Generative Poisoning Attack Method Against Neural Networks

Abstract

Poisoning attack is identified as a severe security threat to machine learning algorithms. In many applications, for example, deep neural network (DNN) models collect public data as the inputs to perform re-training, where the input data can be poisoned. Although poisoning attack against support vector machines (SVM) has been extensively studied before, there is still very limited knowledge about how such attack can be implemented on neural networks (NN), especially DNNs. In this work, we first examine the possibility of applying traditional gradient-based method (named as the direct gradient method) to generate poisoned data against NNs by leveraging the gradient of the target model w.r.t. the normal data. We then propose a generative method to accelerate the generation rate of the poisoned data: an auto-encoder (generator) used to generate poisoned data is updated by a reward function of the loss, and the target NN model (discriminator) receives the poisoned data to calculate the loss w.r.t. the normal data. Our experiment results show that the generative method can speed up the poisoned data generation rate by up to 239.38x compared with the direct gradient method, with slightly lower model accuracy degradation. A countermeasure is also designed to detect such poisoning attack methods by checking the loss of the target model.

References in corpus (2)

• MXNet: A Flexible and Efficient Machine Learning Library for Heterogeneous Distributed Systems
• An Analysis of Deep Neural Network Models for Practical Applications

Cited by in corpus (37)

• Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoning
• Detecting Backdoor Attacks on Deep Neural Networks by Activation Clustering
• Wild Patterns Reloaded: A Survey of Machine Learning Security against Training Data Poisoning
• Adversarial Attacks Against Deep Generative Models on Data: A Survey
• Evaluating Differentially Private Machine Learning in Practice
• Certified Defenses for Data Poisoning Attacks
• Adversarial Samples on Android Malware Detection Systems for IoT Systems
• You Autocomplete Me: Poisoning Vulnerabilities in Neural Code Completion
• Security and Privacy Issues in Deep Learning
• Data Poisoning Attacks Against Federated Learning Systems
• Fawkes: Protecting Privacy against Unauthorized Deep Learning Models
• RAB: Provable Robustness Against Backdoor Attacks
• Poisoning Attacks with Generative Adversarial Nets
• Unlearnable Examples: Making Personal Data Unexploitable
• Certified Robustness to Label-Flipping Attacks via Randomized Smoothing
• A backdoor attack against LSTM-based text classification systems
• Review and Critical Analysis of Privacy-preserving Infection Tracking and Contact Tracing
• Vulnerability-Aware Poisoning Mechanism for Online RL with Unknown Dynamics
• Security and Privacy for Artificial Intelligence: Opportunities and Challenges
• Hidden Killer: Invisible Textual Backdoor Attacks with Syntactic Trigger
• VerIDeep: Verifying Integrity of Deep Neural Networks through Sensitive-Sample Fingerprinting
• SPECTRE: Defending Against Backdoor Attacks Using Robust Statistics
• Robust or Private? Adversarial Training Makes Models More Vulnerable to Privacy Attacks
• Model-Targeted Poisoning Attacks with Provable Convergence
• Revealing Perceptible Backdoors, without the Training Set, via the Maximum Achievable Misclassification Fraction Statistic
• Bias Field Poses a Threat to DNN-based X-Ray Recognition
• Defending against GAN-based Deepfake Attacks via Transformation-aware Adversarial Faces
• Picket: Guarding Against Corrupted Data in Tabular Data during Learning and Inference
• Reconstruction and Membership Inference Attacks against Generative Models
• Blackbox Trojanising of Deep Learning Models : Using non-intrusive network structure and binary alterations
• Technical Report: When Does Machine Learning FAIL? Generalized Transferability for Evasion and Poisoning Attacks
• Being Single Has Benefits. Instance Poisoning to Deceive Malware Classifiers
• Generative Models for Security: Attacks, Defenses, and Opportunities
• De-Pois: An Attack-Agnostic Defense against Data Poisoning Attacks
• PoisHygiene: Detecting and Mitigating Poisoning Attacks in Neural Networks
• Poisoning Online Learning Filters: DDoS Attacks and Countermeasures
• Poisoning the Search Space in Neural Architecture Search