{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,9,18]],"date-time":"2026-09-18T02:23:43Z","timestamp":1789698223801,"version":"4.0.1"},"reference-count":86,"publisher":"Association for Computing Machinery (ACM)","issue":"9","license":[{"start":{"date-parts":[[2023,1,16]],"date-time":"2023-01-16T00:00:00Z","timestamp":1673827200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":["ACM Comput. Surv."],"published-print":{"date-parts":[[2023,9,30]]},"abstract":"<jats:p>Although cyberattacks on machine learning (ML) production systems can be harmful, today, security practitioners are ill-equipped, lacking methodologies and tactical tools that would allow them to analyze the security risks of their ML-based systems. In this article, we perform a comprehensive threat analysis of ML production systems. In this analysis, we follow the ontology presented by NIST for evaluating enterprise network security risk and apply it to ML-based production systems. Specifically, we (1) enumerate the assets of a typical ML production system, (2) describe the threat model (i.e., potential adversaries, their capabilities, and their main goal), (3) identify the various threats to ML systems, and (4) review a large number of attacks, demonstrated in previous studies, which can realize these threats. To quantify the risk posed by adversarial machine learning (AML) threat, we introduce a novel scoring system that assigns a severity score to different AML attacks. The proposed scoring system utilizes the analytic hierarchy process (AHP) for ranking\u2014with the assistance of security experts\u2014various attributes of the attacks. Finally, we developed an extension to the MulVAL attack graph generation and analysis framework to incorporate cyberattacks on ML production systems. Using this extension, security practitioners can apply attack graph analysis methods in environments that include ML components thus providing security practitioners with a methodological and practical tool for both evaluating the impact and quantifying the risk of a cyberattack targeting ML production systems.<\/jats:p>","DOI":"10.1145\/3559104","type":"journal-article","created":{"date-parts":[[2022,8,31]],"date-time":"2022-08-31T12:38:13Z","timestamp":1661949493000},"page":"1-36","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":24,"title":["Evaluating the Cybersecurity Risk of Real-world, Machine Learning Production Systems"],"prefix":"10.1145","volume":"55","author":[{"ORCID":"https:\/\/orcid.org\/0000-0001-8942-9783","authenticated-orcid":false,"given":"Ron","family":"Bitton","sequence":"first","affiliation":[{"name":"Ben-Gurion University of the Negev, Beer-Sheba, Israel"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-7633-9754","authenticated-orcid":false,"given":"Nadav","family":"Maman","sequence":"additional","affiliation":[{"name":"Ben-Gurion University of the Negev, Beer-Sheba, Israel"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-3011-3199","authenticated-orcid":false,"given":"Inderjeet","family":"Singh","sequence":"additional","affiliation":[{"name":"NEC, Japan"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-6239-9753","authenticated-orcid":false,"given":"Satoru","family":"Momiyama","sequence":"additional","affiliation":[{"name":"NEC, Japan"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-9641-128X","authenticated-orcid":false,"given":"Yuval","family":"Elovici","sequence":"additional","affiliation":[{"name":"Ben-Gurion University of the Negev, Beer-Sheba, Israel"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-0630-4059","authenticated-orcid":false,"given":"Asaf","family":"Shabtai","sequence":"additional","affiliation":[{"name":"Ben-Gurion University of the Negev, Beer-Sheba, Israel"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2023,1,16]]},"reference":[{"key":"e_1_3_2_2_2","unstructured":"2022. Nessus security scanner. Retrieved from http:\/\/www.nessus.org."