Transferable Clean-Label Poisoning Attacks on Deep Neural Nets

By Chen Zhu, W. Ronny Huang, Ali Shafahi, Hengduo Li, Gavin Taylor, Christoph Studer, Tom Goldstein, Ronny Huang. International Conference on Machine Learning, 2019

327 citations recorded by the source corpus.

Clean-label poisoning attacks inject innocuous looking (and "correctly" labeled) poison images into training data, causing a model to misclassify a targeted image after being trained on this data. We consider transferable poisoning attacks that succeed without access to the victim network's outputs, architecture, or (in some cases) training data. To achieve this, we propose a new "polytope attack" in which poison images are designed to surround the targeted image in feature space. We also demonstrate that using Dropout during poison creation helps to enhance transferability of this attack. We achieve transferable attack success rates of over 50% while poisoning only 1% of the training set.

Subfields: Artificial Intelligence

View Paper: https://www.semanticscholar.org/paper/d9c14b1a705a3ac55e346a921189ef0fd2292fcb

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

Citations in the corpus

On the security relevance of weights in deep learning. (2020, background): “Due to the flexibility of the models, these attacks are currently limited to the misclassification of individual points [41] or the introduction of backdoors [24, 33, 36].”
LIRA: Learnable, Imperceptible and Robust Backdoor Attacks (2021, background): “Among these attacks, evasion attacks such as adversarial examples [7, 34] attempt to fool a trained model by manipulating the inputs in the inference phase, while causative attacks including poisoning [35, 43, 58] and backdoor attacks [32, 30, 10, 20] seek to maliciously alter the model in the train”
Data collection and quality challenges in deep learning: a data-centric AI perspective (2021, background): “Recently, data poisoning techniques have become much more sophisticated and therefore harder to defend against [143,187].”
Understanding Generalization through Visualizations (2019, unknown): “, we see that over-parameterization causes both models to achieve perfect accuracy on training data.”
MetaPoison: Practical General-purpose Clean-label Data Poisoning (2020, methodology): “This is because existing feature collision-based poisoning (Shafahi et al., 2018; Zhu et al., 2019) requires a pre-existing feature extractor on which to craft a feature collision.”
Data Poisoning Attacks Against Federated Learning Systems (2020, methodology): “Several poisoning attacks were developed for popular ML models including SVM [6,12,44,45,50,52], regression [19], dimensionality reduction [51], linear classifiers [12,23,57], unsupervised learning [7], and more recently, neural networks [12,30,42,45,53,58].”
Anti-Backdoor Learning: Training Clean Models on Poisoned Data (2021, background): “Backdoor attacks can be further divided into two categories: dirty-label attacks [1, 11, 12] and clean-label attacks [20–22, 17, 16].”
Dataset Security for Machine Learning: Data Poisoning, Backdoor Attacks, and Defenses (2020, unknown): “Model poisoning (12), (45), (107) Generative models (114), (170), (176) Vanishing gradients (135) Label flipping (13), (20), (49), (148), (178), (182) Influence functions (46), (79), (80) p-Tampering (104), (105), (106), (107) Bilevel optimization (14), (18), (55), (63), (65), (68), (88), (103), (10”
On the Effectiveness of Mitigating Data Poisoning Attacks with Gradient Shaping (2020, background): “d the magnitude ratio is high. We specify this intuition in the columns 12-13. 4.2Targeted Poisoning Attacks Overview of Existing Work: The bottom half of Table1 shows the targeted attacks. Most work [39,42,50], except [8], performed targeted attacks on large capacity models such as deep neural netw”
A Comprehensive Survey on Poisoning Attacks and Countermeasures in Machine Learning (2022, methodology): “[160] proposed a transferable clean-label poisoning attack.”
Hidden Trigger Backdoor Attacks (2019, background): “(Suciu et al. 2018; Zhu et al. 2019) studied generalization and transferability of the poisoning attacks.”