Search NASA⌕ Search

SEARCH · Search NASA

Results for “poisoning attack”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

10 records
All sourcesNASA NTRSDOE OSTI
DOE OSTI2020

Systematic Evaluation of Backdoor Data Poisoning Attacks on Image Classifiers

Backdoor data poisoning attacks have recently been demonstrated in computer vision research as a potential safety risk for machine learning (ML) systems. Traditional data poisoning attacks manipulate training data to induce unreliability of an ML model, whereas backdoor data poisoning attacks maintain system performance unless the MLmodel is presented with an input containing an embedded“trigger” that provides a predetermined response advantageous to the adversary. Our work builds upon prior back-door data-poisoning research for ML image classifiers and systematically assesses different experimental conditions including types of trigger patterns, persistence of trigger patterns during retraining, poisoning strategies, architectures (ResNet-50, NasNet, NasNet-Mobile), datasets (Flowers, CIFAR-10), and potential defensive regularization techniques (Contrastive Loss, Logit Squeezing, Manifold Mixup,Soft-Nearest-Neighbors Loss). Experiments yield four key findings. First, the success rate of backdoor poisoning at-tacks varies widely, depending on several factors, including model architecture, trigger pattern and regularization technique. Second, we find that poisoned models are hard to detect through performance inspection alone. Third, regularization typically reduces backdoor success rate, although it can have no effect or even slightly increase it, depending on the form of regularization. Finally, backdoors inserted through data poisoning can be rendered ineffective after just a few epochs of additional training on a small set of clean data without affecting the model’s performance.

Truong, Loc T.↗
DOE OSTI2025

Model Residuals as Shields: A Two-Level Formulation to Defend Smart Grids From Poisoning Attacks

The advancement of smart grids presents both vast opportunities and heightened cybersecurity risks. Data-driven defense mechanisms, though designed as a shield against these threats, can fall prey to poisoning attacks. We delve into regression settings, underscoring the imperative to fortify defenses against a spectrum of poison ratios, notably those above 0.5—an issue scarcely addressed in prior studies. Recognizing the susceptibilities of smart grids and their manipulable sensors, we exploit the very intent of poisoning attacks, compromising model accuracy, as our defense mechanism. Our proposed two-level optimization framework discerns between poisoned and authentic data based on model residuals, outperforming or matching existing methods in 72% to 77% of precision and 75% to 80% of recalls across various poisoning attacks, poison ratios, and datasets. Once the authentic data are identified, the trained model is adaptable for a variety of applications. Comprehensive evaluations on different smart grid datasets, pitted against myriad poisoning schemes, validate our methodology’s edge over existing methods. Here, we also shed light on the implications of model misspecification originating from temporal auto-correlation, a common feature in Internet of Things and smart grid data.

