transferable clean label poisoning attacks on deep neural
play

TRANSFERABLE CLEAN-LABEL POISONING ATTACKS ON DEEP NEURAL NETS - PowerPoint PPT Presentation

Aug 10, 2023 •28 likes •218 views

TRANSFERABLE CLEAN-LABEL POISONING ATTACKS ON DEEP NEURAL NETS Chen Zhu*, W. Ronny Huang*^, Ali Shafahi, Hengduo Li, Gavin Taylor, Christoph Studer, Tom Goldstein * equal contribution ^ presenter WHAT IS POISONING? Training data Testing

  1. TRANSFERABLE CLEAN-LABEL POISONING ATTACKS ON DEEP NEURAL NETS Chen Zhu*, W. Ronny Huang*^, Ali Shafahi, Hengduo Li, Gavin Taylor, Christoph Studer, Tom Goldstein * equal contribution ^ presenter

  2. WHAT IS POISONING? Training data Testing example Plane Frog Base

  3. WHAT IS POISONING? Training data Testing example Plane Frog Base Poison! + =

  4. WHAT IS POISONING? Training data Testing example Plane Frog Base Poison! + =

  5. WHITE BOX CASE Victim network is known

  6. <latexit sha1_base64="htNMwdaL3ufABG2uTJC46Ezv8t0=">ACFHicbVDLTgIxFO3gC/GFunTSEwgBDKDJrokunGJiTwSZpx0Sgca2s6k7RgI8hFu/BU3LjTGrQt3/o3lsVDwJM09PefetPcEMaNK2/a3lVpZXVvfSG9mtrZ3dvey+wcNFSUSkzqOWCRbAVKEUHqmpGWrEkiAeMNIP+1cRv3hOpaCRu9TAmHkdQUOKkTaSny26SHahy6nwB9B9gGF+UIAlU3TBXO8qsGjKoBRMuJ/N2WV7CrhMnDnJgTlqfvbL7UQ4URozJBSbceOtTdCUlPMyDjJorECPdRl7QNFYgT5Y2mS43hiVE6MIykOULDqfp7YoS4UkMemE6OdE8tehPxP6+d6PDCG1ERJ5oIPHsoTBjUEZwkBDtUEqzZ0BCEJTV/hbiHJMLa5JgxITiLKy+TRqXsnJYrN2e56uU8jQ4AscgDxwDqrgGtRAHWDwCJ7BK3iznqwX6936mLWmrPnMIfgD6/MH/2ubow=</latexit> COLLISION ATTACK Feature extractor x k f ( x ) � f ( t ) k 2 + k x � b k 2 arg min Decision boundary Base Target

  7. <latexit sha1_base64="htNMwdaL3ufABG2uTJC46Ezv8t0=">ACFHicbVDLTgIxFO3gC/GFunTSEwgBDKDJrokunGJiTwSZpx0Sgca2s6k7RgI8hFu/BU3LjTGrQt3/o3lsVDwJM09PefetPcEMaNK2/a3lVpZXVvfSG9mtrZ3dvey+wcNFSUSkzqOWCRbAVKEUHqmpGWrEkiAeMNIP+1cRv3hOpaCRu9TAmHkdQUOKkTaSny26SHahy6nwB9B9gGF+UIAlU3TBXO8qsGjKoBRMuJ/N2WV7CrhMnDnJgTlqfvbL7UQ4URozJBSbceOtTdCUlPMyDjJorECPdRl7QNFYgT5Y2mS43hiVE6MIykOULDqfp7YoS4UkMemE6OdE8tehPxP6+d6PDCG1ERJ5oIPHsoTBjUEZwkBDtUEqzZ0BCEJTV/hbiHJMLa5JgxITiLKy+TRqXsnJYrN2e56uU8jQ4AscgDxwDqrgGtRAHWDwCJ7BK3iznqwX6936mLWmrPnMIfgD6/MH/2ubow=</latexit> COLLISION ATTACK x k f ( x ) � f ( t ) k 2 + k x � b k 2 arg min Decision boundary Base Target

