Availability Attacks Create Shortcuts

Abstract

Indiscriminate data poisoning attacks, which add imperceptible perturbations to training data to maximize the test error of trained models, have become a trendy topic because they are thought to be capable of preventing unauthorized use of data. In this work, we investigate why these perturbations work in principle. We find that the perturbations of advanced poisoning attacks are almost linear separable when assigned with the target labels of the corresponding samples, which hence can work as shortcuts for the learning objective. This important population property has not been unveiled before. Moreover, we further verify that linear separability is indeed the workhorse for poisoning attacks. We synthesize linear separable data as perturbations and show that such synthetic perturbations are as powerful as the deliberately crafted attacks. Our finding suggests that the shortcut learning problem is more serious than previously believed as deep learning heavily relies on shortcuts even if they are of an imperceptible scale and mixed together with the normal features. This finding also suggests that pre-trained feature extractors would disable these poisoning attacks effectively.

Indiscriminate Poisoning Attacks on Unsupervised Contrastive Learning

“…Prior work has observed that the noise that poisons supervised learning tends to cluster according to the original class labels, and is linearly separable (Yu et al, 2021). We apply the same test on noise for attacking SimCLR and find the noise is not linearly separable.…”

“…We first show that indiscriminate poisoning attacks on supervised learning do not work well in the face of contrastive learning. Indiscriminate poisoning attacks against supervised learning tend to generate poisoning perturbations that are clustered according to the original class labels (Yu et al, 2021). Such a design is unlikely to be effective against contrastive learning since its representation learning does not involve any class labels.…”

Can Adversarial Training Be Manipulated By Non-Robust Features?

“…Yu et al [75] suggest explaining the success of availability attacks from the perspective of shortcuts. They further adopt pre-trained models to extract useful features for mitigating model reliance on the shortcuts.…”

Indiscriminate Data Poisoning Attacks on Neural Networks

“…Note that we consider the effectiveness of adding a small portion of poisoned data to D tr in this paper. While some other works (e.g., Huang et al (2021); Yu et al (2021); Fowl et al (2021)) consider a different problem: the attacker can directly modify up to the entire D tr . In practice, manipulating the existing D tr is not always feasible, while it is much easier for an attacker to add poisoned samples: for example, an attacker can actively manipulate datasets by sending corrupted samples directly to a dataset aggregator such as a chatbot, a spam filter, or user profile databases; the attacker can also passively manipulate datasets by placing poisoned data on the web and waiting for collection.…”