  Data poisoning attacks, in which a malicious adversary aims to influence a
model by injecting "poisoned" data into the training process, have attracted
significant recent attention. In this work, we take a closer look at existing
poisoning attacks and connect them with old and new algorithms for solving
sequential Stackelberg games. By choosing an appropriate loss function for the
attacker and optimizing with algorithms that exploit second-order information,
we design poisoning attacks that are effective on neural networks. We present
efficient implementations that exploit modern auto-differentiation packages and
allow simultaneous and coordinated generation of tens of thousands of poisoned
points, in contrast to existing methods that generate poisoned points one by
one. We further perform extensive experiments that empirically explore the
effect of data poisoning attacks on deep neural networks.
