth.
Computer scientists believed that mastering the ancient game of Go required human intuition that machines would not achieve for decades; DeepMind’s AlphaGo paired deep neural networks with Monte Carlo tree search to defeat the world champion. Published in 2016, AlphaGo proved that deep reinforcement learning could exhibit genuine creative intuition, sparking the modern Artificial General Intelligence revolution.
For thousands of years, secret communication required sending a physical key via a trusted courier before a message could be sent; Whitfield Diffie and Martin Hellman proved that two total strangers can agree on a shared secret over a compromised public channel. Published in 1976, this mathematical breakthrough invented public-key cryptography and made secure global e-commerce possible.
Multiplying two massive prime numbers takes a fraction of a second on a computer; factoring that product back into its original primes takes millions of years. By anchoring asymmetric encryption to the asymmetry of prime numbers, Ron Rivest, Adi Shamir, and Leonard Adleman created RSA—the cryptographic algorithm that encrypts every browser connection, banking transfer, and software update on Earth.
Albert Einstein spent his final decades insisting that quantum entanglement was an incomplete illusion masking hidden common-sense variables; John Stewart Bell devised a single mathematical inequality that allowed laboratory experiments to test whether Einstein or quantum mechanics was right. Published in an obscure, short-lived journal in 1964, Bell’s Theorem proved that the physical universe is fundamentally non-local—founding modern quantum computing, quantum cryptography, and quantum teleportation.
Physical clocks drift out of sync across distributed computer networks because electrical signals cannot travel faster than the speed of light; Leslie Lamport defined time through cause-and-effect causality rather than ticking seconds. Published in 1978, Lamport’s logical clock paper is the most cited work in distributed systems, establishing the foundational physics of cloud computing.
Storing millions of search queries in computer memory wastes vast amounts of expensive hardware; Bloom filters verify whether a record exists using a tiny fraction of a single bit per item. Published in 1970 to speed up hyphenation in typesetting machines, Burton Bloom’s compact data structure now speeds up every Google search query and Bitcoin transaction on Earth.
Ask this paper your own questions, or keep browsing the verified research catalogue.
