# Label Flipping Data Poisoning Attack Against Wearable Human Activity
Recognition System

Abdur R. Shahid1, Ahmed Imteaj2, Peter Y. Wu1, Diane A. Igoche1, Tauhidul
Alam3 1Department of Computer and Information Systems, Robert Morris
University, Moon, PA, USA
2School of Computing, Southern Illinois University, Carbondale, IL, USA
3Department of Computer Science, Louisiana State University Shreveport,
Shreveport, LA, USA
1{shahid, wu<EMAIL_ADDRESS><EMAIL_ADDRESS><EMAIL_ADDRESS>
###### Abstract

Human Activity Recognition (HAR) is a problem of interpreting sensor data to
human movement using an efficient machine learning (ML) approach. The HAR
systems rely on data from untrusted users, making them susceptible to data
poisoning attacks. In a poisoning attack, attackers manipulate the sensor
readings to contaminate the training set, misleading the HAR to produce
erroneous outcomes. This paper presents the design of a label flipping data
poisoning attack for a HAR system, where the label of a sensor reading is
maliciously changed in the data collection phase. Due to high noise and
uncertainty in the sensing environment, such an attack poses a severe threat
to the recognition system. Besides, vulnerability to label flipping attacks is
dangerous when activity recognition models are deployed in safety-critical
applications. This paper shades light on how to carry out the attack in
practice through smartphone-based sensor data collection applications. This is
an earlier research work, to our knowledge, that explores attacking the HAR
models via label flipping poisoning. We implement the proposed attack and test
it on activity recognition models based on the following machine learning
algorithms: multi-layer perceptron, decision tree, random forest, and XGBoost.
Finally, we evaluate the effectiveness of a K-nearest neighbors (KNN)-based
defense mechanism against the proposed attack.

###### Index Terms:

adversarial machine learning; human activity recognition; data poisoning
attack; sensors; wearables

##  I Introduction

Human Activity Recognition, or HAR, is a field of study to understand,
recognize, and predict human activities through machine learning (ML). In HAR,
raw time-series data from wearable sensors are acquired and translated to
human activities (e.g. walking, sitting, jumping, fighting, falling, etc.).
Thanks to the ubiquity of wearable sensors and the Internet of Things (IoT)
and their ever-growing computing, networking, and sensing powers, designing
and building effective and efficient wearable-sensor-based human activity
recognition (HAR) systems have gained increased attention from researchers and
tech industries in the last decade. Apart from the various wearable sensor-
based HAR systems proposed in the literature, various commercial wearable
products are now available on the market including fitness trackers,
smartwatches, and smartphones which are packed with various wearable sensors.
Commonly utilized wearable sensors in HAR systems[1] include accelerometer[2],
magnetometer, gyroscopes, inertial measurement unit (IMU), electromyogram
(EMG)[3], force-sensitive resistors (FSR)[4] and wearable wrist camera[5]. The
wearable sensors-driven HAR has critical applications in healthcare [6, 7, 8,
9], human-robot interaction [10, 11], interactive gaming [4], sports [12, 2],
military [13, 14] and so on.

