Exact Certification of Data-Poisoning Attacks Using Mixed-Integer Programming
Fuente:
arXiv
Enregistré dans:
| Auteurs principaux: | , , , , |
|---|---|
| Format: | Preprint |
| Publié: |
2026
|
| Sujets: | |
| Accès en ligne: | |
| Tags: |
Ajouter un tag
Pas de tags, Soyez le premier à ajouter un tag!
|
| _version_ | 1866912912819355648 |
|---|---|
| author | Sosnin, Philip Knapp, Jodie Kennedy, Fraser Collyer, Josh Tsay, Calvin |
| author_facet | Sosnin, Philip Knapp, Jodie Kennedy, Fraser Collyer, Josh Tsay, Calvin |
| contents | This work introduces a verification framework that provides both sound and complete guarantees for data poisoning attacks during neural network training. We formulate adversarial data manipulation, model training, and test-time evaluation in a single mixed-integer quadratic programming (MIQCP) problem. Finding the global optimum of the proposed formulation provably yields worst-case poisoning attacks, while simultaneously bounding the effectiveness of all possible attacks on the given training pipeline. Our framework encodes both the gradient-based training dynamics and model evaluation at test time, enabling the first exact certification of training-time robustness. Experimental evaluation on small models confirms that our approach delivers a complete characterization of robustness against data poisoning. |
| format | Preprint |
| id |
arxiv_https___arxiv_org_abs_2602_16944 |
| institution | arXiv |
| publishDate | 2026 |
| record_format | arxiv |
| spellingShingle | Exact Certification of Data-Poisoning Attacks Using Mixed-Integer Programming Sosnin, Philip Knapp, Jodie Kennedy, Fraser Collyer, Josh Tsay, Calvin Machine Learning This work introduces a verification framework that provides both sound and complete guarantees for data poisoning attacks during neural network training. We formulate adversarial data manipulation, model training, and test-time evaluation in a single mixed-integer quadratic programming (MIQCP) problem. Finding the global optimum of the proposed formulation provably yields worst-case poisoning attacks, while simultaneously bounding the effectiveness of all possible attacks on the given training pipeline. Our framework encodes both the gradient-based training dynamics and model evaluation at test time, enabling the first exact certification of training-time robustness. Experimental evaluation on small models confirms that our approach delivers a complete characterization of robustness against data poisoning. |
| title | Exact Certification of Data-Poisoning Attacks Using Mixed-Integer Programming |
| topic | Machine Learning |
| url | https://arxiv.org/abs/2602.16944 |