 We consider a new class of \emph{data poisoning} attacks on neural networks, in which the attacker takes control of a model by making small perturbations to a subset of its training data.   We formulate the task of finding poisons as a bi-level optimization problem, which can be solved using methods borrowed from the meta-learning community.   Unlike previous poisoning strategies, the meta-poisoning can poison networks that are trained from scratch using an initialization unknown to the attacker and transfer across hyperparameters. Further we show that our attacks are more versatile: they can cause misclassification of the target image into an arbitrarily chosen class. Our results show above 50% attack success rate when poisoning just 3-10% of the training dataset. We have extended learning-to-learn techniques to adversarial poison example generation, or learning-to-craft. We devised a novel fast algorithm by which to solve the bi-level optimization inherent to poisoning, where the inner training of the network on the perturbed dataset must be performed for every crafting step. Our results, showing the first clean-label poisoning attack that works on networks trained from scratch, demonstrates the effectiveness of this method. Further our attacks are versatile, they have functionality such as the third-party attack which are not possible with previous methods. We hope that our work establishes a strong attack baseline for future work on clean-label data poisoning and also promote caution that these new methods of data poisoning are able to muster a strong attack on industrially-relevant architectures, that even transfers between training runs and hyperparameter choices.
Generate corrupted training images that are imperceptible yet change CNN behavior on a target during any new training.
{"src": "scitldr-AIC_train", "paper_id": "SyliaANtwH"}