[Paper Review] Adversarial Examples Make Strong Poisons

Liam Fowl, Micah Goldblum+4 more|arXiv (Cornell University)|Jun 21, 2021

Adversarial Robustness in Machine Learning52 references33 citations

TL;DR

The paper shows that adversarial examples crafted on a fixed pretrained model can serve as highly effective data poisons, degrading or destroying generalization when used for training, often outperforming prior poisoning methods. A class-targeted adversarial poisoning variant yields especially strong effects on large datasets like ImageNet, and they release ImageNet-P to facilitate defense research.

ABSTRACT

The adversarial machine learning literature is largely partitioned into evasion attacks on testing data and poisoning attacks on training data. In this work, we show that adversarial examples, originally intended for attacking pre-trained models, are even more effective for data poisoning than recent methods designed specifically for poisoning. Our findings indicate that adversarial examples, when assigned the original label of their natural base image, cannot be used to train a classifier for natural images. Furthermore, when adversarial examples are assigned their adversarial class label, they are useful for training. This suggests that adversarial examples contain useful semantic content, just with the ``wrong'' labels (according to a network, but not a human). Our method, adversarial poisoning, is substantially more effective than existing poisoning methods for secure dataset release, and we release a poisoned version of ImageNet, ImageNet-P, to encourage research into the strength of this form of data obfuscation.

Motivation & Objective

• Motivate data poisoning as an availability attack and link it to adversarial examples.
• Propose adversarial poisoning as a simple, effective poisoning method crafted on a fixed model.
• Evaluate across CIFAR-10, ImageNet, and facial recognition to demonstrate portability and strength.
• Analyze why adversarial examples act as strong poisons and investigate defense effectiveness.

Proposed method

• Formulate poisoning as an empirical loss maximization by crafting perturbations with respect to a fixed clean model (theta*).
• Craft poisons using 250-step PGD on a chosen loss, with differentiable data augmentation.
• Explore class-targeted attacks that map each source class to a target label and compare untargeted vs. targeted performance.
• Evaluate across CIFAR-10 and ImageNet (including a released ImageNet-P) and in facial recognition settings.
• Compare to existing poisoning baselines (TensorClog, Loss Minimization, Alignment, etc.).
• Test defenses including adversarial training, various augmentations, and DPSGD to assess robustness.

Experimental results

Research questions

• RQ1 Can adversarial examples crafted on a fixed model outperform existing poisoning methods in availability attacks?
• RQ2 Do adversarial poisons carry useful semantic content for the wrong class, enabling effective training degradation?
• RQ3 How do class-targeted adversarial poisons perform on large-scale datasets (ImageNet) and in facial recognition contexts?
• RQ4 Are standard defenses (adversarial training, data augmentation, DPSGD) effective against adversarial poisons?

Key findings

• Adversarial poisons substantially degrade test accuracy across multiple architectures on CIFAR-10, often reducing performance to near random guessing under 8/255 perturbations.
• On CIFAR-10, adversarial poisoning with 8/255 perturbations yields validation accuracies around 6.25% for ResNet-18, far below prior methods (e.g., 53.67% for Alignment, 6.25% for Adversarial Poisoning).
• Class-targeted poisons on ImageNet dramatically reduce validation accuracy (e.g., 4/255 gives 45.07%, 8/255 gives 36.63%, and CT 4/255 yields 3.57%, CT 8/255 yields 1.45%).
• In facial recognition, class-targeted poisons reduce average accuracy to 8.00%, outperforming unlearnable examples at 16.00%.
• Label-corrected experiments show that relabeling poisoned data with the crafting network’s wrong labels recovers substantial accuracy, illustrating the presence of transferable non-robust features.
• Defenses like adversarial training mitigate poisoning effects but significantly harm natural accuracy and are computationally expensive.