PD-AutoR: Towards Automatic Restoration of Poisoned Examples in Machine Learning

Haoyang Chen, Xinyun Liu, Xu Zhou, Ziao Jiao, Xinyu Lei
Proceedings of the 2025 Conference on Applied Machine Learning for Information Security, PMLR 299:135-167, 2025.

Abstract

Machine learning (ML)-based systems are increasingly being deployed in real-world applications with high societal impacts. A pivotal factor that contributes to the success of ML techniques is the availability of high-quality training datasets. However, there are many attack vectors (exploitable by attackers) to launch various data poisoning (DP) attacks against ML systems since training datasets are often collected from untrusted data sources. One direct negative consequence of DP attacks is that the data quality of the poisoned dataset can be significantly deteriorated compared with the original clean dataset. To mitigate the low-data-quality issue, we design a neural network (NN)-based Poisoned Data Automatic Restoration (PD-AutoR) engine to automatically detect and restore PD prior to ML model training. Our high-level methodology is to develop a transductive learning-supported pipeline, which allows the target PD (that needs to be restored) to be used in PD-AutoR training, so PD-AutoR can achieve very high restoration accuracy. In addition, we design transformer-based networks (with a self-attention mechanism) to enable PD-AutoR to precisely and automatically pay attention to the areas that need to be restored, enabling PD-AutoR to restore the PD even if the attacker’s poisoning strategy is agnostic. Our theoretical analysis and preliminary experimental results show that PD-AutoR can simultaneously fulfill the three design goals including high PD detection accuracy, high PD restoration accuracy, and strong fault tolerance.

Cite this Paper

BibTeX
@InProceedings{pmlr-v299-chen25a, title = {PD-AutoR: Towards Automatic Restoration of Poisoned Examples in Machine Learning}, author = {Chen, Haoyang and Liu, Xinyun and Zhou, Xu and Jiao, Ziao and Lei, Xinyu}, booktitle = {Proceedings of the 2025 Conference on Applied Machine Learning for Information Security}, pages = {135--167}, year = {2025}, editor = {Raff, Edward and Rudd, Ethan M.}, volume = {299}, series = {Proceedings of Machine Learning Research}, month = {22--24 Oct}, publisher = {PMLR}, pdf = {https://raw.githubusercontent.com/mlresearch/v299/main/assets/chen25a/chen25a.pdf}, url = {https://proceedings.mlr.press/v299/chen25a.html}, abstract = {Machine learning (ML)-based systems are increasingly being deployed in real-world applications with high societal impacts. A pivotal factor that contributes to the success of ML techniques is the availability of high-quality training datasets. However, there are many attack vectors (exploitable by attackers) to launch various data poisoning (DP) attacks against ML systems since training datasets are often collected from untrusted data sources. One direct negative consequence of DP attacks is that the data quality of the poisoned dataset can be significantly deteriorated compared with the original clean dataset. To mitigate the low-data-quality issue, we design a neural network (NN)-based Poisoned Data Automatic Restoration (PD-AutoR) engine to automatically detect and restore PD prior to ML model training. Our high-level methodology is to develop a transductive learning-supported pipeline, which allows the target PD (that needs to be restored) to be used in PD-AutoR training, so PD-AutoR can achieve very high restoration accuracy. In addition, we design transformer-based networks (with a self-attention mechanism) to enable PD-AutoR to precisely and automatically pay attention to the areas that need to be restored, enabling PD-AutoR to restore the PD even if the attacker’s poisoning strategy is agnostic. Our theoretical analysis and preliminary experimental results show that PD-AutoR can simultaneously fulfill the three design goals including high PD detection accuracy, high PD restoration accuracy, and strong fault tolerance. } }
Endnote
%0 Conference Paper %T PD-AutoR: Towards Automatic Restoration of Poisoned Examples in Machine Learning %A Haoyang Chen %A Xinyun Liu %A Xu Zhou %A Ziao Jiao %A Xinyu Lei %B Proceedings of the 2025 Conference on Applied Machine Learning for Information Security %C Proceedings of Machine Learning Research %D 2025 %E Edward Raff %E Ethan M. Rudd %F pmlr-v299-chen25a %I PMLR %P 135--167 %U https://proceedings.mlr.press/v299/chen25a.html %V 299 %X Machine learning (ML)-based systems are increasingly being deployed in real-world applications with high societal impacts. A pivotal factor that contributes to the success of ML techniques is the availability of high-quality training datasets. However, there are many attack vectors (exploitable by attackers) to launch various data poisoning (DP) attacks against ML systems since training datasets are often collected from untrusted data sources. One direct negative consequence of DP attacks is that the data quality of the poisoned dataset can be significantly deteriorated compared with the original clean dataset. To mitigate the low-data-quality issue, we design a neural network (NN)-based Poisoned Data Automatic Restoration (PD-AutoR) engine to automatically detect and restore PD prior to ML model training. Our high-level methodology is to develop a transductive learning-supported pipeline, which allows the target PD (that needs to be restored) to be used in PD-AutoR training, so PD-AutoR can achieve very high restoration accuracy. In addition, we design transformer-based networks (with a self-attention mechanism) to enable PD-AutoR to precisely and automatically pay attention to the areas that need to be restored, enabling PD-AutoR to restore the PD even if the attacker’s poisoning strategy is agnostic. Our theoretical analysis and preliminary experimental results show that PD-AutoR can simultaneously fulfill the three design goals including high PD detection accuracy, high PD restoration accuracy, and strong fault tolerance.
APA
Chen, H., Liu, X., Zhou, X., Jiao, Z. & Lei, X.. (2025). PD-AutoR: Towards Automatic Restoration of Poisoned Examples in Machine Learning. Proceedings of the 2025 Conference on Applied Machine Learning for Information Security, in Proceedings of Machine Learning Research 299:135-167 Available from https://proceedings.mlr.press/v299/chen25a.html.

Related Material