Wearable-sensor-based HAR is a classification problem that involves data
acquisition, preprocessing to filter out signal variability or noise, feature
extraction, training, and validating the recognizer. Similar to other ML
problems, the success of HAR largely depends on the quality and quantity of
the dataset to train and develop the recognition model. While over the last
decades ML-based solutions have achieved quite a success, the adversarial side
of data collection for HAR is yet to be explored. To understand the magnitude
of the problem, we need to look at the two modes of data collection for HAR:
closed environment and mobile crowdsensing (MCS). In a closed environment, the
data collection is done in a controlled way and hence the risk of adversarial
attacks is close to zero. However, on the downside, this limits the variety
and size of the dataset, which can cause sampling bias in the dataset. For
instance, the UCI HAR dataset consists of data of 30 volunteers [15]. Another
popular HAR dataset, WISDM, was acquired from 51 test subjects [16]. The
MHealth dataset contains data from ten volunteers [17]. Such limitation is a
real hindrance to the development process of a HAR system. While MCS has the
great potential to solve this problem, its openness allows malicious entities
to attack the system easily. In MCS, adversaries have the privilege of sending
corrupted samples directly to the dataset aggregator to poison the recognition
system; and hence mislead to produce erroneous outcomes. Such an attack is
referred to as a data poisoning attack. To develop a robust HAR system, it is
critical to study how well a HAR system performs under poisoning attacks. In a
training-only data poisoning attack, the attacker is capable of manipulating
the training instances of the target model without the need of accessing the
test instances. Several training-only data poisoning attacks have been
proposed in literature including feature collision, influence functions, label
flipping, vanishing gradients, generative models, and model poisoning[18]. As
the classifier learns from poisoned data, it will lead to unintentional or
even life-threaten situations. Let us consider a HAR system designed to call
for emergency service if detects a sudden fall. For fun, profit, and revenge,
attackers might attempt to alter the training dataset so that the trained
model on the poisoned dataset recognizes a heart attack-related fall as a
regular sitting. This is an example of targeted attack in which the attacker’s
goal is to change the behavior of the model on particular instances. In
untargeted attacks, attackers seek to alter a model’s behavior regardless of
particular instances or scenarios. A subclass of data poisoning attack is
label flipping attack where the label of a sensor reading is maliciously
changed in the data collection phase[19, 20, 21, 22]. Let us consider a HAR
system to recognize the following activities using a smartphone: {walking,
going upstairs, going downstairs, sitting, standing, laying, crawling}. In an
untargeted label flipping attack, an attacker might aim to jeopardize the
model development process by injecting label flipped data as much as possible.
To illustrate, instead of sending data for walking, the attacker might change
the label to standing.

In this work, we focus on untargeted label flipping attack that can happen
through mobile crowdsensing. While there has been a long line of prior work on
data poisoning, very few of them covered HAR systems. In fact, data poisoning
attack on the IoT system is less studied compared to vision-related system. In
this paper, we make the following contributions.

  * •

Label Flipping Attack for Human Activity Recognition Systems. We present a
label flipping attack for multi-class sensor-based HAR systems. To the best of
our knowledge, this is the first work on label flipping attacks for sensor-
based HAR systems. We first propose an optimal but computationally intractable
version of the problem. Next, to reduce the computational cost, we present a
randomized approach for the attack.

  * •

Label Flipping Attack for Multi-Class Classification Task. While most
contemporary works on label flipping attacks focus on binary classification
problems, we extend the existing works to design the attack for multi-class
classifiers.

  * •

k-NN-based Defense Mechanism. We extend K-Nearest Neighbor (KNN)-based defense
mechanism, proposed by Paudice et al.[21], to evaluate the proposed attack.
This extended mechanism is capable of detecting the malicious training data
(whose label was changed) and predicting their correct label. The mechanism is
suitable for participatory-MCS, where the collected data is partially trusted.

  * •

Empirical Study of the Label Flipping Attack and Defense. We empirically
evaluate the effectiveness of the proposed attack and defense mechanisms. In
the evaluation, we utilized the popular UCI HAR dataset[15] and developed HAR
models using the following algorithms: Multi-layer Perceptron, Decision Tree,
Random Forest, and XGBoost in a blackbox setting.

Figure 1: HAR system with sensor data contributors. $\star$ depicts attackers who submit label flipped poisonous data to the system. TABLE I: Frequently used Symbols  Symbol | Definition
---|---
$\mathcal{D}$ | Dataset
$\beta$ | Threshold for number of subsets
$\theta$ | Threshold for loss function output
$x$ | Trusted dataset size
$p$ | Number of label flipped samples
$K$ | Defense model’s hyperparameter

##  II Related Work

Poisoning attack against machine learning algorithms has become an emerging
research in the field of adversarial machine learning [23, 18, 24]. Over the
years, different types of poisoning attacks have been proposed in the
literature, including label flipping attack [19, 20, 21, 22]. These attacks
work by switching training labels while leaving the data instances untouched.
They have the advantage of not introducing strange-looking artifacts, which
may be obvious to the intended victim. One prominent work in this area is the
attack proposed by Biggio et al.[19] to evaluate the effectiveness of Support
Vector Machines (SVM) in adversarial classification tasks. The authors adopt
two different strategies for contaminating the training set through label
flipping: random and adversarial label flips. In both cases, they assumed that
an adversary can only flip the labels of a given percentage of training
samples. Zhang et al.[25] established a game-theoretic framework for attacking
SVM models. Zhao et al.[26] developed Projected Gradient Ascent (PGA)
algorithm to compute a label contamination attack (LCA) which improved the
SVM-based works. paudice et al.[21] proposed an efficient algorithm to perform
optimal label flipping poisoning attacks. From the perspective of defending
against label flipping poisoning attacks on modern ML, Paudice et al.[21]
proposed k-Nearest-Neighbors (kNN) to re-label reach data point to mitigate
label flipping attacks. Specifically, they re-label each data point with the
most common label among its $K$ nearest neighbors.

