Symmetric adversarial poisoning against deep learning

Abstract

Data poisoning is known as the goal of finding small modification of training data which make them not suitable anymore for training the targeted model. Recently, an efficient symmetric poisoning attack targeting frozen deep features plus support vector machine has been found.However, new experiments presented in this paper shows that this attack is not symmetric anymore on unfrozen/real deep networks.Then, several extensions of this attack are considered on CIFAR10/CIFAR100 with both VGG and ResNet backbone leading to a symmetric attack. On VGG/CIFAR10 setting, this extended attack makes performances moving by -60%,+5% from native accuracy using perturbations invisible to human eyes.A discussion on this success and on the failure of the 3 other methods is also presented.