Autoregressive Perturbations for Data Poisoning
Autoregressive Perturbations for Data Poisoning
复制标题
DOI：
10.48550/arxiv.2206.03693
复制
发表时间：
2022-06
期刊：
影响因子：
--
通讯作者：
Pedro Sandoval-Segura;Vasu Singla;Jonas Geiping;Micah Goldblum;T. Goldstein;David Jacobs
中科院分区：
文献类型：
--
作者：
Pedro Sandoval-Segura;Vasu Singla;Jonas Geiping;Micah Goldblum;T. Goldstein;David Jacobs
从社交媒体上抓取数据作为获取数据集的一种手段的流行，导致人们越来越担心未经授权使用数据。数据中毒攻击已经被提出作为对抗抓取的堡垒，因为它们通过添加小的、不可感知的扰动使数据“不可学习“。不幸的是，现有的方法需要目标体系结构和完整的数据集的知识，以便可以训练代理网络，其参数用于生成攻击。在这项工作中，我们介绍了自回归（AR）中毒，一种可以生成中毒数据而无需访问更广泛的数据集的方法。所提出的AR扰动是通用的，可以应用于不同的数据集，并且可以毒害不同的架构。与现有的不可学习方法相比，我们的AR毒药对对抗性训练和强大的数据增强等常见防御更具抵抗力。我们的分析进一步深入了解了什么是有效的数据毒药。
The prevalence of data scraping from social media as a means to obtain datasets has led to growing concerns regarding unauthorized use of data. Data poisoning attacks have been proposed as a bulwark against scraping, as they make data"unlearnable"by adding small, imperceptible perturbations. Unfortunately, existing methods require knowledge of both the target architecture and the complete dataset so that a surrogate network can be trained, the parameters of which are used to generate the attack. In this work, we introduce autoregressive (AR) poisoning, a method that can generate poisoned data without access to the broader dataset. The proposed AR perturbations are generic, can be applied across different datasets, and can poison different architectures. Compared to existing unlearnable methods, our AR poisons are more resistant against common defenses such as adversarial training and strong data augmentations. Our analysis further provides insight into what makes an effective data poison.