A major limitation of most of the works on designing label flipping work
concentrated on binary classification problems. Also, an investigation of the
effectiveness of the proposed attacks on wearable-based HAR is yet to be
explored.

##  III The Setting

###  III-A Classification Problem

Consider a multi-class human-activity classification problem: a recognizer
($f:\mathcal{X}\rightarrow\mathcal{R}^{k}$) receives a pair of random
variables $(X,Y)\in\mathcal{X}\times\\{1,\ldots k\\}$ where $Y$ is unobserved
and wishes to assign the variable $X$ to one of the $k$ classes
$K=\\{1,2,\ldots k\\}$ such that the probability of a misclassification is
minimized. Each component $f_{y}(x),y=1,\ldots x$ is the deemed likelihood the
recognizer assigns to class $y$ for $x$. Consequently, the goal of the
recognizer is then to minimize the expected loss function $L$,

$R_{L}(f):=\mathbb{E}[L(f(X),Y)]$ (1)

Where $L(f(X),Y)$ measures the loss of margins $f(x)\in\mathcal{R}^{k}$ when
the true label of $x$ is $y$ and the expectation (eq. 1) is taken jointly over
$(X,Y)$.

###  III-B Threat Model

Similar to prior works on data poisoning, we consider a white-box attacker. We
consider the worst-case scenario of an attack, where the attacker has the
capability of directly injecting data into the training dataset. The attacker
has access to the raw data collection phase and is capable of modifying the
data to perform an attack. The attacker can disguise itself as an ordinary
sensor data contributor. It has knowledge of the data distribution, a portion
of the training dataset, the training algorithm, the model type, and
hyperparameters. While the consideration of such an attacker seems a bit
unrealistic but it allows us to investigate the worst-case performance and
demonstrate how robust the learning algorithm is; under certain attacks. Using
such knowledge, the goal of the attacker is to manipulate the data collection
phase to poison the training data set. For this purpose, the attacker replaces
the label of its dataset before the model is in the training step. This means,
its goal is the opposite of the recognizer: maximize the expected loss $L$. We
assume that any defense mechanism deployed by the system to prevent data
poisoning is unknown to the attacker.

##  IV The Label Flipping Attack on HAR

We assumed that the main purpose of the attacker is to manipulate the labels
of some samples in the training set to mislead the model to make wrong
predictions as many as possible. In other words, in this problem, the loss
function on the true data is minimized and the cost function of the poisoned
data is maximized. However, an arbitrary amount of changes might be noticed by
the system and subsequently stops the attacker from causing further damage to
the model. Therefore, the attack becomes a multi-objective optimization
problem where, on one hand, the attacker wants to cause the highest amount of
damage to the model, and on the other hand, it wants to avoid any defense
mechanism as much as possible. If $\mathcal{D^{\text{true}}}$,
$\mathcal{D^{\text{poisoned}}}$, and $\mathcal{D}$ are the true/not poisoned,
poisoned, and entire sets where
$\mathcal{D}=\mathcal{D^{\text{true}}}\cup\mathcal{D^{\text{poisoned}}}$; then
the attack can be formulated as an optimization problem and can be expressed
as follows:

$\arg\min\Big{(}\sum_{x_{i}\in\mathcal{D^{\text{true}}}}L(f(x_{i}),y_{i}))-\sum_{x_{i}\in\mathcal{D^{\text{poisoned}}}}L(f(x_{i}),y_{i}))\Big{)}$
(2)

To carry out the flipping attack, an adversary targets to choose $p$ samples
whose label will be flipped such that the loss function of the model, trained
by the attacker, is maximized while the visibility of the attack to the system
is minimized. The amount of visibility can be expressed as a budget
$\mathcal{C}$. If the cost of flipping a sample’s label is $c_{i}$, then the
optimization problem (eq. 2) becomes,

