Dataset Security for Machine Learning: Data Poisoning, Backdoor Attacks, and Defenses (2020-12-18T00:00:00.000000Z)

TL;DR

The goal of this work is to systematically categorize and discuss a wide range of dataset vulnerabilities and exploits, approaches for defending against these threats, and an array of open problems in this space.

Abstract

As machine learning systems grow in scale, so do their training data requirements, forcing practitioners to automate and outsource the curation of training data in order to achieve state-of-the-art performance. The absence of trustworthy human supervision over the data collection process exposes organizations to security vulnerabilities; training data can be manipulated to control and degrade the downstream behaviors of learned models. The goal of this work is to systematically categorize and discuss a wide range of dataset vulnerabilities and exploits, approaches for defending against these threats, and an array of open problems in this space.

Authors

Micah Goldblum

4 papers

Dimitris Tsipras

3 papers

Chulin Xie

1 papers

TL;DR

Abstract

Authors

References207 items

Generative Adversarial Networks

DP-InstaHide: Provably Defusing Poisoning and Backdoor Attacks with Differentially Private Data Augmentations

Preventing Unauthorized Use of Proprietary Data: Poisoning for Secure Dataset Release

LowKey: Leveraging Adversarial Attacks to Protect Social Media Users from Facial Recognition

Unlearnable Examples: Making Personal Data Unexploitable

FoggySight: A Scheme for Facial Lookup Privacy

Certified Robustness of Nearest Neighbors against Data Poisoning and Backdoor Attacks

Certified Robustness of Nearest Neighbors against Data Poisoning Attacks

Strong Data Augmentation Sanitizes Poisoning and Backdoor Attacks Without an Accuracy Tradeoff

BaFFLe: Backdoor Detection via Feedback-based Federated Learning

Mitigating Backdoor Attacks in Federated Learning

Customizing Triggers with Concealed Data Poisoning

VENOMAVE: Clean-Label Poisoning Against Speech Recognition

Poisoned classifiers are not only backdoored, they are fundamentally broken

GangSweep: Sweep out Neural Backdoors by GAN

BAAAN: Backdoor Attacks Against Autoencoder and GAN-Based Machine Learning Models

Witches' Brew: Industrial Scale Data Poisoning via Gradient Matching

One-pixel Signature: Characterizing CNN Models for Backdoor Detection

Removing Backdoor-Based Watermarks in Neural Networks with Limited Data

Trojaning Language Models for Fun and Profit

Practical Detection of Trojan Neural Networks: Data-Limited and Data-Free Cases

Data Poisoning Attacks against Differentially Private Recommender Systems

Backdoor Attacks and Countermeasures on Deep Learning: A Comprehensive Review

Backdoor Learning: A Survey

Data Poisoning Attacks Against Federated Learning Systems

Attack of the Tails: Yes, You Really Can Backdoor Federated Learning

Backdoor attacks and defenses in feature-partitioned collaborative learning

You Autocomplete Me: Poisoning Vulnerabilities in Neural Code Completion

TrojDRL: Evaluation of Backdoor Attacks on Deep Reinforcement Learning

Natural Backdoor Attack on Text Data

Deep Partition Aggregation: Provable Defense against General Poisoning Attacks

Influence Functions in Deep Learning Are Fragile

Subpopulation Data Poisoning Attacks

Just How Toxic is Data Poisoning? A Unified Benchmark for Backdoor and Data Poisoning Attacks

Graph Backdoor

FaceHack: Triggering backdoored facial recognition systems using facial characteristics

Backdoor Attacks to Graph Neural Networks

An Embarrassingly Simple Approach for Trojan Attack in Deep Neural Networks

Auditing Differentially Private Machine Learning: How Private is Private SGD?

Backdoor Attacks on Federated Meta-Learning

Backdoors in Neural Models of Source Code

BadNL: Backdoor Attacks Against NLP Models

Bullseye Polytope: A Scalable Clean-Label Poisoning Attack with Improved Transferability

DBA: Distributed Backdoor Attacks against Federated Learning

Data Poisoning Attacks on Federated Machine Learning

Poisoning Attacks on Algorithmic Fairness

MetaPoison: Practical General-purpose Clean-label Data Poisoning

Inverting Gradients - How easy is it to break privacy in federated learning?

RAB: Provable Robustness Against Backdoor Attacks

Face-Off: Adversarial Face Obfuscation

Stop-and-Go: Exploring Backdoor Attacks on Deep Reinforcement Learning-Based Traffic Congestion Control Systems

Threats to Federated Learning: A Survey

Exploring Backdoor Poisoning Attacks Against Malware Classifiers

On the Effectiveness of Mitigating Data Poisoning Attacks with Gradient Shaping

MaxUp: A Simple Way to Improve Generalization of Neural Network Training

Influence Function based Data Poisoning Attacks to Top-N Recommender Systems

Fawkes: Protecting Personal Privacy against Unauthorized Deep Learning Models

Certified Robustness to Label-Flipping Attacks via Randomized Smoothing

Learning to Detect Malicious Clients for Robust Federated Learning

Adversarial Machine Learning-Industry Perspectives

Backdoor Attacks Against Transfer Learning With Pre-Trained Deep Learning Models

Robust Aggregation for Federated Learning

Label-Consistent Backdoor Attacks

Understanding Distributed Poisoning Attack in Federated Learning

Targeted Poisoning Attacks on Social Recommender Systems

Local Model Poisoning Attacks to Byzantine-Robust Federated Learning

Can You Really Backdoor Federated Learning?

REFIT: A Unified Watermark Removal Framework For Deep Learning Systems With Limited Data

Recent Advances in Algorithmic High-Dimensional Robust Statistics

Latent Backdoor Attacks on Deep Neural Networks

Data Poisoning Attacks to Local Differential Privacy Protocols

Trojan Attack on Deep Generative Models in Autonomous Driving

A taxonomy and survey of attacks against machine learning

Detecting AI Trojans Using Meta Neural Analysis

Defending Neural Backdoors via Generative Distribution Modeling

Hidden Trigger Backdoor Attacks