论文标题
对神经网络的数据中毒攻击
Indiscriminate Data Poisoning Attacks on Neural Networks
论文作者
论文摘要
数据中毒攻击是恶意的对手旨在通过将“中毒”数据注入训练过程中的模型，引起了最近的关注。在这项工作中，我们仔细研究了现有的中毒攻击，并将它们与解决顺序Stackelberg游戏的新算法联系起来。通过为攻击者选择适当的损失功能，并使用利用二阶信息的算法进行优化，我们设计了对神经网络有效的中毒攻击。我们提出了有效的实施，可以利用现代自动差异套件，并允许同时且协调一致的成千上万的中毒点，与现有的方法一一产生中毒点相比。我们进一步进行广泛的实验，从经验探索数据中毒攻击对深神经网络的影响。
Data poisoning attacks, in which a malicious adversary aims to influence a model by injecting "poisoned" data into the training process, have attracted significant recent attention. In this work, we take a closer look at existing poisoning attacks and connect them with old and new algorithms for solving sequential Stackelberg games. By choosing an appropriate loss function for the attacker and optimizing with algorithms that exploit second-order information, we design poisoning attacks that are effective on neural networks. We present efficient implementations that exploit modern auto-differentiation packages and allow simultaneous and coordinated generation of tens of thousands of poisoned points, in contrast to existing methods that generate poisoned points one by one. We further perform extensive experiments that empirically explore the effect of data poisoning attacks on deep neural networks.
