[Paper Review] Indiscriminate Poisoning Attacks on Unsupervised Contrastive Learning

Hao He, Kaiwen Zha+1 more|arXiv (Cornell University)|Feb 22, 2022

Domain Adaptation and Few-Shot Learning4 citations

TL;DR

This paper introduces Contrastive Poisoning (CP), the first effective indiscriminate data poisoning attack targeting unsupervised contrastive learning (CL). By exploiting the contrastive loss, data augmentation, and momentum encoder dynamics, CP drastically degrades CL performance and generalizes to attack supervised learning, revealing CL's relative robustness and the need for new defenses like matrix completion-based augmentation.

ABSTRACT

Indiscriminate data poisoning attacks are quite effective against supervised learning. However, not much is known about their impact on unsupervised contrastive learning (CL). This paper is the first to consider indiscriminate poisoning attacks of contrastive learning. We propose Contrastive Poisoning (CP), the first effective such attack on CL. We empirically show that Contrastive Poisoning, not only drastically reduces the performance of CL algorithms, but also attacks supervised learning models, making it the most generalizable indiscriminate poisoning attack. We also show that CL algorithms with a momentum encoder are more robust to indiscriminate poisoning, and propose a new countermeasure based on matrix completion. Code is available at: https://github.com/kaiwenzha/contrastive-poisoning.

Motivation & Objective

• To investigate the vulnerability of unsupervised contrastive learning (CL) to indiscriminate data poisoning attacks.
• To develop a novel poisoning method effective against CL, which prior attacks on supervised learning fail to compromise.
• To evaluate the robustness of CL models with momentum encoders and identify their advantages over standard CL.
• To assess existing defenses against poisoning and propose a new, more effective defense mechanism based on matrix completion.

Proposed method

• Design a poison generation process that directly targets the contrastive learning objective, specifically the InfoNCE loss, to mislead representation learning.
• Introduce a differentiation procedure that accounts for data augmentation in CL, ensuring poison effectiveness across augmented views.
• Implement a dual-branch gradient propagation scheme to effectively poison CL models with momentum encoders (e.g., MoCo, BYOL).
• Generate poisons using a momentum encoder to improve transferability across different CL architectures.
• Evaluate defenses using standard data augmentations (Random Noise, Gauss Smooth, Cutout) and propose a new matrix completion-based augmentation.
• Use universal singular value thresholding (USVT) for matrix completion to reconstruct missing pixels in poisoned data.

Experimental results

Research questions

• RQ1 Can indiscriminate poisoning attacks, effective against supervised learning, successfully degrade unsupervised contrastive learning models?
• RQ2 What are the key architectural and training differences in CL that make it more robust to indiscriminate poisoning than supervised learning?
• RQ3 How does the use of a momentum encoder in CL affect vulnerability to poisoning attacks?
• RQ4 Can a single poison generated for one CL model effectively attack other CL models and even supervised learning models?
• RQ5 Is matrix completion-based data augmentation more effective than standard augmentations in defending against contrastive poisoning?

Key findings

• Contrastive learning models (SimCLR, MoCo, BYOL) remain highly robust to prior indiscriminate poisoning attacks designed for supervised learning, maintaining high accuracy even under strong poisoning.
• Contrastive Poisoning (CP) achieves a 44.9% test accuracy drop on SimCLR and a 68.9% drop on MoCo under CP(S) and CP(C) attacks, respectively, demonstrating its effectiveness.
• Models with momentum encoders (MoCo, BYOL) are significantly more robust than those without (SimCLR), with CP achieving lower performance degradation on them.
• The matrix completion-based defense achieves an average accuracy of 86.9% across attacks, outperforming adversarial training (80.8%) and other augmentations.
• Adversarial training, effective against supervised learning poisoning, fails to defend against CP, highlighting the need for new defense strategies in CL.
• Class-wise poison is more resilient to data augmentation defenses than sample-wise poison, which is highly sensitive to such defenses.