DP-InstaHide: Provably Defusing Poisoning and Backdoor Attacks with Differentially Private Data Augmentations

Abstract

Data poisoning and backdoor attacks manipulate training data to induce security breaches in a victim model. These attacks can be provably deflected using differentially private (DP) training methods, although this comes with a sharp decrease in model performance. The InstaHide method has recently been proposed as an alternative to DP training that leverages supposed privacy properties of the mixup augmentation, although without rigorous guarantees. In this work, we show that strong data augmentations, such as mixup and random additive noise, nullify poison attacks while enduring only a small accuracy trade-off. To explain these finding, we propose a training method, DP-InstaHide, which combines the mixup regularizer with additive noise. A rigorous analysis of DP-InstaHide shows that mixup does indeed have privacy advantages, and that training with k-way mixup provably yields at least k times stronger DP guarantees than a naive DP mechanism. Because mixup (as opposed to noise) is beneficial to model performance, DP-InstaHide provides a mechanism for achieving stronger empirical performance against poisoning attacks than other known DP methods.

11 pages, 5 figures

References in corpus (20)

• mixup: Beyond Empirical Risk Minimization
• Improved Regularization of Convolutional Neural Networks with Cutout
• Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoning
• BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chain
• Spectral Signatures in Backdoor Attacks
• Is feature selection secure against training data poisoning?
• How To Break Anonymity of the Netflix Prize Dataset
• Detecting Backdoor Attacks on Deep Neural Networks by Activation Clustering
• Transferable Clean-Label Poisoning Attacks on Deep Neural Nets
• Stronger Data Poisoning Attacks Break Data Sanitization Defenses
• Subsampled Rényi Differential Privacy and Analytical Moments Accountant
• MetaPoison: Practical General-purpose Clean-label Data Poisoning
• Just How Toxic is Data Poisoning? A Unified Benchmark for Backdoor and Data Poisoning Attacks
• RAB: Provable Robustness Against Backdoor Attacks
• Witches' Brew: Industrial Scale Data Poisoning via Gradient Matching
• MaxUp: A Simple Way to Improve Generalization of Neural Network Training
• Data Poisoning against Differentially-Private Learners: Attacks and Defenses
• How Does Mixup Help With Robustness and Generalization?
• Deep Partition Aggregation: Provable Defense against General Poisoning Attacks
• Is Private Learning Possible with Instance Encoding?

Cited by in corpus (5)

• Wild Patterns Reloaded: A Survey of Machine Learning Security against Training Data Poisoning
• Adversarial Examples Make Strong Poisons
• Sleeper Agent: Scalable Hidden Trigger Backdoors for Neural Networks Trained from Scratch
• AirMixML: Over-the-Air Data Mixup for Inherently Privacy-Preserving Edge Machine Learning
• Accumulative Poisoning Attacks on Real-time Data