},{"key":"e_1_3_2_3_2","unstructured":"2022. NVD national vulnerability database. Retrieved from http:\/\/www.nvd.nist.gov."},{"key":"e_1_3_2_4_2","doi-asserted-by":"publisher","DOI":"10.1109\/MILCOM.2016.7795462"},{"key":"e_1_3_2_5_2","doi-asserted-by":"publisher","DOI":"10.1145\/3317549.3323411"},{"key":"e_1_3_2_6_2","doi-asserted-by":"publisher","DOI":"10.1504\/IJSN.2015.071829"},{"key":"e_1_3_2_7_2","doi-asserted-by":"publisher","DOI":"10.1109\/ICCNI.2017.8123782"},{"key":"e_1_3_2_8_2","volume-title":"Mulval Extensions for Dynamic Asset Protection","author":"Bacic Eugen","year":"2006","unstructured":"Eugen Bacic, Michael Froh, and Glen Henderson. 2006. Mulval Extensions for Dynamic Asset Protection. Technical Report. Cinnabar Networks, Inc."},{"key":"e_1_3_2_9_2","doi-asserted-by":"publisher","DOI":"10.1145\/3097983.3098021"},{"key":"e_1_3_2_10_2","article-title":"Poisoning attacks against support vector machines","author":"Biggio Battista","year":"2012","unstructured":"Battista Biggio, Blaine Nelson, and Pavel Laskov. 2012. Poisoning attacks against support vector machines. arXiv preprint arXiv:1206.6389 (2012).","journal-title":"arXiv preprint arXiv:1206.6389"},{"key":"e_1_3_2_11_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.patcog.2018.07.023"},{"key":"e_1_3_2_12_2","article-title":"An automated, end-to-end framework for modeling attacks from vulnerability descriptions","author":"Binyamini Hodaya","year":"2020","unstructured":"Hodaya Binyamini, Ron Bitton, Masaki Inokuchi, Tomohiko Yagyu, Yuval Elovici, and Asaf Shabtai. 2020. An automated, end-to-end framework for modeling attacks from vulnerability descriptions. arXiv preprint arXiv:2008.04377 (2020).","journal-title":"arXiv preprint arXiv:2008.04377"},{"key":"e_1_3_2_13_2","doi-asserted-by":"publisher","DOI":"10.1145\/3447548.3467159"},{"key":"e_1_3_2_14_2","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2019.2914035"},{"key":"e_1_3_2_15_2","article-title":"Decision-based adversarial attacks: Reliable attacks against black-box machine learning models","author":"Brendel Wieland","year":"2017","unstructured":"Wieland Brendel, Jonas Rauber, and Matthias Bethge. 2017. Decision-based adversarial attacks: Reliable attacks against black-box machine learning models. arXiv preprint arXiv:1712.04248 (2017).","journal-title":"arXiv preprint arXiv:1712.04248"},{"key":"e_1_3_2_16_2","doi-asserted-by":"publisher","DOI":"10.1145\/3128572.3140444"},{"key":"e_1_3_2_17_2","first-page":"1309","volume-title":"29th USENIX Security Symposium (USENIX Security\u201920)","author":"Chandrasekaran Varun","year":"2020","unstructured":"Varun Chandrasekaran, Kamalika Chaudhuri, Irene Giacomelli, Somesh Jha, and Songbai Yan. 2020. Exploring connections between active learning and model extraction. In 29th USENIX Security Symposium (USENIX Security\u201920). 1309\u20131326."},{"key":"e_1_3_2_18_2","doi-asserted-by":"publisher","DOI":"10.1109\/SP40000.2020.00045"},{"key":"e_1_3_2_19_2","doi-asserted-by":"publisher","DOI":"10.1145\/3128572.3140448"},{"key":"e_1_3_2_20_2","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2013.8"},{"key":"e_1_3_2_21_2","first-page":"2206","volume-title":"Proceedings of the International Conference on Machine Learning","author":"Croce Francesco","year":"2020","unstructured":"Francesco Croce and Matthias Hein. 2020. Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks. In Proceedings of the International Conference on Machine Learning. PMLR, 2206\u20132216."},{"key":"e_1_3_2_22_2","doi-asserted-by":"publisher","DOI":"10.5120\/7228-0076"},{"key":"e_1_3_2_23_2","doi-asserted-by":"publisher","DOI":"10.1109\/ROBIO.2011.6181557"},{"key":"e_1_3_2_24_2","unstructured":"Evan Downing. 2019. MLsploit [judges remarks] Georgia Institute of Technology. https:\/\/smartech.gatech.edu\/handle\/1853\/61037."},{"issue":"3","key":"e_1_3_2_25_2","first-page":"345","article-title":"A game theoretic approach based virtual machine migration for cloud environment security","volume":"9","author":"Mir Iman El","year":"2017","unstructured":"Iman El Mir, El Mehdi Kandoussi, Mohamed Hanini, Abdelkrim Haqiq, and Dong Seong Kim. 2017. A game theoretic approach based virtual machine migration for cloud environment security. Int. J. Commun. Netw. Inf. Secur. 9, 3 (2017), 345\u2013357.","journal-title":"Int. J. Commun. Netw. Inf. Secur."},{"key":"e_1_3_2_26_2","doi-asserted-by":"publisher","DOI":"10.1145\/2810103.2813677"},{"key":"e_1_3_2_27_2","first-page":"17","volume-title":"Proceedings of the 23rd USENIX Security Symposium (USENIX Security\u201914)","author":"Fredrikson Matthew","year":"2014","unstructured":"Matthew Fredrikson, Eric Lantz, Somesh Jha, Simon Lin, David Page, and Thomas Ristenpart. 2014. Privacy in pharmacogenetics: An end-to-end case study of personalized warfarin dosing. In Proceedings of the 23rd USENIX Security Symposium (USENIX Security\u201914). 17\u201332."},{"key":"e_1_3_2_28_2","volume-title":"MulVAL Extensions II","author":"Froh Michael John","year":"2009","unstructured":"Michael John Froh and Glen Henderson. 2009. MulVAL Extensions II. Defence R & D Canada-Ottawa."},{"key":"e_1_3_2_29_2","doi-asserted-by":"publisher","DOI":"10.1145\/3243734.3243834"},{"key":"e_1_3_2_30_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.eswa.2016.01.018"},{"key":"e_1_3_2_31_2","first-page":"215","volume-title":"Proceedings of the Global Conference on Artificial Intelligence","author":"Gonda Tom","year":"2018","unstructured":"Tom Gonda, Tal Pascal, Rami Puzis, Guy Shani, and Bracha Shapira. 2018. Analysis of attack graph representations for ranking vulnerability fixes. In Proceedings of the Global Conference on Artificial Intelligence. 215\u2013228."},{"key":"e_1_3_2_32_2","first-page":"293","volume-title":"Proceedings of the International Symposium on Foundations and Practice of Security","author":"Gonzalez-Granadillo Gustavo","year":"2017","unstructured":"Gustavo Gonzalez-Granadillo, Elena Doynikova, Igor Kotenko, and Joaquin Garcia-Alfaro. 2017. Attack graph-based countermeasure selection using a stateful return on investment metric. In Proceedings of the International Symposium on Foundations and Practice of Security. Springer, 293\u2013302."},{"key":"e_1_3_2_33_2","article-title":"Explaining and harnessing adversarial examples","author":"Goodfellow Ian J.","year":"2014","unstructured":"Ian J. Goodfellow, Jonathon Shlens, and Christian Szegedy. 2014. Explaining and harnessing adversarial examples. arXiv preprint arXiv:1412.6572 (2014).","journal-title":"arXiv preprint arXiv:1412.6572"},{"key":"e_1_3_2_34_2","article-title":"BadNets: Identifying vulnerabilities in the machine learning model supply chain","author":"Gu Tianyu","year":"2017","unstructured":"Tianyu Gu, Brendan Dolan-Gavitt, and Siddharth Garg. 2017. BadNets: Identifying vulnerabilities in the machine learning model supply chain. arXiv preprint arXiv:1708.06733 (2017).","journal-title":"arXiv preprint arXiv:1708.06733"},{"key":"e_1_3_2_35_2","doi-asserted-by":"publisher","DOI":"10.1109\/PST.2017.00023"},{"key":"e_1_3_2_36_2","doi-asserted-by":"publisher","DOI":"10.1145\/2046684.2046692"},{"key":"e_1_3_2_37_2","article-title":"Query-efficient