Robust Anomaly Detection and Backdoor Attack Detection Via Differential Privacy

Abstract

Outlier detection and novelty detection are two important topics for anomaly detection. Suppose the majority of a dataset are drawn from a certain distribution, outlier detection and novelty detection both aim to detect data samples that do not fit the distribution. Outliers refer to data samples within this dataset, while novelties refer to new samples. In the meantime, backdoor poisoning attacks for machine learning models are achieved through injecting poisoning samples into the training dataset, which could be regarded as "outliers" that are intentionally added by attackers. Differential privacy has been proposed to avoid leaking any individual's information, when aggregated analysis is performed on a given dataset. It is typically achieved by adding random noise, either directly to the input dataset, or to intermediate results of the aggregation mechanism. In this paper, we demonstrate that applying differential privacy can improve the utility of outlier detection and novelty detection, with an extension to detect poisoning samples in backdoor attacks. We first present a theoretical analysis on how differential privacy helps with the detection, and then conduct extensive experiments to validate the effectiveness of differential privacy in improving outlier detection, novelty detection, and backdoor attack detection.

References in corpus (5)

• Scikit-learn: Machine Learning in Python
• BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chain
• Differential Privacy Has Disparate Impact on Model Accuracy
• A Zero-Positive Learning Approach for Diagnosing Software Performance Regressions
• Differentially Private Analysis of Outliers

Cited by in corpus (15)

• Backdoor Attacks and Countermeasures on Deep Learning: A Comprehensive Review
• You Autocomplete Me: Poisoning Vulnerabilities in Neural Code Completion
• Recent Advances of Differential Privacy in Centralized Deep Learning: A Systematic Survey
• Backdoor Scanning for Deep Neural Networks through K-Arm Optimization
• Adversarial Unlearning of Backdoors via Implicit Hypergradient
• DeepSweep: An Evaluation Framework for Mitigating DNN Backdoor Attacks using Data Augmentation
• Rethinking the Backdoor Attacks' Triggers: A Frequency Perspective
• Embedding and Extraction of Knowledge in Tree Ensemble Classifiers
• LMSanitator: Defending Prompt-Tuning Against Task-Agnostic Backdoors
• Removing Disparate Impact of Differentially Private Stochastic Gradient Descent on Model Accuracy
• FaceHack: Triggering backdoored facial recognition systems using facial characteristics
• Gradient Shaping: Enhancing Backdoor Attack Against Reverse Engineering
• Robustness Threats of Differential Privacy
• DeepPoison: Feature Transfer Based Stealthy Poisoning Attack
• A General Framework for Defending Against Backdoor Attacks via Influence Graph