$\begin{split}\arg\min_{\mathcal{C}}&\Big{(}\sum_{x_{i}\in\mathcal{D^{\text{true}}}}L(f(x_{i}),y_{i}))-\sum_{x_{i}\in\mathcal{D^{\text{poisoned}}}}L(f(x_{i}),y_{i}))\Big{)}\\\
&s.t.\quad\sum_{i=1}^{i=p}c_{i}\leq\mathcal{C}\end{split}$ (3)

We can express the optimal label flipping strategy as follows. In every subset
$s\in\left(\begin{array}[]{c}n\\\ p\end{array}\right)$ of $\mathcal{D}$,
change the original label of each sample $(X,Y)\in s$ to all the other labels
in $(K\setminus Y)$ and generate a set with contaminated samples. Here, $n$
refers to the number of samples in $\mathcal{D}$. For each of the contaminated
sets $\mathcal{D}^{\prime}$ train a model. Finally, select the training set
for which its corresponding model’s loss function’s output was the maximum
among all the contaminated models while it meets specific budget constraints.
Solving such a problem requires a heuristic search considering all possible
subsets to identify the labels that are flipped. Therefore, next, we present a
realistic randomized approach for the label flipping attack. Before that, we
need to keep in mind that the design of budget $\mathcal{C}$ depends on
various factors, including time and resource constraints. In this work, we
propose a version of the attack that can be performed straight from a wearable
(e.g.smartphone) during the data collection phase.

We first introduce two parameters $\beta$ and $\delta$ where $\beta$ is to
control the number of subsets to try out of the total
$\left(\begin{array}[]{c}n\\\ p\end{array}\right)$ from $S_{A}$ set.
Theoretically, $0<\beta\leq\left(\begin{array}[]{c}n\\\ p\end{array}\right)$.
The parameter $\delta$ is to define the attacker’s satisfactory level of loss
function’s output. If the loss function’s output meets or exceeds $\delta$
then we say the attacker’s goal is achieved. Utilizing these two parameters,
the proposed randomized label flipping attack stops its search to find a
suboptimal subset if the following condition is true:

$\begin{split}\beta\geq\text{(Total number of subsets considered)}\text{ and
}\\\ \delta\geq\text{(The output of the loss function)}\end{split}$ (4)

The method is outlined in algorithm 1. This algorithm takes as input:

  1. 1.

A supervised machine learning algorithm

  2. 2.

A dataset $\mathcal{D}$

  3. 3.

The values of the parameters $\beta$ and $\delta$

Using these inputs, the method first randomly picks $p$ samples from $S_{A}$
(line 3 of algorithm 1). For each selected sample, it then replaces the label
with a randomly selected label from the set $K\setminus Y$. As an example,
consider a HAR system to recognize the following set of activities:{walking,
sitting, standing, and laying}. If a sample has the label ”laying”, the attack
method will pick one label from the set {walking, sitting, standin} at random,
and replace ”laying” with the selected label. After flipping the labels of the
selected $p$ samples, we get a contaminated set $S^{\prime}_{A}$ which is then
used to train and validate a contaminated model (lines 4 and 5 of algorithm
1). Finally, the method selects that contaminated dataset for which the loss
function’s output is the maximum (line 10 of algorithm 1).

1 $N_{s}\leftarrow 0,L_{o}\leftarrow 0$

2while  _$N_{s}\leq\beta$ and $L_{o}\leq\delta$_ do

3 Randomly select $p$ samples from $\mathcal{D}$.

4 Randomly change the label of each of the selected samples and create a
contaminated set $\mathcal{D}^{\prime}$.

5 $L_{o}\leftarrow$Train a contaminated model and calculate the loss function
of the trained model.

6 save the model and the contaminated set.

7 $N_{s}\leftarrow N_{s}+1$

8 end while

9Select and return the contaminated dataset for which the model’s loss
function was maximized.

