[Paper Review] Preventing Unauthorized Use of Proprietary Data: Poisoning for Secure Dataset Release

Liam Fowl, Ping-yeh Chiang+5 more|arXiv (Cornell University)|Feb 16, 2021

Advanced Malware Detection Techniques12 citations

TL;DR

This paper proposes a novel, scalable data poisoning method that subtly modifies publicly released datasets to degrade the generalization performance of models trained on them, preserving perceptual quality while preventing competitors from replicating proprietary models. The approach uses an online, gradient-based optimization to craft minimal perturbations that maximize test error in deep networks, achieving state-of-the-art results on ImageNet and facial recognition tasks with minimal data modification.

ABSTRACT

Large organizations such as social media companies continually release data, for example user images. At the same time, these organizations leverage their massive corpora of released data to train proprietary models that give them an edge over their competitors. These two behaviors can be in conflict as an organization wants to prevent competitors from using their own data to replicate the performance of their proprietary models. We solve this problem by developing a data poisoning method by which publicly released data can be minimally modified to prevent others from train-ing models on it. Moreover, our method can be used in an online fashion so that companies can protect their data in real time as they release it.We demonstrate the success of our approach onImageNet classification and on facial recognition.

Motivation & Objective

• To address the conflict between publicly releasing data and maintaining a competitive edge from proprietary model training.
• To develop a method that degrades model generalization on released data without compromising perceptual quality.
• To enable real-time, online data poisoning for dynamic data release platforms such as social media.
• To outperform existing indiscriminate poisoning attacks on deep networks in terms of effectiveness and scalability.
• To provide a practical solution for organizations to release data transparently while protecting their model training advantages.

Proposed method

• The method formulates a bi-level optimization problem to maximize test error of models trained on poisoned data, subject to small perturbations bounded by an ℓ∞ norm.
• It uses a surrogate model to estimate the target gradient and crafts perturbations via a loss function that maximizes the inner product between the target gradient and the model's loss gradient.
• The algorithm enables online, per-sample perturbation generation by detaching the denominator in the gradient computation, allowing distributed and real-time application.
• It incorporates regularization techniques such as ℓ2, total variation (TV), and SSIM to improve visual fidelity of perturbed data.
• The approach uses signed Adam optimization to efficiently compute perturbations that degrade generalization while remaining imperceptible.
• The method is designed to be effective in a black-box setting, requiring no access to the target model’s architecture or weights.

Experimental results

Research questions

• RQ1 Can a data poisoning method be developed that effectively degrades generalization performance of deep networks trained on released data?
• RQ2 Can such a method be applied in an online, real-time fashion suitable for dynamic data platforms?
• RQ3 How effective is the method in degrading performance on modern deep networks like ResNet-18, especially under limited poisoning ratios?
• RQ4 To what extent do regularization techniques improve visual quality without sacrificing poisoning effectiveness?
• RQ5 Can the method be applied successfully to both image classification and facial recognition tasks?

Key findings

• The method achieves a validation accuracy of 44.82% on ResNet-18 when trained on poisoned ImageNet data using only 5% of the data for gradient estimation, demonstrating high effectiveness with minimal data.
• When using only 5% of the data for gradient estimation and no regularization, the method still doubles the validation error, achieving 74.64% accuracy, indicating strong robustness to data sparsity.
• The addition of regularization terms such as SSIM and TV reduces the visibility of perturbations, but increases validation accuracy—e.g., SSIM regularization raises accuracy to 51.09% compared to 44.82% without regularization.
• The online crafting mechanism, which detaches the denominator in the gradient computation, produces perturbations nearly identical to the full-batch version, enabling scalable, distributed deployment.
• The method outperforms prior indiscriminate poisoning attacks on deep networks, particularly in black-box and real-time settings, and is effective even when poisoning only a small fraction of data.
• The approach is effective on both ImageNet classification and facial recognition tasks, showing broad applicability across vision benchmarks.