BiCert: A Blinear Mixed Integer Programming Formulation for Precise Certified Bounds Against Data Poisoning Attacks

Tobias Lorenz, Marta Kwiatkowska, Mario Fritz

Keywords: Data Poisoning Defense, Certified Robustness, Provable Defenses, Robust Machine Learning, Adversarial Machine Learning

TL;DR: We introduce a BMIP-based formulation to compute precise bounds against data poisoning attacks, overcoming the limitation of only expanding bounds in prior methods. Our approach increases certified accuracy and solves divergence issues.

Abstract:

Data poisoning attacks pose one of the biggest threats to modern AI systems, necessitating robust defenses. While extensive efforts have been made to develop empirical defenses, attackers continue to evolve, creating sophisticated methods to circumvent these measures. To address this, we must move beyond empirical defenses and establish provable certification methods that guarantee robustness. This paper introduces a novel certification approach using Bilinear Mixed Integer Programming (BMIP) to compute sound, deterministic bounds that provide such provable robustness. Using BMIP, we compute the reachable set of parameters that could result from training with potentially manipulated data. A key insight to make this computation feasible is relaxing the reachable parameter set to a convex set between training iterations. At test time, this parameter set allows us to predict all possible outcomes, guaranteeing robustness. Our BMIP approach is more precise than previous methods, which rely solely on interval and polyhedral bounds. Crucially, it overcomes the fundamental limitation of prior approaches where parameter bounds could only grow, often uncontrollably. We show that these tighter bounds eliminate a key source of divergence issues, resulting in more stable training and higher certified accuracy.

Primary Area: learning theory

Code Of Ethics: I acknowledge that I and all co-authors of this work have read and commit to adhering to the ICLR Code of Ethics.

Submission Guidelines: I certify that this submission complies with the submission instructions as described on https://iclr.cc/Conferences/2025/AuthorGuide.

Reciprocal Reviewing: I understand the reciprocal reviewing requirement as described on https://iclr.cc/Conferences/2025/CallForPapers. If none of the authors are registered as a reviewer, it may result in a desk rejection at the discretion of the program chairs. To request an exception, please complete this form at https://forms.gle/Huojr6VjkFxiQsUp6.

Anonymous Url: I certify that there is no URL (e.g., github page) that could be used to find authors’ identity.

No Acknowledgement Section: I certify that there is no acknowledgement section in this submission for double blind review.

Submission Number: 10032