Enhancing the Antidote: Improved Pointwise Certifications against Poisoning Attacks

Abstract

Poisoning attacks can disproportionately influence model behaviour by making small changes to the training corpus. While defences against specific poisoning attacks do exist, they in general do not provide any guarantees, leaving them potentially countered by novel attacks. In contrast, by examining worst-case behaviours Certified Defences make it possible to provide guarantees of the robustness of a sample against adversarial attacks modifying a finite number of training samples, known as pointwise certification. We achieve this by exploiting both Differential Privacy and the Sampled Gaussian Mechanism to ensure the invariance of prediction for each testing instance against finite numbers of poisoned examples. In doing so, our model provides guarantees of adversarial robustness that are more than twice as large as those provided by prior certifications.

References in corpus (17)

• Deep Learning with Differential Privacy
• Renyi Differential Privacy
• Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoning
• Poisoning Attacks against Support Vector Machines
• Adversarial Attacks and Defences: A Survey
• Security Evaluation of Pattern Classifiers under Attack
• Empirical Bernstein Bounds and Sample Variance Penalization
• Privacy Amplification by Subsampling: Tight Analyses via Couplings and Divergences
• Detection of Adversarial Training Examples in Poisoning Attacks through Anomaly Detection
• Rényi Differential Privacy of the Sampled Gaussian Mechanism
• On the Effectiveness of Mitigating Data Poisoning Attacks with Gradient Shaping
• On Certifying Robustness against Backdoor Attacks via Randomized Smoothing
• Data Poisoning against Differentially-Private Learners: Attacks and Defenses
• Hypothesis Testing Interpretations and Renyi Differential Privacy
• Certified Robustness to Label-Flipping Attacks via Randomized Smoothing
• Regularisation Can Mitigate Poisoning Attacks: A Novel Analysis Based on Multiobjective Bilevel Optimisation
• A Framework of Randomized Selection Based Certified Defenses Against Data Poisoning Attacks