Bullseye Polytope: A Scalable Clean-Label Poisoning Attack with Improved Transferability

Abstract

A recent source of concern for the security of neural networks is the emergence of clean-label dataset poisoning attacks, wherein correctly labeled poisoned samples are injected in the training dataset. While these poisons look legitimate to the human observer, they contain malicious characteristics that trigger a targeted misclassification during inference. We propose a scalable and transferable clean-label attack, Bullseye Polytope, which creates poison images centered around the target image in the feature space. Bullseye Polytope improves the attack success rate of the current stateof-the-art by 26.75% in end-to-end training, while increasing attack speed by a factor of 12. We further extend Bullseye Polytope to a more practical attack model by including multiple images of the same object (e.g., from different angles) in crafting the poisoned samples. We demonstrate that this extension improves attack transferability by over 16% to unseen images (of the same object) without increasing the number of poisons.

A Roadmap for Big Model

“…This type of data poisoning attacks only manipulate training data and labels without the need to modify testing data after the victim model is deployed. Training-only poisoning attacks include both untargeted attacks where the adversary aims to degrade model performance on normal testing data [995,997,998,999], and targeted attacks in which the adversary aims to change the behavior of the model on particular testing inputs [1000,1001,1002]. Below we introduce some typical approaches.…”

Low-Rank Softmax Can Have Unargmaxable Classes in Theory but Rarely in Practice

“…A subset of such techniques, known as feature collisions (Shafahi et al, 2018;Goldblum et al, 2020), exploit the arrangement of the training examples in feature space to force the misclassification of a target example. Attacks such as Convex Polytope (Zhu et al, 2019) and Bullseye Polytope (Aghakhani et al, 2021), specifically target the unargmaxability weakness (Cover, 1967;Demeter et al, 2020) we elaborated on in the paper. While such attacks assume they are able to inject examples into a training set used for finetuning, this is not an unrealistic assumption.…”

The MeVer DeepFake Detection Service: Lessons Learnt from Developing and Deploying in the Wild

“…These attacks come in various shapes and forms but can be categorised as: Evasion attacks intentionally perform targeted alterations to an image or video so as to confuse a machine learning system [75] in making a wrong prediction. Poisoning attacks [2] attempt to alter the dataset used to train an AI model. This type of attack occurs prior to the deployment of the AI system.…”

“…In combination with the drastic increase in quality fueled by the research in the area of image/video generation [25,63,83], DeepFakes pose a serious threat to society with far-reaching impacts. Some notable DeepFake examples include: a DeepFake of the US president Donald Trump in which he urges Belgian politicians to pull out of the Paris climate agreement 2 , a DeepFake of Meta CEO Mark Zuckerberg in which he gives a sinister speech about the influence of Facebook on its users 3 , and a fake video of US president Barack Obama during which he insults Donald Trump 4 .…”