Inverting Gradient Attacks Makes Powerful Data Poisoning

TL;DR

This paper demonstrates that data poisoning can effectively mimic gradient attacks to perform availability attacks on neural networks, significantly degrading performance with minimal poisoned data in non-convex settings.

Contribution

It introduces a method to invert gradients to reconstruct data points, enabling data poisoning to replicate gradient attack effects in neural networks.

Findings

Data poisoning can match gradient attack harm in neural networks.

Reconstructing data from malicious gradients enables effective availability attacks.

As low as 1% poisoned data can degrade model performance to random levels.

Abstract

Gradient attacks and data poisoning tamper with the training of machine learning algorithms to maliciously alter them and have been proven to be equivalent in convex settings. The extent of harm these attacks can produce in non-convex settings is still to be determined. Gradient attacks can affect far less systems than data poisoning but have been argued to be more harmful since they can be arbitrary, whereas data poisoning reduces the attacker's power to only being able to inject data points to training sets, via e.g. legitimate participation in a collaborative dataset. This raises the question of whether the harm made by gradient attacks can be matched by data poisoning in non-convex settings. In this work, we provide a positive answer in a worst-case scenario and show how data poisoning can mimic a gradient attack to perform an availability attack on (non-convex) neural networks. Through gradient inversion, commonly used to reconstruct data points from actual gradients, we show how reconstructing data points out of malicious gradients can be sufficient to perform a range of attacks. This allows us to show, for the first time, an availability attack on neural networks through data poisoning, that degrades the model's performances to random-level through a minority (as low as 1%) of poisoned points.