  8. <latexit sha1_base64="htNMwdaL3ufABG2uTJC46Ezv8t0=">ACFHicbVDLTgIxFO3gC/GFunTSEwgBDKDJrokunGJiTwSZpx0Sgca2s6k7RgI8hFu/BU3LjTGrQt3/o3lsVDwJM09PefetPcEMaNK2/a3lVpZXVvfSG9mtrZ3dvey+wcNFSUSkzqOWCRbAVKEUHqmpGWrEkiAeMNIP+1cRv3hOpaCRu9TAmHkdQUOKkTaSny26SHahy6nwB9B9gGF+UIAlU3TBXO8qsGjKoBRMuJ/N2WV7CrhMnDnJgTlqfvbL7UQ4URozJBSbceOtTdCUlPMyDjJorECPdRl7QNFYgT5Y2mS43hiVE6MIykOULDqfp7YoS4UkMemE6OdE8tehPxP6+d6PDCG1ERJ5oIPHsoTBjUEZwkBDtUEqzZ0BCEJTV/hbiHJMLa5JgxITiLKy+TRqXsnJYrN2e56uU8jQ4AscgDxwDqrgGtRAHWDwCJ7BK3iznqwX6936mLWmrPnMIfgD6/MH/2ubow=</latexit> COLLISION ATTACK x k f ( x ) � f ( t ) k 2 + k x � b k 2 arg min Decision boundary Base Target

  9. BLACK BOX CASE Victim network is unknown

  10. <latexit sha1_base64="uzhIUA0S2mCBDfhPZMdVTJ09xEQ=">ACJHicbVDLSgMxFM34rPVdekmWIQWaZmpgoKbohuXFewDOuOQSTNtaCYzJBlpGfsxbvwVNy584MKN32Km7aK2Hg5Oedebu7xIkalMs1vY2l5ZXVtPbOR3dza3tnN7e03ZBgLTOo4ZKFoeUgSRjmpK6oYaUWCoMBjpOn1r1O/+UCEpCG/U8OIOAHqcupTjJSW3NyljUQX2gHl7gDaj9B3k25MpBwVBkVYmnmqorbvK/BEX4OSl3I3lzfL5hwkVhTkgdT1Nzch90JcRwQrjBDUrYtM1JOgoSimJFR1o4liRDuoy5pa8pRQKSTjJcwWOtdKAfCn24gmN1tiNBgZTDwNOVAVI9Oe+l4n9eO1b+hZNQHsWKcDwZ5McMqhCmicEOFQrNtQEYUH1XyHuIYGw0rlmdQjW/MqLpFEpW6flyu1Zvno1jSMDsERKALnIMquAE1UAcYPIEX8AbejWfj1fg0vialS8a05wD8gfHzCyvyoz8=</latexit> BLACK BOX ATTACK Guess the model x k f guess ( x ) � f guess ( t ) k 2 + k x � b k 2 arg min Decision boundary Base Target

  11. <latexit sha1_base64="uzhIUA0S2mCBDfhPZMdVTJ09xEQ=">ACJHicbVDLSgMxFM34rPVdekmWIQWaZmpgoKbohuXFewDOuOQSTNtaCYzJBlpGfsxbvwVNy584MKN32Km7aK2Hg5Oedebu7xIkalMs1vY2l5ZXVtPbOR3dza3tnN7e03ZBgLTOo4ZKFoeUgSRjmpK6oYaUWCoMBjpOn1r1O/+UCEpCG/U8OIOAHqcupTjJSW3NyljUQX2gHl7gDaj9B3k25MpBwVBkVYmnmqorbvK/BEX4OSl3I3lzfL5hwkVhTkgdT1Nzch90JcRwQrjBDUrYtM1JOgoSimJFR1o4liRDuoy5pa8pRQKSTjJcwWOtdKAfCn24gmN1tiNBgZTDwNOVAVI9Oe+l4n9eO1b+hZNQHsWKcDwZ5McMqhCmicEOFQrNtQEYUH1XyHuIYGw0rlmdQjW/MqLpFEpW6flyu1Zvno1jSMDsERKALnIMquAE1UAcYPIEX8AbejWfj1fg0vialS8a05wD8gfHzCyvyoz8=</latexit> BLACK BOX ATTACK x k f guess ( x ) � f guess ( t ) k 2 + k x � b k 2 arg min Decision boundary Base MISS! Target

