In a \emph{data poisoning attack}, an attacker modifies, deletes, and/or inserts some training examples to corrupt the learnt machine learning model. \emph{Bootstrap Aggregating (bagging)} is a well-known ensemble learning method, which trains multiple base models on random subsamples of a training dataset using a base learning algorithm and uses majority vote to predict labels of testing examples. We prove the intrinsic certified robustness of bagging against data poisoning attacks. Specifically, we show that bagging with an arbitrary base learning algorithm provably predicts the same label for a testing example when the number of modified, deleted, and/or inserted training examples is bounded by a threshold. Moreover, we show that our derived threshold is tight if no assumptions on the base learning algorithm are made. We evaluate our method on MNIST and CIFAR10. For instance, our method achieves a certified accuracy of $91.1\%$ on MNIST when arbitrarily modifying, deleting, and/or inserting 100 training examples. Code is available at: \url{https://github.com/jjy1994/BaggingCertifyDataPoisoning}.

翻译：在 \ emph{ 数据中毒攻击} 中,攻击者修改、删除和/或插入一些培训范例,以腐蚀所学的机器学习模式。 \ emph{Bootsstrap 聚合(bashing)} 是一种众所周知的共通学习方法,它利用一个基础学习算法对培训数据集的随机子样本进行多基模型培训,并使用多数票来预测测试实例的标签。 我们证明,包包包对数据中毒袭击的加固性具有内在的经认证的可靠性。 具体地说, 我们用任意的基础学习算法来预测一个测试示例的标签相同。 当修改、删除和/或插入的培训示例被一个阈值捆绑时, 。 此外, 我们显示,如果没有对基础学习算法进行假设, 我们所得出的阈值是紧凑的。 我们用MNIST 和 CIFAR10 来评估我们的方法。 例如, 我们的方法在任意修改、 删除和/ 或插入100个培训示例时, 其认证的准确度为91.1美元。 。 代码可在 : url/\\\\\\\ brifile.