Adversarial Examples Make Strong Poisons
arXiv:2106.10807
Abstract
The adversarial machine learning literature is largely partitioned into evasion attacks on testing data and poisoning attacks on training data. In this work, we show that adversarial examples, originally intended for attacking pre-trained models, are even more effective for data poisoning than recent methods designed specifically for poisoning. Our findings indicate that adversarial examples, when assigned the original label of their natural base image, cannot be used to train a classifier for natural images. Furthermore, when adversarial examples are assigned their adversarial class label, they are useful for training. This suggests that adversarial examples contain useful semantic content, just with the ``wrong'' labels (according to a network, but not a human). Our method, adversarial poisoning, is substantially more effective than existing poisoning methods for secure dataset release, and we release a poisoned version of ImageNet, ImageNet-P, to encourage research into the strength of this form of data obfuscation.
References in corpus (26)
- Very Deep Convolutional Networks for Large-Scale Image Recognition
- Explaining and Harnessing Adversarial Examples
- Deep Learning with Differential Privacy
- Language Models are Few-Shot Learners
- Densely Connected Convolutional Networks
- Learning Face Representation from Scratch
- Towards Deep Learning Models Resistant to Adversarial Attacks
- Understanding Black-box Predictions via Influence Functions
- Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoning
- Towards Federated Learning at Scale: System Design
- AutoAugment: Learning Augmentation Policies from Data
- Generating Natural Adversarial Examples
- Adversarial Examples Are Not Bugs, They Are Features
- Is feature selection secure against training data poisoning?
- Stronger Data Poisoning Attacks Break Data Sanitization Defenses
- MetaPoison: Practical General-purpose Clean-label Data Poisoning
- Zero-Shot Knowledge Distillation in Deep Networks
- On the Effectiveness of Mitigating Data Poisoning Attacks with Gradient Shaping
- An Alternative Surrogate Loss for PGD-based Adversarial Testing
- Unlearnable Examples: Making Personal Data Unexploitable
- On the Geometry of Adversarial Examples
- Witches' Brew: Industrial Scale Data Poisoning via Gradient Matching
- LowKey: Leveraging Adversarial Attacks to Protect Social Media Users from Facial Recognition
- DP-InstaHide: Provably Defusing Poisoning and Backdoor Attacks with Differentially Private Data Augmentations
- Influence Functions in Deep Learning Are Fragile
- Preventing Unauthorized Use of Proprietary Data: Poisoning for Secure Dataset Release