black-box adversarial examples (superceded)","author":"Ilyas Andrew","year":"2017","unstructured":"Andrew Ilyas, Logan Engstrom, Anish Athalye, and Jessy Lin. 2017. Query-efficient black-box adversarial examples (superceded). arXiv preprint arXiv:1712.07113 (2017).","journal-title":"arXiv preprint arXiv:1712.07113"},{"key":"e_1_3_2_38_2","doi-asserted-by":"publisher","DOI":"10.1145\/3321705.3329853"},{"key":"e_1_3_2_39_2","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2018.00057"},{"key":"e_1_3_2_40_2","doi-asserted-by":"publisher","DOI":"10.1109\/EuroSP.2019.00044"},{"key":"e_1_3_2_41_2","doi-asserted-by":"publisher","DOI":"10.1109\/ARES.2010.21"},{"key":"e_1_3_2_42_2","doi-asserted-by":"publisher","DOI":"10.1109\/PDP.2016.96"},{"key":"e_1_3_2_43_2","doi-asserted-by":"publisher","DOI":"10.1145\/3412841.3441892"},{"key":"e_1_3_2_44_2","first-page":"69","volume-title":"Proceedings of the IEEE Security and Privacy Workshops (SPW)","author":"Kumar Ram Shankar Siva","year":"2020","unstructured":"Ram Shankar Siva Kumar, Magnus Nystr\u00f6m, John Lambert, Andrew Marshall, Mario Goertzel, Andi Comissoneru, Matt Swann, and Sharon Xia. 2020. Adversarial machine learning-industry perspectives. In Proceedings of the IEEE Security and Privacy Workshops (SPW). IEEE, 69\u201375."},{"key":"e_1_3_2_45_2","doi-asserted-by":"crossref","first-page":"99","DOI":"10.1201\/9781351251389-8","volume-title":"Artificial Intelligence Safety and Security","author":"Kurakin Alexey","year":"2018","unstructured":"Alexey Kurakin, Ian J. Goodfellow, and Samy Bengio. 2018. Adversarial examples in the physical world. In Artificial Intelligence Safety and Security. Chapman and Hall\/CRC, 99\u2013112."},{"key":"e_1_3_2_46_2","doi-asserted-by":"publisher","DOI":"10.1109\/IVS.2011.5940562"},{"key":"e_1_3_2_47_2","doi-asserted-by":"publisher","DOI":"10.1109\/MC.2021.3057686"},{"key":"e_1_3_2_48_2","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-24123-4_8"},{"key":"e_1_3_2_49_2","unstructured":"Yingqi Liu Shiqing Ma Yousra Aafer Wen-Chuan Lee Juan Zhai Weihang Wang and Xiangyu Zhang. 2017. Trojaning attack on neural networks. (2017). https:\/\/docs.lib.purdue.edu\/cgi\/viewcontent.cgi?article=2782&context=cstech."},{"key":"e_1_3_2_50_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2017.05.004"},{"key":"e_1_3_2_51_2","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v29i1.9569"},{"key":"e_1_3_2_52_2","article-title":"SecML: A Python library for secure and explainable machine learning","author":"Melis Marco","year":"2019","unstructured":"Marco Melis, Ambra Demontis, Maura Pintor, Angelo Sotgiu, and Battista Biggio. 2019. SecML: A Python library for secure and explainable machine learning. arXiv preprint arXiv:1912.10013 (2019).","journal-title":"arXiv preprint arXiv:1912.10013"},{"key":"e_1_3_2_53_2","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.282"},{"key":"e_1_3_2_54_2","doi-asserted-by":"publisher","DOI":"10.1145\/3128572.3140451"},{"key":"e_1_3_2_55_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2018.09.006"},{"key":"e_1_3_2_56_2","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2019.00065"},{"key":"e_1_3_2_57_2","article-title":"Adversarial robustness toolbox v1. 0.0","author":"Nicolae Maria-Irina","year":"2018","unstructured":"Maria-Irina Nicolae, Mathieu Sinn, Minh Ngoc Tran, Beat Buesser, Ambrish Rawat, Martin Wistuba, Valentina Zantedeschi, Nathalie Baracaldo, Bryant Chen, Heiko Ludwig, et\u00a0al. 2018. Adversarial robustness toolbox v1. 