Source-linked AI summary
Strong Data Augmentation Sanitizes Poisoning and Backdoor Attacks Without an Accuracy Tradeoff
Eitan Borgnia, Valeriia Cherepanova, Liam Fowl, Amin Ghiasi, Jonas Geiping, Micah Goldblum, Tom Goldstein, Arjun Gupta
TL;DR
Data poisoning and backdoor attacks exploit maliciously modified training data, while existing defenses can be ineffective or reduce accuracy. This paper evaluates strong data augmentations as a simple defense and finds they mitigate poisoning while largely preserving natural accuracy, including a 9% validation-accuracy increase for CutMix against backdoors.
Problem
Data poisoning and backdoor attacks threaten models trained on potentially compromised data, while existing defenses may fail against strong attacks or degrade performance.
Method
The paper evaluates strong data augmentations, including mixup and CutMix, as simple defenses against backdoor and optimization-based poisoning attacks, including adaptive attacks.
Results
Across backdoor and targeted poisoning settings, data augmentation substantially reduces poison success with little validation-accuracy loss; CutMix reduces backdoor success from 100% to 36% while increasing validation accuracy by 9%.
Takeaways & Limitations
Strong data augmentation offers a convenient poisoning defense that mitigates attacks while maintaining natural accuracy across backdoor and optimization-based settings.
Takeaways & Limitations
Four-fold mixtures strengthen mixup’s defense but modify data so starkly that they negatively affect validation accuracy.
Abstract
from arXiv · showhide
Data poisoning and backdoor attacks manipulate victim models by maliciously modifying training data. In light of this growing threat, a recent survey of industry professionals revealed heightened fear in the private sector regarding data poisoning. Many previous defenses against poisoning either fail in the face of increasingly strong attacks, or they significantly degrade performance. However, we find that strong data augmentations, such as mixup and CutMix, can significantly diminish the threat of poisoning and backdoor attacks without trading off performance. We further verify the effectiveness of this simple defense against adaptive poisoning methods, and we compare to baselines including the popular differentially private SGD (DP-SGD) defense. In the context of backdoors, CutMix greatly mitigates the attack while simultaneously increasing validation accuracy by 9%.
1. INTRODUCTION
Data poisoning threatens models trained on potentially compromised third-party data, while existing defenses can fail against strong attacks or substantially reduce validation accuracy. The paper investigates strong augmentations as simpler defenses that preserve natural performance.
- Data poisoning modifies training data to induce targeted misclassification or performance degradation in victim models.
- Existing defenses either fail against stronger poisoning attacks or substantially reduce validation accuracy.Feature-anomaly filtering can fail for models trained from scratch on poisoned data, while DP-SGD prevents state-of-the-art targeted poisoning at an accuracy cost.
- The paper evaluates multiple augmentation strategies against both backdoor triggers and modern imperceptible targeted poisoning attacks.The evaluation covers a simple backdoor attack and an optimization-based targeted poisoning attack.
- Modern augmentations can mitigate poisoning more effectively than cumbersome defenses without significantly sacrificing natural validation accuracy.The proposed defense requires only a small change to standard training pipelines.
2. THREAT MODEL
The paper studies robust backdoor and targeted clean-label poisoning attacks under a bilevel threat model. It argues that strong augmentation can regularize decision boundaries and prevent poisoned targets from being isolated into adversarial classes.
- Backdoor attacks insert trigger patterns into training images so triggered test images are assigned the poisoned training label.
- The attacker modifies a small number of training samples with perturbations constrained by either an ℓ0 patch norm or an ℓ∞ optimization norm.The attacker can modify P samples out of N total samples, with P ≪ N.
- Targeted poisoning methods optimize training-data perturbations so the trained model misclassifies selected target samples with adversarial labels.
- Both attack types exploit expressive networks trained from scratch to create narrow, irregular decision-boundary regions around target images.
- Strong augmentation is intended to impose decision-boundary regularity and prevent targets from being gerrymandered into incorrect classes without reducing normal accuracy.
3. METHOD
The method applies strong image augmentations, especially mixup and CutMix, to alter training examples and regularize class boundaries. CutMix replaces a randomly located image region and mixes labels according to the retained image area.
- Mixup regularizes class boundaries by assigning convex combinations of inputs convex combinations of labels, targeting small gerrymandered poisoned regions.
- The experiments use mixture width k with coefficients drawn from Dir[α, . . . , α] and α = 1.
- CutMix combines two images by replacing a randomly located rectangular region and mixing their labels according to the region’s relative area.The mask selects the cut-and-pasted box, while λ determines the relative contribution of the sampled images.
- Cutout masks an image region while retaining the original label, whereas MaxUp generates multiple augmented examples for modified empirical-risk training.
- CutMix chops poisoned patches apart, reducing their visual impact during training.
4. EXPERIMENTS
Strong data augmentation mitigates both backdoor and targeted poisoning attacks while largely preserving validation accuracy. CutMix is especially effective against backdoors, while mixup and MaxUp provide strong defenses against optimization-based poisoning, including adaptive attacks.
- 4.1. Defending Against Backdoor Trigger Attacks: CutMix reduces backdoor poison success from 100% to 36% while increasing validation accuracy by 9%.Mixup does not defend against this backdoor attack.
- 4.2. Defending Against Targeted Poisoning Attacks: Adaptive attacks are evaluated by generating poisons against models trained with the same augmentation as the victim.This tests whether augmentation defenses remain effective when the attacker knows the defense.
- 4.2. Defending Against Targeted Poisoning Attacks: Data augmentation defenses lose almost no validation accuracy, unlike DP-SGD, while reducing poison success by up to 60% with MaxUp using four cutouts.Table 2 reports poison success and clean validation error averaged over 20 runs.
- 4.2. Defending Against Targeted Poisoning Attacks: Mixup is the strongest tested accuracy-preserving augmentation against optimization-based poisoning, including adaptive attacks.Four-fold mixup is stronger than vanilla mixup but negatively affects validation accuracy because its image modifications are more drastic.
- 4.2. Defending Against Targeted Poisoning Attacks: CutMix improves upon mixup against adaptive poisoning because the attacker cannot know the randomly selected cut-patch location in advance.For non-adaptive targeted poisoning, CutMix is less effective than in the backdoor setting.
5. CONCLUSIONS
The paper concludes that modern data augmentation can mitigate from-scratch poisoning attacks while maintaining natural accuracy. It identifies specially designed augmentations for poison defense as a promising direction for future research.
- 5. CONCLUSIONS: Modern data augmentation mitigates backdoor and optimization-based poisoning while maintaining natural accuracy.The conclusion covers both backdoor triggers and optimization-based attacks.
- 5. CONCLUSIONS: Specially designed augmentations for poison defense are proposed as a fruitful direction for future research.