[Paper Review] PoisonedEncoder: Poisoning the Unlabeled Pre-training Data in Contrastive Learning

Hongbin Liu, Jinyuan Jia+1 more|arXiv (Cornell University)|May 13, 2022

Adversarial Robustness in Machine Learning4 citations

TL;DR

PoisonedEncoder is the first targeted data poisoning attack against single-modal contrastive learning that poisons unlabeled pre-training data by crafting adversarial inputs combining target inputs and reference images from the target class. The attack achieves high success rates in causing downstream classifiers to misclassify attacker-chosen inputs as target classes while preserving the encoder’s utility on clean inputs.

ABSTRACT

Contrastive learning pre-trains an image encoder using a large amount of unlabeled data such that the image encoder can be used as a general-purpose feature extractor for various downstream tasks. In this work, we propose PoisonedEncoder, a data poisoning attack to contrastive learning. In particular, an attacker injects carefully crafted poisoning inputs into the unlabeled pre-training data, such that the downstream classifiers built based on the poisoned encoder for multiple target downstream tasks simultaneously classify attacker-chosen, arbitrary clean inputs as attacker-chosen, arbitrary classes. We formulate our data poisoning attack as a bilevel optimization problem, whose solution is the set of poisoning inputs; and we propose a contrastive-learning-tailored method to approximately solve it. Our evaluation on multiple datasets shows that PoisonedEncoder achieves high attack success rates while maintaining the testing accuracy of the downstream classifiers built upon the poisoned encoder for non-attacker-chosen inputs. We also evaluate five defenses against PoisonedEncoder, including one pre-processing, three in-processing, and one post-processing defenses. Our results show that these defenses can decrease the attack success rate of PoisonedEncoder, but they also sacrifice the utility of the encoder or require a large clean pre-training dataset.

Motivation & Objective

• To address the vulnerability of single-modal contrastive learning to targeted data poisoning attacks via manipulation of unlabeled pre-training data.
• To develop a method that enables an attacker to cause multiple downstream classifiers to misclassify arbitrary clean inputs as attacker-chosen target classes.
• To formulate the attack as a bilevel optimization problem tailored to contrastive learning’s self-supervised objective.
• To evaluate the effectiveness of PoisonedEncoder under realistic threat models where downstream training data is clean and inaccessible to tampering.
• To assess the robustness of existing defenses against this novel attack and identify their limitations in utility or data requirements.

Proposed method

• Formulate the data poisoning attack as a bilevel optimization problem: the outer problem defines the attack goal on the poisoned encoder, and the inner problem models the encoder’s training on poisoned pre-training data.
• Propose a contrastive-learning-tailored approximation method to solve the bilevel optimization, leveraging the fact that contrastive learning encourages similar features for cropped views of the same image.
• Construct poisoning inputs by concatenating a target input and a reference image from the target class either horizontally or vertically, so that random crops may yield the target input and reference image.
• Exploit the random cropping mechanism in contrastive learning: if two cropped views of a poisoning input correspond to the target input and reference image, the encoder learns to embed them similarly.
• Use the resulting encoder to train downstream classifiers, which then misclassify the target input as the target class due to feature similarity induced by the poisoning.
• Extend the framework to backdoor attacks by concatenating trigger-embedded auxiliary inputs with reference images to create poisoning inputs that trigger misclassification under a trigger.

Experimental results

Research questions

• RQ1 Can an attacker successfully manipulate multiple downstream classifiers in contrastive learning by poisoning only the unlabeled pre-training data, without modifying downstream training data?
• RQ2 How effective is PoisonedEncoder in achieving high attack success rates while maintaining the pre-trained encoder’s performance on clean inputs?
• RQ3 How do existing defenses—pre-processing, in-processing, and post-processing—perform against PoisonedEncoder, and what are their trade-offs in utility or data requirements?
• RQ4 Can the proposed attack be extended to backdoor-style poisoning, where trigger-embedded inputs are misclassified as a target class?
• RQ5 What are the limitations of current defenses in providing robustness without sacrificing model utility or requiring large clean pre-training datasets?

Key findings

• PoisonedEncoder achieves high attack success rates, with downstream classifiers misclassifying 96.54% of trigger-embedded inputs as the target class in backdoor extension experiments on STL10.
• The attack maintains high testing accuracy on non-target inputs, demonstrating that the poisoned encoder preserves utility for benign inputs.
• Five evaluated defenses—ranging from pre-processing to post-processing—reduce the attack success rate but either sacrifice encoder utility or require a large clean pre-training dataset.
• Extending bagging to contrastive learning provides certified robustness but significantly degrades model utility, indicating a strong trade-off between robustness and performance.
• In-processing defenses such as early stopping and disabling random cropping reduce attack success but also degrade the encoder’s generalization performance.
• Post-processing defenses like fine-tuning can reduce attack success but require access to a clean pre-training dataset, which may be impractical to obtain.