MetaPoison: Practical General-purpose Clean-label Data Poisoning (2020-04-01T00:00:00.000000Z)

TL;DR

This work poses crafting poisons more generally as a bi-level optimization problem, where the inner level corresponds to training a network on a poisoned dataset and the outer level corresponding to updating those poisons to achieve a desired behavior on the trained model, and proposes MetaPoison, a first-order method to solve this optimization quickly.

Abstract

Data poisoning--the process by which an attacker takes control of a model by making imperceptible changes to a subset of the training data--is an emerging threat in the context of neural networks. Existing attacks for data poisoning have relied on hand-crafted heuristics. Instead, we pose crafting poisons more generally as a bi-level optimization problem, where the inner level corresponds to training a network on a poisoned dataset and the outer level corresponds to updating those poisons to achieve a desired behavior on the trained model. We then propose MetaPoison, a first-order method to solve this optimization quickly. MetaPoison is effective: it outperforms previous clean-label poisoning methods by a large margin under the same setting. MetaPoison is robust: its poisons transfer to a variety of victims with unknown hyperparameters and architectures. MetaPoison is also general-purpose, working not only in fine-tuning scenarios, but also for end-to-end training from scratch with remarkable success, e.g. causing a target image to be misclassified 90% of the time via manipulating just 1% of the dataset. Additionally, MetaPoison can achieve arbitrary adversary goals not previously possible--like using poisons of one class to make a target image don the label of another arbitrarily chosen class. Finally, MetaPoison works in the real-world. We demonstrate successful data poisoning of models trained on Google Cloud AutoML Vision. Code and premade poisons are provided at this https URL

Authors

T. Goldstein

9 papers

Jonas Geiping

2 papers

W. R. Huang

2 papers

TL;DR

Abstract

Authors

References40 items

Breaking certified defenses: Semantic adversarial examples with spoofed robustness certificates

Fawkes: Protecting Personal Privacy against Unauthorized Deep Learning Models

Radioactive data: tracing through training

Hidden Trigger Backdoor Attacks

Deep k-NN Defense Against Clean-Label Data Poisoning Attacks

Functional Adversarial Attacks

Transferable Clean-Label Poisoning Attacks on Deep Neural Nets

The Impact of Neural Network Overparameterization on Gradient Confusion and Stochastic Gradient Descent

Wasserstein Adversarial Examples via Projected Sinkhorn Iterations

Truncated Back-propagation for Bilevel Optimization

Can Adversarially Robust Learning Leverage Computational Hardness?

Clean-Label Backdoor Attacks

Why Do Adversarial Attacks Transfer? Explaining Transferability of Evasion and Poisoning Attacks

DARTS: Differentiable Architecture Search

Bilevel Programming for Hyperparameter Optimization and Meta-Learning

Poison Frogs! Targeted Clean-Label Poisoning Attacks on Neural Networks

Manipulating Machine Learning: Poisoning Attacks and Countermeasures for Regression Learning

Deep k-Nearest Neighbors: Towards Confident, Interpretable and Robust Deep Learning

Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples

Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoning

Exploring the Landscape of Spatial Robustness

Interpretability Beyond Feature Attribution: Quantitative Testing with Concept Activation Vectors (TCAV)

Towards Poisoning of Deep Learning Algorithms with Back-gradient Optimization

Towards Deep Learning Models Resistant to Adversarial Attacks

Certified Defenses for Data Poisoning Attacks

Analysis of Causative Attacks against SVMs Learning from Data Streams

Understanding Black-box Predictions via Influence Functions

Model-Agnostic Meta-Learning for Fast Adaptation of Deep Networks

Towards Evaluating the Robustness of Neural Networks

Gradient-based Hyperparameter Optimization through Reversible Learning

Using Machine Teaching to Identify Optimal Training-Set Attacks on Machine Learners

Intriguing properties of neural networks

Poisoning Attacks against Support Vector Machines

Generic Methods for Optimization-Based Modeling

Bilevel Optimization and Machine Learning

Practical Bilevel Optimization: Algorithms and Applications

MetaPoison: Practical General-purpose Clean-label Data Poisoning

Trojaning Attack on Neural Networks

TCAV: R ELATIVE CONCEPT IMPORTANCE TESTING WITH L INEAR C ONCEPT A CTIVATION V ECTORS

Attacks against machine learning an overview

Field of Study

Journal Information

Name

Volume

Venue Information

Name

Type

URL

Alternate Names