MetaPoison: Practical General-purpose Clean-label Data Poisoning

Abstract

Data poisoning -- the process by which an attacker takes control of a model by making imperceptible changes to a subset of the training data -- is an emerging threat in the context of neural networks. Existing attacks for data poisoning neural networks have relied on hand-crafted heuristics, because solving the poisoning problem directly via bilevel optimization is generally thought of as intractable for deep models. We propose MetaPoison, a first-order method that approximates the bilevel problem via meta-learning and crafts poisons that fool neural networks. MetaPoison is effective: it outperforms previous clean-label poisoning methods by a large margin. MetaPoison is robust: poisoned data made for one model transfer to a variety of victim models with unknown training settings and architectures. MetaPoison is general-purpose, it works not only in fine-tuning scenarios, but also for end-to-end training from scratch, which till now hasn't been feasible for clean-label attacks with deep nets. MetaPoison can achieve arbitrary adversary goals -- like using poisons of one class to make a target image don the label of another arbitrarily chosen class. Finally, MetaPoison works in the real-world. We demonstrate for the first time successful data poisoning of models trained on the black-box Google Cloud AutoML API. Code and premade poisons are provided at https://github.com/wronnyhuang/metapoison

arXiv commentConference paper at NeurIPS 2020. First two authors contributed equally

References in corpus (15)

• Model-Agnostic Meta-Learning for Fast Adaptation of Deep Networks
• Understanding Black-box Predictions via Influence Functions
• Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples
• Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoning
• Poisoning Attacks against Support Vector Machines
• Interpretability Beyond Feature Attribution: Quantitative Testing with Concept Activation Vectors (TCAV)
• Deep k-Nearest Neighbors: Towards Confident, Interpretable and Robust Deep Learning
• Exploring the Landscape of Spatial Robustness
• Transferable Clean-Label Poisoning Attacks on Deep Neural Nets
• MetaPoison: Practical General-purpose Clean-label Data Poisoning
• Functional Adversarial Attacks
• Wasserstein Adversarial Examples via Projected Sinkhorn Iterations
• Radioactive data: tracing through training
• The Impact of Neural Network Overparameterization on Gradient Confusion and Stochastic Gradient Descent
• Breaking certified defenses: Semantic adversarial examples with spoofed robustness certificates

Cited by in corpus (22)

• Ditto: Fair and Robust Federated Learning Through Personalization
• Backdoor Attacks and Countermeasures on Deep Learning: A Comprehensive Review
• MetaPoison: Practical General-purpose Clean-label Data Poisoning
• Just How Toxic is Data Poisoning? A Unified Benchmark for Backdoor and Data Poisoning Attacks
• Witches' Brew: Industrial Scale Data Poisoning via Gradient Matching
• Machine Learning Security against Data Poisoning: Are We There Yet?
• Adversarial Examples Make Strong Poisons
• DP-InstaHide: Provably Defusing Poisoning and Backdoor Attacks with Differentially Private Data Augmentations
• Defending Against Backdoor Attacks in Natural Language Generation
• Preventing Unauthorized Use of Proprietary Data: Poisoning for Secure Dataset Release
• Sleeper Agent: Scalable Hidden Trigger Backdoors for Neural Networks Trained from Scratch
• Model-Targeted Poisoning Attacks with Provable Convergence
• Better Safe Than Sorry: Preventing Delusive Adversaries with Adversarial Training
• RoCourseNet: Distributionally Robust Training of a Prediction Aware Recourse Model
• Understanding the Limits of Unsupervised Domain Adaptation via Data Poisoning
• Can Pretrained Language Models Derive Correct Semantics from Corrupt Subwords under Noise?
• Make Text Unlearnable: Exploiting Effective Patterns to Protect Personal Data
• Regularization Can Help Mitigate Poisoning Attacks... with the Right Hyperparameters
• Disrupting Model Training with Adversarial Shortcuts
• Going Grayscale: The Road to Understanding and Improving Unlearnable Examples
• A Framework of Randomized Selection Based Certified Defenses Against Data Poisoning Attacks
• 10 Security and Privacy Problems in Large Foundation Models