[Paper Review] MetaPoison: Practical General-purpose Clean-label Data Poisoning

Wei Huang, Jonas Geiping+3 more|arXiv (Cornell University)|Apr 1, 2020

Adversarial Robustness in Machine LearningComputer Science37 references81 citations

TL;DR

MetaPoison presents a first-order, meta-learning based poisoning method that crafts clean-label poisons to mislead deep networks trained from scratch or fine-tuned, transferring across models and even black-box APIs. It achieves high attack success with very small poison budgets and enables novel poisoning schemes.

ABSTRACT

Data poisoning -- the process by which an attacker takes control of a model by making imperceptible changes to a subset of the training data -- is an emerging threat in the context of neural networks. Existing attacks for data poisoning neural networks have relied on hand-crafted heuristics, because solving the poisoning problem directly via bilevel optimization is generally thought of as intractable for deep models. We propose MetaPoison, a first-order method that approximates the bilevel problem via meta-learning and crafts poisons that fool neural networks. MetaPoison is effective: it outperforms previous clean-label poisoning methods by a large margin. MetaPoison is robust: poisoned data made for one model transfer to a variety of victim models with unknown training settings and architectures. MetaPoison is general-purpose, it works not only in fine-tuning scenarios, but also for end-to-end training from scratch, which till now hasn't been feasible for clean-label attacks with deep nets. MetaPoison can achieve arbitrary adversary goals -- like using poisons of one class to make a target image don the label of another arbitrarily chosen class. Finally, MetaPoison works in the real-world. We demonstrate for the first time successful data poisoning of models trained on the black-box Google Cloud AutoML API. Code and premade poisons are provided at https://github.com/wronnyhuang/metapoison

Motivation & Objective

• Motivate and enable practical clean-label data poisoning against deep neural networks.
• Develop a scalable approximation to bilevel poisoning using meta-learning and ensemble surrogates.
• Demonstrate effectiveness when victims train from scratch and in fine-tuning scenarios.
• Show transferability across architectures and robustness to training settings.
• Explore real-world applicability, including black-box ML APIs and novel poisoning schemes.

Proposed method

• Formulate poisoning as a constrained bilevel optimization problem where poisons maximize adversarial loss after training on poisoned data.
• Use ReColorAdv perceptual perturbations to ensure poisons remain visually inconspicuous within L∞ bounds.
• Approximate the inner training objective by unrolling a small number (K=2) of SGD steps to estimate outer gradients.
• Craft poisons via an ensemble of partially trained surrogate models staggered in training epochs to improve generalization across initializations.
• Update poisons with gradient information from an ensemble of models across multiple epochs, with reinitialization to avoid overfitting to a single model state.
• Retain a practical computation budget (e.g., 5760 forward/backward passes per poison in reported settings) and apply projection to ε and εc bounds during optimization.

Experimental results

Research questions

• RQ1 Can MetaPoison craft effective clean-label poisons for models trained from scratch, not just fine-tuned networks?
• RQ2 Do poisons crafted with MetaPoison transfer across different victim architectures, initializations, and training settings?
• RQ3 Are the poisoned poisons effective in real-world black-box systems (e.g., Google Cloud AutoML) and under alternative poisoning schemes (self-concealment, multiclass poisoning)?
• RQ4 What is the trade-off between poison budget and attack success across architectures and datasets?
• RQ5 Do the crafted poisons remain effective under data augmentation and various hyperparameters?

Key findings

• MetaPoison achieves high attack success with small poison budgets, e.g., 40–90% success at 1% poison budget for end-to-end trained networks.
• ResNet20 reaches 72% attack success with a 1% poison budget on dog-bird targets.
• Poison budgets as low as 0.01% can be viable with nonzero success in end-to-end training across architectures.
• In continuous evaluations, self-concealment and multiclass-poison schemes enable flexible, previously untested poisoning objectives.
• Poisoned CIFAR-10 models can be successfully deployed against Google Cloud AutoML Vision with poison budgets as low as 0.5%, achieving measurable success (>15%).
• Poisons crafted on one architecture transfer to other architectures (e.g., ConvNetBN, VGG13, ResNet20) with substantial but non-symmetric effectiveness.