Algorithm 1 Randomized Label Flipping Attack

##  V Defense Mechanism

For a wearable-based HAR system, it is not difficult to collect some data
under a controlled environment. For instance, the data collection can be video
recorded and any inconsistency in the label of the collected data from
wearable sensors can be corrected. This type of data can be called “trusted”.
This notion of the trusted dataset is the central idea of our defense
mechanism. Put it another way, our data collection process is a hybrid model
covering both a closed environment and crowdsensing. Naturally, the size of an
available trusted dataset is smaller than the untrusted dataset. The defense
mechanism works as follows. At the beginning, it takes a trusted dataset and a
machine learning algorithm as input. Here, we use the KNN approach proposed by
Paudice et al.[21]. Using the inputs, the mechanism trains a model to predict
the label of a given sample. This model is then deployed between the data
source and the database to filter out and correct the labels of poisoned
samples before inserting them into the database. The design of the system with
the defense mechanism is depicted using figure 2. Algorithm 2 describes the
steps of the defense mechanism. With $K$ as its hyperparameter, it takes a
potential poisonous sample $(x,y)$ as input. Then, it calculates the distance
of each sample in the trusted set to the input sample, then pick the $K$
closest samples (line 1 in algorithm 2). Finally, it replaces $y$ in $(x,y)$
with the mode of the labels of selected $K$ samples.

Figure 2: HAR system model with defense against the label flipping poisoning
attack.

Data: $K$, potentially poisoned sample $(x,y)$, trusted dataset
$\mathcal{D^{\text{trusted}}}$

Result: Sanitized sample

1

2Pick the $K$ closest samples from $\mathcal{D^{\text{trusted}}}$ based on
their distances from the poisoned sample.

3$y_{\text{pred}}\leftarrow$ Mode of the labels of selected $K$ samples.

4Return $(x,y_{\text{pred}})$ after replacing $y$ with $y_{\text{pred}}$ in
$(x,y)$.

Algorithm 2 Label Sanitization

##  VI Results

###  VI-A Experimental Setting

In the experiment, we utilize the UCI HAR dataset[15]. It consists data of 30
volunteers within an age bracket of 19-48 years. Each person performed six
activities (WALKING, WALKING_UPSTAIRS, WALKING_DOWNSTAIRS, SITTING, STANDING,
LAYING) wearing a smartphone (figure 3 shows the distribution of the
activities in the dataset).

Figure 3: Distribution of the activities in the dataset.

The experiments were video-recorded to label the data manually. The obtained
dataset had been randomly partitioned into two sets, where 75% of the
volunteers were selected for generating the training data and 25% for the test
data. We develop HAR models in both non-adversarial and adversarial
environments using the following algorithms:

  * •

Multi-layer Perceptron (MLP)

  * •

Decision Tree (DT)

  * •

Random Forest (RF)

  * •

XGBoost

We train all the models in a black-box settings with default parameters
provided by scikit-learn package. In the non-adversarial environment, we
assume that all the samples are with true labels. In the adversarial
environment, we separate $x\%$ samples from the training dataset as trusted
dataset. This $x\%$ samples are then used to develop a KNN model for defense
mechanism. Out of the $(1-x)\%$ training samples, we flip the labels of $p\%$
samples using the proposed attack (algorithm 1). For speedy proof of concept
generation, we use $\beta=1$ and $\delta=0$. Also, such a setting of these two
parameters makes resource-constrained attack a reality. The values of $x$,
$p$, and $K$ used in the experiment are as follows.

  * •

$x$ = $\\{5,10,15,20,25\\}$

  * •

$p$ = $\\{1,5,10,15,20,25,30\\}$

  * •

$K$ = $\\{3,5,7,9,11,13\\}$

Using the combinations of the values of these parameters, we developed
multiple contaminated and defense models.

TABLE II: Accuracy of the baseline models on the original dataset (in %) Model $\rightarrow$ | MLP | DT | DT | XGBoost
---|---|---|---|---
Accuracy $\rightarrow$ | 94 | 86 | 92 | 96

###  VI-B Baseline Models

For comparison purpose, we first develop baseline four models using the above-
mentioned algorithms without considering the attack. The accuracy of the four
models on the test set are presented in table II. The results of these models
are quite impressive as it is possible to make $95\%$ correct predictions with
the default settings of the algorithms. We left the hyperparameter tuning of
these algorithms to improve the performance further for our future work.

