Transferable Availability Poisoning Attacks

TL;DR

This paper introduces Transferable Poisoning, a novel data poisoning method that creates perturbations to degrade model performance across various learning algorithms, especially in contrastive learning, by leveraging intrinsic data properties and gradient information.

Contribution

The paper proposes a new transferable poisoning attack that improves attack transferability across different algorithms and paradigms, addressing limitations of prior methods.

Findings

Significant decrease in attack effectiveness when using different learning algorithms.

Transferable poisoning achieves high success across multiple models and paradigms.

Enhanced unlearnability in contrastive learning through intrinsic data characteristics.

Abstract

We consider availability data poisoning attacks, where an adversary aims to degrade the overall test accuracy of a machine learning model by crafting small perturbations to its training data. Existing poisoning strategies can achieve the attack goal but assume the victim to employ the same learning method as what the adversary uses to mount the attack. In this paper, we argue that this assumption is strong, since the victim may choose any learning algorithm to train the model as long as it can achieve some targeted performance on clean data. Empirically, we observe a large decrease in the effectiveness of prior poisoning attacks if the victim employs an alternative learning algorithm. To enhance the attack transferability, we propose Transferable Poisoning, which first leverages the intrinsic characteristics of alignment and uniformity to enable better unlearnability within contrastive learning, and then iteratively utilizes the gradient information from supervised and unsupervised contrastive learning paradigms to generate the poisoning perturbations. Through extensive experiments on image benchmarks, we show that our transferable poisoning attack can produce poisoned samples with significantly improved transferability, not only applicable to the two learners used to devise the attack but also to learning algorithms and even paradigms beyond.