  12. <latexit sha1_base64="uzhIUA0S2mCBDfhPZMdVTJ09xEQ=">ACJHicbVDLSgMxFM34rPVdekmWIQWaZmpgoKbohuXFewDOuOQSTNtaCYzJBlpGfsxbvwVNy584MKN32Km7aK2Hg5Oedebu7xIkalMs1vY2l5ZXVtPbOR3dza3tnN7e03ZBgLTOo4ZKFoeUgSRjmpK6oYaUWCoMBjpOn1r1O/+UCEpCG/U8OIOAHqcupTjJSW3NyljUQX2gHl7gDaj9B3k25MpBwVBkVYmnmqorbvK/BEX4OSl3I3lzfL5hwkVhTkgdT1Nzch90JcRwQrjBDUrYtM1JOgoSimJFR1o4liRDuoy5pa8pRQKSTjJcwWOtdKAfCn24gmN1tiNBgZTDwNOVAVI9Oe+l4n9eO1b+hZNQHsWKcDwZ5McMqhCmicEOFQrNtQEYUH1XyHuIYGw0rlmdQjW/MqLpFEpW6flyu1Zvno1jSMDsERKALnIMquAE1UAcYPIEX8AbejWfj1fg0vialS8a05wD8gfHzCyvyoz8=</latexit> BLACK BOX ATTACK x k f guess ( x ) � f guess ( t ) k 2 + k x � b k 2 arg min Decision boundary Base MISS! Target

  13. CONVEX POLYTOPE ATTACK Decision boundary Base Target Zhu et al. "Transferable clean-label poisoning attacks”

  14. CONVEX POLYTOPE ATTACK Decision boundary Base Target Zhu et al. "Transferable clean-label poisoning attacks”

  15. CONVEX POLYTOPE ATTACK Decision boundary Base Target Zhu et al. "Transferable clean-label poisoning attacks”

  16. CONVEX POLYTOPE ATTACK Decision boundary Base Target Zhu et al. "Transferable clean-label poisoning attacks”

  17. POISON POLYTOPE Target (fish) Clean Poison

  18. POISON POLYTOPE Target (fish) Clean Poison

  19. COME SEE POSTER #68! Ok “hook” Poisons Correctly Neural Net Wrong Scraped Labelled Trained Test Prediction (from web) Attack success rate ~50% on unknown Link to paper & code architectures Works under many scenarios • No training data overlap • Transfer learning and end-to-end training No drop in overall test accuracy

Recommend

learning: defense, transferable and camouflaged attacks Xingjun Ma School of Computing and

learning: defense, transferable and camouflaged attacks Xingjun Ma School of Computing and

Recent advances in adversarial machine learning: defense, transferable and camouflaged attacks Xingjun Ma School of Computing and Information Systems The University of Melbourne April 2020 Deep learning models are used everywhere Image

1.12k views • 34 slides
2019 Research Experience for Undergraduates Detection of Data Poisoning Attacks on Image

2019 Research Experience for Undergraduates Detection of Data Poisoning Attacks on Image

2019 Research Experience for Undergraduates Detection of Data Poisoning Attacks on Image Classification Models Harsh Kachhadia Co-Advisors: Dr. Amin Alipour and Dr. Ioannis Kakadiaris Motivation Deep Learning models, due to their

204 views • 19 slides
Poisoning Attacks: p-Tampering and Poison Frogs Simons Robustness Reading Group Bolton Bailey

Poisoning Attacks: p-Tampering and Poison Frogs Simons Robustness Reading Group Bolton Bailey

