Towards Poisoning of Deep Learning Algorithms with Back-gradient Optimization

TL;DR

This paper introduces a novel back-gradient optimization method for data poisoning attacks, extending to multiclass problems and deep learning models, demonstrating effectiveness across various applications.

Contribution

The work presents a new poisoning algorithm based on back-gradient optimization that broadens attack applicability to gradient-trained models, including deep neural networks.

Findings

Effective poisoning attack demonstrated on multiple applications

Attack transferability across different learning algorithms

Extension of poisoning attacks to multiclass problems

Abstract

A number of online services nowadays rely upon machine learning to extract valuable information from data collected in the wild. This exposes learning algorithms to the threat of data poisoning, i.e., a coordinate attack in which a fraction of the training data is controlled by the attacker and manipulated to subvert the learning process. To date, these attacks have been devised only against a limited class of binary learning algorithms, due to the inherent complexity of the gradient-based procedure used to optimize the poisoning points (a.k.a. adversarial training examples). In this work, we rst extend the de nition of poisoning attacks to multiclass problems. We then propose a novel poisoning algorithm based on the idea of back-gradient optimization, i.e., to compute the gradient of interest through automatic di erentiation, while also reversing the learning procedure to drastically reduce the attack complexity. Compared to current poisoning strategies, our approach is able to target a wider class of learning algorithms, trained with gradient- based procedures, including neural networks and deep learning architectures. We empirically evaluate its e ectiveness on several application examples, including spam ltering, malware detection, and handwritten digit recognition. We nally show that, similarly to adversarial test examples, adversarial training examples can also be transferred across di erent learning algorithms.