[Paper Review] Label Poisoning is All You Need

Rishi D. Jha, Jonathan Hayase+1 more|arXiv (Cornell University)|Oct 29, 2023

Adversarial Robustness in Machine Learning4 citations

TL;DR

This paper introduces FLIP, a novel label-only backdoor attack that successfully poisons models by corrupting only training labels, achieving 99.4% attack success rate on CIFAR-10 with just 2% label corruption and only a 1.8% drop in clean accuracy. The method leverages trajectory matching from dataset distillation to train models that learn to associate specific label patterns with target classes, even without modifying input images.

ABSTRACT

In a backdoor attack, an adversary injects corrupted data into a model's training dataset in order to gain control over its predictions on images with a specific attacker-defined trigger. A typical corrupted training example requires altering both the image, by applying the trigger, and the label. Models trained on clean images, therefore, were considered safe from backdoor attacks. However, in some common machine learning scenarios, the training labels are provided by potentially malicious third-parties. This includes crowd-sourced annotation and knowledge distillation. We, hence, investigate a fundamental question: can we launch a successful backdoor attack by only corrupting labels? We introduce a novel approach to design label-only backdoor attacks, which we call FLIP, and demonstrate its strengths on three datasets (CIFAR-10, CIFAR-100, and Tiny-ImageNet) and four architectures (ResNet-32, ResNet-18, VGG-19, and Vision Transformer). With only 2% of CIFAR-10 labels corrupted, FLIP achieves a near-perfect attack success rate of 99.4% while suffering only a 1.8% drop in the clean test accuracy. Our approach builds upon the recent advances in trajectory matching, originally introduced for dataset distillation.

Motivation & Objective

• To investigate whether backdoor attacks are possible when an adversary controls only the training labels, not the input images.
• To challenge the assumption that models are safe from backdoors when training images are clean but labels are provided by untrusted third parties.
• To develop a practical and effective label-only backdoor attack that maintains high clean accuracy while achieving near-perfect attack success.
• To evaluate the robustness of FLIP against state-of-the-art defenses, including SPECTRE, k-means, and PCA.
• To demonstrate the transferability of FLIP attacks to large vision transformers via fine-tuning.

Proposed method

• FLIP uses trajectory matching, a technique originally developed for dataset distillation, to learn a sequence of model weights that align with the desired label distribution.
• The method trains a model on a synthetic dataset where each example consists of a clean image paired with a corrupted label, designed to induce the model to associate the label pattern with a target class.
• Label corruption is implemented by reassigning a subset of training labels to a target class based on a predefined pattern (e.g., sinusoidal, periodic, Turner triggers), without altering the image content.
• The attack is optimized using a loss function that encourages the model’s prediction trajectory to converge toward the target label for poisoned examples while preserving performance on clean data.
• FLIP is evaluated across multiple architectures (ResNet-32, ResNet-18, VGG-19, Vision Transformer) and datasets (CIFAR-10, CIFAR-100, Tiny-ImageNet) to assess generalization and transferability.
• The approach is tested under fine-tuning scenarios, where a pre-trained ViT is fine-tuned on FLIP-generated labels from ResNet or VGG-19 models, demonstrating strong transferability.

Experimental results

Research questions

• RQ1 Can a backdoor attack be successfully mounted by corrupting only the labels, without modifying the input images?
• RQ2 How effective is the FLIP attack in maintaining high clean test accuracy while achieving near-perfect poison attack success rate?
• RQ3 How does FLIP perform against state-of-the-art backdoor defenses such as SPECTRE, k-means, and PCA?
• RQ4 Can FLIP-generated label poisoning transfer effectively to large vision transformers when fine-tuned from pre-trained models?
• RQ5 What is the minimal number of label corruptions required to achieve strong attack performance?

Key findings

• With only 2% of CIFAR-10 labels corrupted, FLIP achieves a 99.4% poison test accuracy (PTA) while reducing clean test accuracy (CTA) by only 1.8%.
• FLIP outperforms existing baselines, including a multi-label attack from [18] and an inner product baseline, in both PTA and CTA trade-off, especially under low corruption rates.
• SPECTRE defense is highly effective against FLIP, reducing PTA to near zero across all trigger types, while k-means and PCA defenses fail to mitigate the attack.
• FLIP demonstrates strong transferability: labels trained on ResNet-32 or VGG-19 models successfully backdoor a Vision Transformer fine-tuned on ImageNet1K, achieving over 94% PTA with 1,500 poisoned labels.
• The use of ℓ₁-regularization in FLIP does not improve performance, indicating that the core method is already optimized for label efficiency and robustness.
• Even under strong defenses like SPECTRE, FLIP remains a threat in settings where images are clean but labels are untrusted, such as crowd-sourced annotation and knowledge distillation.