论文标题
更快地学习的毒物更有效
Poisons that are learned faster are more effective
论文作者
论文摘要
最近，对整个数据集的中毒攻击不可察觉，作为保护数据隐私的方法。但是，在防止实际使用这些技术的许多防御措施中，早期停滞不前是一种简单而有效的防御。为了衡量毒药的脆弱性，我们以100个时期的峰值测试准确性来实现误差限制，误差 - 最大化和合成的毒物，并做出许多令人惊讶的观察结果。首先，我们发现更快地达到低训练损失的毒物具有较低的峰值测试准确性。其次，我们发现，当毒药训练在8时期停止时，当前的最新错误最大毒药的效果降低了7倍。第三，我们发现更强，更可转移的对抗性攻击并不能使毒药更强。我们主张根据峰值测试准确性评估毒物。
Imperceptible poisoning attacks on entire datasets have recently been touted as methods for protecting data privacy. However, among a number of defenses preventing the practical use of these techniques, early-stopping stands out as a simple, yet effective defense. To gauge poisons' vulnerability to early-stopping, we benchmark error-minimizing, error-maximizing, and synthetic poisons in terms of peak test accuracy over 100 epochs and make a number of surprising observations. First, we find that poisons that reach a low training loss faster have lower peak test accuracy. Second, we find that a current state-of-the-art error-maximizing poison is 7 times less effective when poison training is stopped at epoch 8. Third, we find that stronger, more transferable adversarial attacks do not make stronger poisons. We advocate for evaluating poisons in terms of peak test accuracy.
