MetaPoison: Practical General-purpose Clean-label Data Poisoning
MetaPoison: Practical General-purpose Clean-label Data Poisoning
复制标题
DOI：
--
复制
发表时间：
2020-04
期刊：
影响因子：
--
通讯作者：
W. R. Huang;Jonas Geiping;Liam H. Fowl;Gavin Taylor;T. Goldstein
中科院分区：
文献类型：
--
作者：
W. R. Huang;Jonas Geiping;Liam H. Fowl;Gavin Taylor;T. Goldstein
数据中毒——攻击者通过对训练数据的一个子集进行难以察觉的改变来控制模型的过程——是神经网络背景下的一个新兴威胁。现有的数据中毒攻击依赖于手工设计的启发式方法。相反，我们更普遍地将制作毒药作为一个双级优化问题，其中内部级别对应于在中毒数据集上训练网络，外部级别对应于更新这些毒药以实现训练模型上的期望行为。然后，我们提出了一种一阶方法MetaPoison来快速解决这个优化问题。MetaPoison是有效的：在相同的环境下，它比以前的清洁标签中毒方法要好得多。MetaPoison是鲁棒的：它的毒物转移到具有未知超参数和结构的各种受害者。MetaPoison也是通用的，不仅在微调场景中工作，而且在从头开始的端到端训练中也取得了显著的成功，例如，通过操作1%的数据集，导致目标图像在90%的时间内被错误分类。此外，MetaPoison可以实现以前不可能实现的任意对手目标——比如使用一个类的毒药使目标图像在另一个任意选择的类的标签上。最后，MetaPoison在现实世界中工作。我们展示了在谷歌Cloud AutoML Vision上训练的模型的成功数据中毒。代码和预先制作的毒药在此https URL提供
Data poisoning--the process by which an attacker takes control of a model by making imperceptible changes to a subset of the training data--is an emerging threat in the context of neural networks. Existing attacks for data poisoning have relied on hand-crafted heuristics. Instead, we pose crafting poisons more generally as a bi-level optimization problem, where the inner level corresponds to training a network on a poisoned dataset and the outer level corresponds to updating those poisons to achieve a desired behavior on the trained model. We then propose MetaPoison, a first-order method to solve this optimization quickly. MetaPoison is effective: it outperforms previous clean-label poisoning methods by a large margin under the same setting. MetaPoison is robust: its poisons transfer to a variety of victims with unknown hyperparameters and architectures. MetaPoison is also general-purpose, working not only in fine-tuning scenarios, but also for end-to-end training from scratch with remarkable success, e.g. causing a target image to be misclassified 90% of the time via manipulating just 1% of the dataset. Additionally, MetaPoison can achieve arbitrary adversary goals not previously possible--like using poisons of one class to make a target image don the label of another arbitrarily chosen class. Finally, MetaPoison works in the real-world. We demonstrate successful data poisoning of models trained on Google Cloud AutoML Vision. Code and premade poisons are provided at this https URL