0.0. arXiv preprint arXiv:1807.01069 (2018).","journal-title":"arXiv preprint arXiv:1807.01069"},{"key":"e_1_3_2_58_2","first-page":"121","volume-title":"Explainable AI: Interpreting, Explaining and Visualizing Deep Learning","author":"Oh Seong Joon","year":"2019","unstructured":"Seong Joon Oh, Bernt Schiele, and Mario Fritz. 2019. Towards reverse-engineering black-box neural networks. In Explainable AI: Interpreting, Explaining and Visualizing Deep Learning. Springer, 121\u2013144."},{"key":"e_1_3_2_59_2","first-page":"113","volume-title":"Proceedings of the USENIX Security Symposium","author":"Ou Xinming","year":"2005","unstructured":"Xinming Ou, Sudhakar Govindavajhala, and Andrew W. Appel. 2005. MulVAL: A logic-based network security analyzer. In Proceedings of the USENIX Security Symposium. 113\u2013128."},{"key":"e_1_3_2_60_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.eswa.2018.08.003"},{"key":"e_1_3_2_61_2","doi-asserted-by":"publisher","DOI":"10.1109\/AICCSA.2008.4493524"},{"key":"e_1_3_2_62_2","article-title":"Technical report on the CleverHans v2.1.0 adversarial examples library","author":"Papernot Nicolas","year":"2018","unstructured":"Nicolas Papernot, Fartash Faghri, Nicholas Carlini, Ian Goodfellow, Reuben Feinman, Alexey Kurakin, Cihang Xie, Yash Sharma, Tom Brown, Aurko Roy, Alexander Matyasko, Vahid Behzadan, Karen Hambardzumyan, Zhishuai Zhang, Yi-Lin Juang, Zhi Li, Ryan Sheatsley, Abhibhav Garg, Jonathan Uesato, Willi Gierke, Yinpeng Dong, David Berthelot, Paul Hendricks, Jonas Rauber, and Rujun Long. 2018. Technical report on the CleverHans v2.1.0 adversarial examples library. arXiv preprint arXiv:1610.00768 (2018).","journal-title":"arXiv preprint arXiv:1610.00768"},{"key":"e_1_3_2_63_2","article-title":"Transferability in machine learning: From phenomena to black-box attacks using adversarial samples","author":"Papernot Nicolas","year":"2016","unstructured":"Nicolas Papernot, Patrick McDaniel, and Ian Goodfellow. 2016. Transferability in machine learning: From phenomena to black-box attacks using adversarial samples. arXiv preprint arXiv:1605.07277 (2016).","journal-title":"arXiv preprint arXiv:1605.07277"},{"key":"e_1_3_2_64_2","doi-asserted-by":"publisher","DOI":"10.1145\/3052973.3053009"},{"key":"e_1_3_2_65_2","doi-asserted-by":"publisher","DOI":"10.1109\/EuroSP.2016.36"},{"key":"e_1_3_2_66_2","doi-asserted-by":"publisher","DOI":"10.1109\/EuroSP.2018.00035"},{"key":"e_1_3_2_67_2","doi-asserted-by":"publisher","DOI":"10.2308\/ajpt-50009"},{"key":"e_1_3_2_68_2","article-title":"Foolbox: A Python toolbox to benchmark the robustness of machine learning models","author":"Rauber Jonas","year":"2017","unstructured":"Jonas Rauber, Wieland Brendel, and Matthias Bethge. 2017. Foolbox: A Python toolbox to benchmark the robustness of machine learning models. arXiv preprint arXiv:1707.04131 (2017).","journal-title":"arXiv preprint arXiv:1707.04131"},{"key":"e_1_3_2_69_2","doi-asserted-by":"publisher","DOI":"10.1504\/IJSSCI.2008.017590"},{"key":"e_1_3_2_70_2","doi-asserted-by":"publisher","DOI":"10.1145\/2459976.2459988"},{"key":"e_1_3_2_71_2","article-title":"Denial-of-service attack on object detection model using universal adversarial perturbation","volume":"2205","author":"Shapira Avishag","year":"2022","unstructured":"Avishag Shapira, Alon Zolfi, Luca Demetrio, Battista Biggio, and Asaf Shabtai. 