Adversarial machine learning (ML)↗
DOE OSTI2022

Autonomous System Subversion Tactics: Prototypes and Recommended Countermeasures

One of the fielding requirements for Advanced and Small Modular Reactors (AR/SMR) is the ability to support remote and autonomous operations. Autonomous Control Systems (ACS) are found on platforms such as Autonomous Space Vehicles, Cruise Missiles, and advanced driver-assistance systems. Each of these ACS implementations depends upon a set of decision support subsystems responsible for supporting Autonomous Mission Managers (names vary based upon field and author preferences). These Autonomous Mission Managers receive inputs from system sensors (e.g., LIDAR collection from an automobile travelling down a street; transients from a nuclear reactor), and perform a set of classifications (e.g., Red Traffic Light; Small Pedestrian at 10m; Load Rejection; Single Coolant Pump Trip), and then use these classifications in combination with recommendation algorithms to achieve platform goals (e.g., Stop the Vehicle at the Traffic Light, Avoid the Small Pedestrian; Trip the Reactor to prevent a Safety Event). The design, implementation, and fielding of an ACS capability will alter the cyber-attack surface such that existing risk management plans will need to be updated to include how to protect and defend against data-science and decision-support-system attack classes. These attack classes would include protection of the design and training environments where algorithm selection and testing and training data would be obvious attack vectors. These attack classes would also require an informed set of detection and response procedures to identify anomalous behaviors and document best practices for anomaly assessment and vulnerability mitigation and remediation. Last year we published a Cyber Threat Assessment Methodology for Autonomous and Remote Operations for AR/SMRs along with a companion publication on Cyber Attack and Defense Use Cases. The focus of the methodology was on describing and enumerating ACS processes, components, and functions such that security engineers could: evaluate subversion options against the target; identify threat actor attributes and capabilities derived from each subversion option; and identify security controls and response countermeasures. The Use Cases document offered detailed methodology examples including an assessment of a Military Base SMR, an Autonomous System Decision Loop, and implementation of AR/SMR Machine Learning algorithms. Our proposal at the end of last year was to focus on implementation of subversion prototypes related to the last Use Case area: AR/SMR Machine Learning (ML) Algorithms. We included six attack scenarios in our Use Cases paper: a Poisoning Attack against ML functions implemented using an FPGA; a Trojaning Attack against ML classifiers exploiting the excitability of Nuclear Engineers; a Backdooring Attack against ML Training environments to ensure persistence of an attack vector; a False Positive Evasion Attack against multi-factor Access Control Systems using clever inputs; an Inference Attack against ML models by an Insider with access to the Operational environment; and an Adversarial Reprogramming Attack against a Material Access Control Video Surveillance System. At the beginning of this year these six attack scenarios were provided to our research teams at Georgia Tech and Idaho State University and each team successfully implemented a subversion attack against a ML implementation to include transient misclassifications. While this is a notable outcome from this type of research, this paper offers the reader insight into not only how to structure and execute these types of attacks, but into the thought process behind how the researcher investigated the problem space, performed initial algorithm implementation, and the trial-and-error behind arriving at the successful subversion prototypes. We include in this paper a set of associated Scenarios on how these subversion prototypes could be implemented and an initial set of guidance for AR/SMR architects, Nuclear Regulators, and Cyber Defenders to implement awareness and defense capabilities into their current operational portfolios.

42 ENGINEERING↗
DOE OSTI2024

A Compound Data Poisoning Technique with Significant Adversarial Effects on Transformer-based Sentiment Classification Tasks

Transformer-based models have demonstrated much success in various natural language processing tasks. However, they are often vulnerable to adversarial attacks, such as data poisoning, which can intentionally fool the model into generating incorrect results. In this article, we present a novel, compound variant of a data poisoning attack on a transformer-based model that maximizes the poisoning effect while minimizing the scope of poisoning. Here we do so by combining the established data poisoning technique (label flipping) with a novel adversarial artifact selection and insertion technique aimed at minimizing detectability and the scope of the poisoning footprint. We find that by using a combination of these two techniques, we achieve a state-of-the-art attack success rate of approximately 90% while poisoning only 0.5% of the original training set, thus minimizing the scope and detectability of the poisoning action. These findings have the potential to advance the development of better data poisoning detection methods.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2023

Quantifying the robustness of deep multispectral segmentation models against natural perturbations and data poisoning

In overhead image segmentation tasks, including additional spectral bands beyond the traditional RGB channels can improve model performance. However, it is still unclear how incorporating this additional data impacts model robustness to adversarial attacks and natural perturbations. For adversarial robustness, the additional in-formation could improve the model’s ability to distinguish malicious inputs, or simply provide new attack avenues and vulnerabilities. For natural perturbations, the additional information could better inform model decisions and weaken perturbation effects or have no significant influence at all. In this work, we seek to characterize the performance and robustness of a multispectral (RGB and near infrared) image segmentation model subjected to adversarial attacks and natural perturbations. While existing adversarial and natural robustness research has focused primarily on digital perturbations, we prioritize on creating realistic perturbations designed with physical world conditions in mind. For adversarial robustness, we focus on data poisoning attacks whereas for natural robustness, we focus on extending ImageNet-C common corruptions for fog and snow that coherently and self-consistently perturbs the input data. Overall, we find both RGB and multispectral models are vulnerable to data poisoning attacks regardless of input or fusion architectures and that while physically-realizable natural perturbations still degrade model performance, the impact differs based on fusion architecture and input data.