###  VI-C Attack and Defense Analysis

In the analysis of the proposed attack and defense mechanism, in this paper,
we seek answers to the following three interrelated questions which are
critical in evaluating their effectiveness.

  * •

What impact does the proposed attack have on a HAR model?

  * •

How good is the defense mechanism for a HAR model against the proposed attack?

  * •

What is the influence of the amount of trusted data on the defense mechanism?

####  VI-C1 Impact of the Proposed Attack

To answer the first question, we study the relationship between the attack and
different HAR models for varying amounts of poisoned data. The results on this
relationship is showed in table III. With $1\%$ label flipped data, the attack
barely has any significant affect on the four models. However, with little
increase in the amount of poisoned data (from $1\%$ to $5\%$), the attack was
able to influence all models’ accuracy crucially. Among all the models, MLP’s
accuracy dropped drastically (from $94\%$ to $77\%$). Among the tree-based
models, both random forest (RF) and XGboost show notable strength against the
attack with $5\%$ poisoned data. However, their resistance against the attack
is almost completely washed away under $15\%$ poisoned data. At this point,
all the models become literally useless as the accuracy dropped to $50\%$ or
less.

TABLE III: Accuracy on the poisoned dataset (in %) Models | Amount of Label Flipped Data (in %)
---|---
1 | 5 | 10 | 15 | 20 | 25 | 30
MLP | 93 | 77 | 71 | 39 | 27 | 21 | 19
DT | 83 | 65 | 63 | 35 | 27 | 21 | 18
RF | 92 | 84 | 80 | 56 | 45 | 35 | 27
XGBoost | 93 | 83 | 80 | 55 | 45 | 35 | 27
TABLE IV: Accuracy on the recovered dataset after applying the defense mechanism with K = 9 (in %) Models | Amount of Label Flipped Data (in %)
---|---
1 | 5 | 10 | 15 | 20 | 25 | 30
MLP | 94 | 93 | 93 | 91 | 91 | 89 | 89
DT | 85 | 85 | 83 | 84 | 82 | 82 | 82
RF | 92 | 92 | 91 | 89 | 90 | 89 | 88
XGBoost | 94 | 93 | 92 | 90 | 90 | 90 | 88

####  VI-C2 Effectiveness of the Defense Mechanism against the Attack

Next, we analyze the strength of the defense mechanism against the attack with
varying amounts of poisoned data samples. We first examine its impact on the
accuracy of the different models after sanitizing the poisoned data set using
it (with $K=9$) in table IV. Let us take a look at the scenario with $15\%$
poisoned data. The defense model was able to recover most of the poisoned data
as the accuracy of the model increased sharply, and almost reached the
baseline accuracy. For instance, while MLP’s accuracy dropped to $39\%$ for
$15\%$ poisoned data, after sanitizing the data with the defense model, it was
able to achieve $91\%$ accuracy. Impressively, the models achieved pretty good
accuracy even under a high volume of poisoned data (e.g. $30\%$). This
signifies the effectiveness of the proposed KNN-based defense mechanism in
sanitizing the label flipped data. To get a better idea of what the models are
getting right and what types of errors they are making on the original,
poisoned, and recovered datasets, let us take a look at the confusion metrics
of the different models presented in figure 4. Note that these confusion
matrices were generated with $K=9$, $x=10\%$, $p=25\%$. The first insight we
can draw from the confusion metrics on the poisoned dataset is that the attack
exhibits an untargeted attack as it scrambled all the numbers in each matrix.
Another insight that can be drawn is the similarities between the confusion
matrices on original and recovered datasets for all the models. Apparently,
all the models had some difficulties in differentiating SITTING and STANDING;
and it is not due to the attack, as a similar problem was perceived on the
original dataset too. One potential solution to this problem is to collect
more data on these two activities.

Original Dataset | Poisoned Dataset | Recovered Dataset
---|---|---
|  |
Multi-layer Perceptron
|  |
Decision Tree
|  |
Random Forest
|  |
XGBoost
Figure 4: Confusion matrix of the decision tree, random forest, and XGBoost
models on the original, poisoned, and recovered datasets. Here, 10% of the
entire dataset was used as a trusted set. 25% of the untrusted dataset was
contaminated with the proposed label flipped attack. k = 9 was used to train
the KNN-based defense model.

