Transferable Clean-Label Poisoning Attacks on Deep Neural Nets

Abstract

Clean-label poisoning attacks inject innocuous looking (and "correctly" labeled) poison images into training data, causing a model to misclassify a targeted image after being trained on this data. We consider transferable poisoning attacks that succeed without access to the victim network's outputs, architecture, or (in some cases) training data. To achieve this, we propose a new "polytope attack" in which poison images are designed to surround the targeted image in feature space. We also demonstrate that using Dropout during poison creation helps to enhance transferability of this attack. We achieve transferable attack success rates of over 50% while poisoning only 1% of the training set.

Accepted to ICML2019

References in corpus (8)

• Adam: A Method for Stochastic Optimization
• Understanding deep learning requires rethinking generalization
• Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoning
• Delving into Transferable Adversarial Examples and Black-box Attacks
• The Space of Transferable Adversarial Examples
• WebVision Database: Visual Learning and Understanding from Web Data
• A Field Guide to Forward-Backward Splitting with a FASTA Implementation
• Learning under $p$-Tampering Attacks

Cited by in corpus (32)

• Backdoor Attacks and Countermeasures on Deep Learning: A Comprehensive Review
• MetaPoison: Practical General-purpose Clean-label Data Poisoning
• Backdoor Pre-trained Models Can Transfer to All
• On the Effectiveness of Mitigating Data Poisoning Attacks with Gradient Shaping
• Security and Privacy Issues in Deep Learning
• Just How Toxic is Data Poisoning? A Unified Benchmark for Backdoor and Data Poisoning Attacks
• Data Poisoning Attacks Against Federated Learning Systems
• Fawkes: Protecting Privacy against Unauthorized Deep Learning Models
• Backdoor Scanning for Deep Neural Networks through K-Arm Optimization
• A Master Key Backdoor for Universal Impersonation Attack against DNN-based Face Verification
• Understanding Generalization through Visualizations
• Practical Detection of Trojan Neural Networks: Data-Limited and Data-Free Cases
• TrojanZoo: Towards Unified, Holistic, and Practical Evaluation of Neural Backdoors
• Certified Robustness to Label-Flipping Attacks via Randomized Smoothing
• DP-InstaHide: Provably Defusing Poisoning and Backdoor Attacks with Differentially Private Data Augmentations
• Light Can Hack Your Face! Black-box Backdoor Attack on Face Recognition Systems
• SoK: Machine Learning Governance
• Backdoor Attacks on Crowd Counting
• Sleeper Agent: Scalable Hidden Trigger Backdoors for Neural Networks Trained from Scratch
• EX-RAY: Distinguishing Injected Backdoor from Natural Features in Neural Networks by Examining Differential Feature Symmetry
• Better Safe Than Sorry: Preventing Delusive Adversaries with Adversarial Training
• Model-Targeted Poisoning Attacks with Provable Convergence
• Understanding the Limits of Unsupervised Domain Adaptation via Data Poisoning
• Bait and Switch: Online Training Data Poisoning of Autonomous Driving Systems
• Active Learning Under Malicious Mislabeling and Poisoning Attacks
• Disrupting Model Training with Adversarial Shortcuts
• Regularization Can Help Mitigate Poisoning Attacks... with the Right Hyperparameters
• An Evasion Attack against Stacked Capsule Autoencoder
• De-Pois: An Attack-Agnostic Defense against Data Poisoning Attacks
• 10 Security and Privacy Problems in Large Foundation Models
• Widen The Backdoor To Let More Attackers In
• Accumulative Poisoning Attacks on Real-time Data