2022. Denial-of-service attack on object detection model using universal adversarial perturbation. CoRR abs\/2205.13618 (2022).","journal-title":"CoRR"},{"key":"e_1_3_2_72_2","doi-asserted-by":"publisher","DOI":"10.1145\/3292500.3330747"},{"key":"e_1_3_2_73_2","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2017.41"},{"key":"e_1_3_2_74_2","doi-asserted-by":"publisher","DOI":"10.1109\/EuroSP51992.2021.00024"},{"key":"e_1_3_2_75_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.knosys.2022.108709"},{"key":"e_1_3_2_76_2","doi-asserted-by":"publisher","DOI":"10.1145\/3372297.3417270"},{"key":"e_1_3_2_77_2","first-page":"111","volume-title":"Proceedings of the New Security Paradigms Workshop","author":"Spring Jonathan M.","year":"2020","unstructured":"Jonathan M. Spring, April Galyardt, Allen D. Householder, and Nathan VanHoudnos. 2020. On managing vulnerabilities in AI\/ML systems. In Proceedings of the New Security Paradigms Workshop. 111\u2013126."},{"key":"e_1_3_2_78_2","doi-asserted-by":"publisher","DOI":"10.1109\/CSF51468.2021.00003"},{"key":"e_1_3_2_79_2","doi-asserted-by":"publisher","DOI":"10.1109\/CSF51468.2021.00003"},{"key":"e_1_3_2_80_2","article-title":"Extending attack graphs to represent cyber-attacks in communication protocols and modern IT networks","author":"Stan Orly","year":"2019","unstructured":"Orly Stan, Ron Bitton, Michal Ezrets, Moran Dadon, Masaki Inokuchi, Yoshinobu Ohta, Yoshiyuki Yamada, Tomohiko Yagyu, Yuval Elovici, and Asaf Shabtai. 2019. Extending attack graphs to represent cyber-attacks in communication protocols and modern IT networks. arXiv preprint arXiv:1906.09786 (2019).","journal-title":"arXiv preprint arXiv:1906.09786"},{"key":"e_1_3_2_81_2","article-title":"Intriguing properties of neural networks","author":"Szegedy Christian","year":"2013","unstructured":"Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. 2013. Intriguing properties of neural networks. arXiv preprint arXiv:1312.6199 (2013).","journal-title":"arXiv preprint arXiv:1312.6199"},{"key":"e_1_3_2_82_2","doi-asserted-by":"publisher","DOI":"10.1109\/INFOTEH.2019.8717766"},{"key":"e_1_3_2_83_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.dss.2012.04.001"},{"key":"e_1_3_2_84_2","first-page":"1689","volume-title":"Proceedings of the International Conference on Machine Learning","author":"Xiao Huang","year":"2015","unstructured":"Huang Xiao, Battista Biggio, Gavin Brown, Giorgio Fumera, Claudia Eckert, and Fabio Roli. 2015. Is feature selection secure against training data poisoning? In Proceedings of the International Conference on Machine Learning. PMLR, 1689\u20131698."},{"key":"e_1_3_2_85_2","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2018.2836950"},{"key":"e_1_3_2_86_2","doi-asserted-by":"publisher","DOI":"10.1145\/3319535.3354261"},{"key":"e_1_3_2_87_2","doi-asserted-by":"publisher","DOI":"10.1145\/3319535.3354209"}],"container-title":["ACM Computing Surveys"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3559104","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3559104","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,17]],"date-time":"2025-06-17T19:00:45Z","timestamp":1750186845000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3559104"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2023,1,16]]},"references-count":86,"journal-issue":{"issue":"9","published-print":{"date-parts":[[2023,9,30]]}},"alternative-id":["10.1145\/3559104"],"URL":"https:\/\/doi.org\/10.1145\/3559104","relation":{},"ISSN":["0360-0300","1557-7341"],"issn-type":[{"value":"0360-0300","type":"print"},{"value":"1557-7341","type":"electronic"}],"subject":[],"published":{"date-parts":[[2023,1,16]]},"assertion":[{"value":"2021-11-04","order":0,"name":"received","label":"Received","group":{"name":"publication_history","label":"Publication History"}},{"value":"2022-08-03","order":1,"name":"accepted","label":"Accepted","group":{"name":"publication_history","label":"Publication History"}},{"value":"2023-01-16","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}