####  VI-C3 Influence of Trusted Dataset Size on the Defense Mechanism

Figure 5 presents experimental results of the relationship between the size of
the trusted dataset and the KNN-based defense mechanism. Here, by accuracy, we
mean the accuracy of the mechanism with a specific value of $K$ to correctly
predict the label of a sample in a trusted dataset. For all the $K$s,
regardless the size of the trusted dataset, the models achieved more than
$90\%$ accuracy. In addition, the models show improved performance with the
increase in the size of the trusted dataset.

Figure 5: Relationship between the defense model and trusted dataset size

##  VII Conclusion

The open structure of the human activity recognition (HAR) system for data
collection, such as mobile crowdsensing, allows adversaries to inject
poisonous data to disrupt the recognition process. In this paper, we present
our novel research on investigating the label flipping data poisoning attack
on wearable-sensor-based HAR systems. While the majority of the attacks on
label flipping focus on the binary classifier, our resea extend the existing
works for multi-class classification problem. We empirically demonstrate the
effectiveness of the proposed attack on different machine learning algorithms.
Then, we present a defense mechanism based on the KNN algorithm which exhibits
impressive performance on a real-world dataset. As an early work, the work has
scope for improvement that lay the foundation for future research works, which
includes, developing a better defense mechanism as the KNN-based approach has
its limitations, covering different datasets in the experiment, and evaluating
the strength of the attack against deep learning models.

