Poisoning the Unlabeled Dataset of Semi-Supervised Learning
By Nicholas Carlini. 2021
80 citations recorded by the source corpus.
Semi-supervised machine learning models learn from a (small) set of labeled training examples, and a (large) set of unlabeled training examples. State-of-the-art models can reach within a few percentage points of fully-supervised training, while requiring 100x less labeled data. We study a new class of vulnerabilities: poisoning attacks that modify the unlabeled dataset. In order to be useful, unlabeled datasets are given strictly less review than labeled datasets, and adversaries can therefore poison them easily. By inserting maliciously-crafted unlabeled examples totaling just 0.1% of the dataset size, we can manipulate a model trained on this poisoned dataset to misclassify arbitrary examples at test time (as any desired label). Our attacks are highly effective across datasets and semi-supervised learning methods. We find that more accurate methods (thus more likely to be used) are significantly more vulnerable to poisoning attacks, and as such better training methods are unlikely to prevent this attack. To counter this we explore the space of defenses, and propose two methods that mitigate our attack.
Subfields: Artificial Intelligence, Safety, Robustness & Interpretability
How researchers see this paper
The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.
In Artificial Intelligence
- Eric Wallace
- Florian Tramèr
- Nicholas Carlini
- Percy Liang
- Matthew Jagielski
- Luke S. Zettlemoyer
- Sheng Shen
- Dawn Song
In Safety, Robustness & Interpretability
- Florian Tramèr
- Nicholas Carlini
- Eric Wallace
- Matthew Jagielski
- Daniel Klein
- Christopher A. Choquette-Choo
- Andreas F. Terzis
- Sheng Shen
Citations in the corpus
- Poisoning Language Models During Instruction Tuning (2023, background): “For example, some work poisons traditional multi-task or federated learning models (Zhao et al., 2018; Sun et al., 2021) and others poison the pre-training or self-supervision stages and affect downstream fine-tuning results (Liu et al., 2022; Carlini, 2021; Carlini & Terzis, 2022).”
- Poisoning and Backdooring Contrastive Learning (2021, background): “Poisoning attacks exist for many tasks, including supervised (Biggio et al., 2012; Turner et al., 2019; Koh & Liang, 2017), unsupervised (Kloft & Laskov, 2010; 2012; Biggio et al., 2013), and semi-supervised (Liu et al., 2020; Carlini, 2021) learning.”
- Poisoning Web-Scale Training Datasets is Practical (2023, background): “Recent work [14, 15] shows that arbitrarily poisoning only 0.”