Are You Tampering With My Data?

Abstract

We propose a novel approach towards adversarial attacks on neural networks (NN), focusing on tampering the data used for training instead of generating attacks on trained models. Our network-agnostic method creates a backdoor during training which can be exploited at test time to force a neural network to exhibit abnormal behaviour. We demonstrate on two widely used datasets (CIFAR-10 and SVHN) that a universal modification of just one pixel per image for all the images of a class in the training set is enough to corrupt the training procedure of several state-of-the-art deep neural networks causing the networks to misclassify any images to which the modification is applied. Our aim is to bring to the attention of the machine learning community, the possibility that even learning-based methods that are personally trained on public datasets can be subject to attacks by a skillful adversary.

arXiv comment18 pages

References in corpus (16)

• Very Deep Convolutional Networks for Large-Scale Image Recognition
• Ensemble Adversarial Training: Attacks and Defenses
• Understanding Black-box Predictions via Influence Functions
• Poisoning Attacks against Support Vector Machines
• Robust Physical-World Attacks on Deep Learning Models
• Adversarial Examples Are Not Easily Detected: Bypassing Ten Detection Methods
• Is feature selection secure against training data poisoning?
• Why do deep convolutional networks generalize so poorly to small image transformations?
• Tactics of Adversarial Attack on Deep Reinforcement Learning Agents
• Certified Defenses for Data Poisoning Attacks
• Ensemble Methods as a Defense to Adversarial Perturbations Against Deep Neural Networks
• A Testbed for Cross-Dataset Analysis
• Learning Deep Networks from Noisy Labels with Dropout Regularization
• PeerNets: Exploiting Peer Wisdom Against Adversarial Attacks
• Laplacian Networks: Bounding Indicator Function Smoothness for Neural Network Robustness
• Towards an Understanding of Neural Networks in Natural-Image Spaces