HINT: Healthy Influential-Noise based Training to Defend against Data Poisoning Attacks

TL;DR

HINT is a robust training method that uses influence functions to generate healthy noise, effectively defending deep learning models against various data poisoning attacks while maintaining test accuracy.

Contribution

This work introduces HINT, a novel influence function-based training approach that enhances robustness against diverse data poisoning attacks with limited data modification.

Findings

HINT effectively defends against untargeted poisoning attacks.

HINT maintains high test accuracy under attack scenarios.

HINT outperforms existing defenses in empirical evaluations.

Abstract

While numerous defense methods have been proposed to prohibit potential poisoning attacks from untrusted data sources, most research works only defend against specific attacks, which leaves many avenues for an adversary to exploit. In this work, we propose an efficient and robust training approach to defend against data poisoning attacks based on influence functions, named Healthy Influential-Noise based Training. Using influence functions, we craft healthy noise that helps to harden the classification model against poisoning attacks without significantly affecting the generalization ability on test data. In addition, our method can perform effectively when only a subset of the training data is modified, instead of the current method of adding noise to all examples that has been used in several previous works. We conduct comprehensive evaluations over two image datasets with state-of-the-art poisoning attacks under different realistic attack scenarios. Our empirical results show that HINT can efficiently protect deep learning models against the effect of both untargeted and targeted poisoning attacks.