Deep learning, multispectral images, multimodal fu↗
DOE OSTI2021

Development of a CNS-permeable reactivator for nerve agent exposure: an iterative, multi-disciplinary approach

Nerve agents have experienced a resurgence in recent times with their use against civilian targets during the attacks in Syria (2012), the poisoning of Sergei and Yulia Skripal in the United Kingdom (2018) and Alexei Navalny in Russia (2020), strongly renewing the importance of antidote development against these lethal substances. The current standard treatment against their effects relies on the use of small molecule-based oximes that can efficiently restore acetylcholinesterase (AChE) activity. Despite their efficacy in reactivating AChE, the action of drugs like 2-pralidoxime (2-PAM) is primarily limited to the peripheral nervous system (PNS) and, thus, provides no significant protection to the central nervous system (CNS). This lack of action in the CNS stems from their ionic nature that, on one end makes them very powerful reactivators and on the other renders them ineffective at crossing the Blood Brain Barrier (BBB) to reach the CNS. In this report, we describe the use of an iterative approach composed of parallel chemical and in silico syntheses, computational modeling, and a battery of detailed in vitro and in vivo assays that resulted in the identification of a promising, novel CNS-permeable oxime reactivator. Additional experiments to determine acute and chronic toxicity are ongoing.

37 INORGANIC, ORGANIC, PHYSICAL, AND ANALYTICAL CH↗
DOE OSTI2024

Cyber Resilience in the Cast Timing System

Our task within the DarkNet project was to test the cyber resiliency of the Center for Alternate Synchronization and Timing’s (CAST) framework. We focused our testing on two of the core pieces of CAST’s implementation, a Juniper MX204 router and the Precision Time Protocol (PTP). In this report, we cover the following attempted methods of attack on our targets: ping flood, fork bomb, network protocol fuzzing, ARP poisoning, and IGMP spoofing. We found that delaying certain packets, specifically Delay Request, had a significant impact on the Offset from Master and Observed Drift timing statistics.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2021

Analysis of Organophosphorus-Based Nerve Agent Degradation Products by Gas Chromatography-Mass Spectrometry (GC-MS): Current Derivatization Reactions in the Analytical Chemist’s Toolbox

The field of gas chromatography-mass spectrometry (GC-MS) in the analysis of chemical warfare agents (CWAs), specifically those involving the organophosphorus-based nerve agents (OPNAs), is a continually evolving and dynamic area of research. The ever-present interest in this field within analytical chemistry is driven by the constant threat posed by these lethal CWAs, highlighted by their use during the Tokyo subway attack in 1995, their deliberate use on civilians in Syria in 2013, and their use in the poisoning of Sergei and Yulia Skripal in Great Britain in 2018 and Alexei Navalny in 2020. These events coupled with their potential for mass destruction only serve to stress the importance of developing methods for their rapid and unambiguous detection. Although the direct detection of OPNAs is possible by GC-MS, in most instances, the analytical chemist must rely on the detection of the products arising from their degradation. To this end, derivatization reactions mainly in the form of silylations and alkylations employing a vast array of reagents have played a pivotal role in the efficient detection of these products that can be used retrospectively to identify the original OPNA.

sarin↗
DOE OSTI2021

Radiation exposure induces cross-species temporal metabolic changes that are mitigated in mice by amifostine

Exposure to acute, damaging radiation may occur through a variety of events from cancer therapy and industrial accidents to terrorist attacks and military actions. Our understanding of how to protect individuals and mitigate the effects of radiation injury or Acute Radiation Syndrome (ARS) is still limited. There are only a few Food and Drug Administration-approved therapies for ARS; whereas, amifostine is limited to treating low dose (0.7–6 Gy) radiation poisoning arising from cancer radiotherapy. An early intervention is critical to treat ARS, which necessitates identifying diagnostic biomarkers to quickly characterize radiation exposure. Towards this end, a multiplatform metabolomics study was performed to comprehensively characterize the temporal changes in metabolite levels from mice and non-human primate serum samples following γ-irradiation. The metabolomic signature of amifostine was also evaluated in mice as a model for radioprotection. The NMR and mass spectrometry metabolomics analysis identified 23 dysregulated pathways resulting from the radiation exposure. These metabolomic alterations exhibited distinct trajectories within glucose metabolism, phospholipid biosynthesis, and nucleotide metabolism. A return to baseline levels with amifostine treatment occurred for these pathways within a week of radiation exposure. Together, our data suggests a unique physiological change that is independent of radiation dose or species. Furthermore, a metabolic signature of radioprotection was observed through the use of amifostine prophylaxis of ARS.

59 BASIC BIOLOGICAL SCIENCES↗