## References

  * [1] L. M. Dang, K. Min, H. Wang, M. J. Piran, C. H. Lee, and H. Moon, “Sensor-based and vision-based human activity recognition: A comprehensive survey,” _Pattern Recognition_ , vol. 108, p. 107561, 2020.
  * [2] W. R. Johnson, A. Mian, M. A. Robinson, J. Verheul, D. G. Lloyd, and J. A. Alderson, “Multidimensional ground reaction forces and moments from wearable sensor accelerations via deep learning,” _IEEE Transactions on Biomedical Engineering_ , vol. 68, no. 1, pp. 289–297, 2020.
  * [3] A. Al-Yacoub, A. Buerkle, M. Flanagan, P. Ferreira, E.-M. Hubbard, and N. Lohse, “Effective human-robot collaboration through wearable sensors,” in _2020 25th IEEE International Conference on Emerging Technologies and Factory Automation (ETFA)_ , vol. 1. IEEE, 2020, pp. 651–658.
  * [4] B. Dontha, K. Swearingen, S. Swearingen, S. E. Thrane, and A. Kiourti, “Wearable sensors based on force-sensitive resistors for touch-based collaborative digital gaming,” _Sensors_ , vol. 22, no. 1, p. 342, 2022.
  * [5] F. Chen, H. Lv, Z. Pang, J. Zhang, Y. Hou, Y. Gu, H. Yang, and G. Yang, “Wristcam: A wearable sensor for hand trajectory gesture recognition and intelligent human–robot interaction,” _IEEE Sensors Journal_ , vol. 19, no. 19, pp. 8441–8451, 2018.
  * [6] Y. Wang, S. Cang, and H. Yu, “A survey on wearable sensor modality centred human activity recognition in health care,” _Expert Systems with Applications_ , vol. 137, pp. 167–190, 2019.
  * [7] Y. Matsushita, D. T. Tran, H. Yamazoe, and J.-H. Lee, “Recent use of deep learning techniques in clinical applications based on gait: a survey,” _Journal of Computational Design and Engineering_ , vol. 8, no. 6, pp. 1499–1532, 2021.
  * [8] A. Palaniappan, R. Bhargavi, and V. Vaidehi, “Abnormal human activity recognition using svm based approach,” in _2012 international conference on recent trends in information technology_. IEEE, 2012, pp. 97–102.
  * [9] A. Kristoffersson and M. Lindén, “A systematic review of wearable sensors for monitoring physical activity,” _Sensors_ , vol. 22, no. 2, p. 573, 2022\.
  * [10] S. U. Lee, A. Hofmann, and B. Williams, “A model-based human activity recognition for human–robot collaboration,” in _2019 IEEE/RSJ International Conference on Intelligent Robots and Systems (IROS)_. IEEE, 2019, pp. 736–743.
  * [11] Y. Tang, L. Zhang, F. Min, and J. He, “Multi-scale deep feature learning for human activity recognition using wearable sensors,” _IEEE Transactions on Industrial Electronics_ , 2022.
  * [12] V. Camomilla, E. Bergamini, S. Fantozzi, and G. Vannozzi, “Trends supporting the in-field use of wearable inertial sensors for sport performance evaluation: A systematic review,” _Sensors_ , vol. 18, no. 3, p. 873, 2018\.
  * [13] J. J. Kang, W. Yang, G. Dermody, M. Ghasemian, S. Adibi, and P. Haskell-Dowland, “No soldiers left behind: an iot-based low-power military mobile health system design,” _IEEE access_ , vol. 8, pp. 201 498–201 515, 2020.
  * [14] J. J. Kang, “A military human performance management system design using machine learning algorithms,” in _2021 31st International Telecommunication Networks and Applications Conference (ITNAC)_. IEEE, 2021, pp. 13–18.
  * [15] D. Anguita, A. Ghio, L. Oneto, X. Parra Perez, and J. L. Reyes Ortiz, “A public domain dataset for human activity recognition using smartphones,” in _Proceedings of the 21th international European symposium on artificial neural networks, computational intelligence and machine learning_ , 2013, pp. 437–442.
  * [16] G. M. Weiss, K. Yoneda, and T. Hayajneh, “Smartphone and smartwatch-based biometrics using activities of daily living,” _IEEE Access_ , vol. 7, pp. 133 190–133 202, 2019.
  * [17] O. Banos, R. Garcia, J. A. Holgado-Terriza, M. Damas, H. Pomares, I. Rojas, A. Saez, and C. Villalonga, “mhealthdroid: a novel framework for agile development of mobile health applications,” in _International workshop on ambient assisted living_. Springer, 2014, pp. 91–98.
  * [18] M. Goldblum, D. Tsipras, C. Xie, X. Chen, A. Schwarzschild, D. Song, A. Madry, B. Li, and T. Goldstein, “Dataset security for machine learning: Data poisoning, backdoor attacks, and defenses,” _IEEE Transactions on Pattern Analysis and Machine Intelligence_ , 2022.
  * [19] B. Biggio, B. Nelson, and P. Laskov, “Support vector machines under adversarial label noise,” in _Asian conference on machine learning_. PMLR, 2011, pp. 97–112.
  * [20] H. Xiao, H. Xiao, and C. Eckert, “Adversarial label flips attack on support vector machines,” in _ECAI 2012_. IOS Press, 2012, pp. 870–875.
  * [21] A. Paudice, L. Muñoz-González, and E. C. Lupu, “Label sanitization against label flipping poisoning attacks,” in _Joint European conference on machine learning and knowledge discovery in databases_. Springer, 2018, pp. 5–15.
  * [22] N. Baracaldo, B. Chen, H. Ludwig, A. Safavi, and R. Zhang, “Detecting poisoning attacks on machine learning in iot environments,” in _2018 IEEE international congress on internet of things (ICIOT)_. IEEE, 2018, pp. 57–64.
  * [23] M. Barreno, B. Nelson, R. Sears, A. D. Joseph, and J. D. Tygar, “Can machine learning be secure?” in _Proceedings of the 2006 ACM Symposium on Information, computer and communications security_ , 2006, pp. 16–25.
  * [24] M. Kloft and P. Laskov, “Online anomaly detection under adversarial impact,” in _Proceedings of the Thirteenth International Conference on Artificial Intelligence and Statistics_ , ser. Proceedings of Machine Learning Research, Y. W. Teh and M. Titterington, Eds., vol. 9. Chia Laguna Resort, Sardinia, Italy: PMLR, 13–15 May 2010, pp. 405–412. [Online]. Available: https://proceedings.mlr.press/v9/kloft10a.html
  * [25] R. Zhang and Q. Zhu, “A game-theoretic analysis of label flipping attacks on distributed support vector machines,” in _2017 51st Annual Conference on Information Sciences and Systems (CISS)_. IEEE, 2017, pp. 1–6.
  * [26] M. Zhao, B. An, W. Gao, and T. Zhang, “Efficient label contamination attacks against black-box learning models.” in _IJCAI_ , 2017, pp. 3945–3951.