Poisoning Attacks: p-Tampering and Poison Frogs Simons Robustness Reading Group Bolton Bailey July 1, 2019 What is a Poisoning Attack? Data poisoning is an attack on machine learning models wherein the attacker adds (or modifies) examples

1.28k views • 12 slides
DNS Poisoning: Developments, Attacks and Research Directions Suggestions for the Idle and Curious

DNS Poisoning: Developments, Attacks and Research Directions Suggestions for the Idle and Curious

DNS Poisoning Attack Scenarios Vulnerability Analysis Remedies DNS Poisoning: Developments, Attacks and Research Directions Suggestions for the Idle and Curious Researcher David Dagon 1 1 Georgia Institute of Technology Atlanta, Georgia

327 views • 28 slides
Making deep neural networks robust to label noise: a loss correction approach Giorgio Patrini

Making deep neural networks robust to label noise: a loss correction approach Giorgio Patrini

Making deep neural networks robust to label noise: a loss correction approach Giorgio Patrini 23 July 2017 CVPR, Honolulu joint work with Alessandro Rozza, Aditya Krishna Menon, Richard Nock and Lizhen Qu ANU, Data61, Waynaut, University

508 views • 28 slides
Poisoning Attack Analysis Jeffrey Zhang Universal Multi-Party Poisoning Attacks Saeed

Poisoning Attack Analysis Jeffrey Zhang Universal Multi-Party Poisoning Attacks Saeed

Poisoning Attack Analysis Jeffrey Zhang Universal Multi-Party Poisoning Attacks Saeed Mahloujifar Mohammad Mahmoody Ameer Mohammed, ICML 2019 Multi-party Learning Application: Federated Learning Federated Learning : Train a centralized

590 views • 34 slides
Combating Label Noise in Deep Learning using Abstention Speaker: Sunil Thulasidasan

Combating Label Noise in Deep Learning using Abstention Speaker: Sunil Thulasidasan

Combating Label Noise in Deep Learning using Abstention Speaker: Sunil Thulasidasan sunil@lanl.gov sunil@lanl.gov A Practical Challenge for Deep Learning State-of-the-art models require large amounts of clean , annotated data. sunil@lanl.gov

452 views • 18 slides
Poisoning Attacks on Federated Le Learning-based In Intrusion Detection System Thien Duc

Poisoning Attacks on Federated Le Learning-based In Intrusion Detection System Thien Duc

Poisoning Attacks on Federated Le Learning-based In Intrusion Detection System Thien Duc Nguyen, Phillip Rieger, Markus Miettinen, Ahmad-Reza Sadeghi Typical IoT Devices 2 IoT The S stands for Security 3 Mirai: Largest Disruptive

509 views • 33 slides
ON THE ADVERSARIAL ROBUSTNESS OF UNCERTAINTY AWARE DEEP NEURAL NETWORKS APRIL 29 TH , 2019

ON THE ADVERSARIAL ROBUSTNESS OF UNCERTAINTY AWARE DEEP NEURAL NETWORKS APRIL 29 TH , 2019

ON THE ADVERSARIAL ROBUSTNESS OF UNCERTAINTY AWARE DEEP NEURAL NETWORKS APRIL 29 TH , 2019 PREPARED BY: ALI HARAKEH QUESTION Can a neural network mitigate the effects of adversarial attacks by estimating the uncertainty in its predictions ?

1.14k views • 26 slides
Deep Learning with Neural Networks The Structure and Optimization of Deep Neural Networks Allan

Deep Learning with Neural Networks The Structure and Optimization of Deep Neural Networks Allan

Deep Learning with Neural Networks The Structure and Optimization of Deep Neural Networks Allan Zelener Machine Learning Reading Group January 7 th 2016 The Graduate Center, CUNY Objectives Explain some of the trends of deep learning and

680 views • 44 slides
CVPR 2020 Universal Adversarial Attacks Image agnostic and transferable across networks

CVPR 2020 Universal Adversarial Attacks Image agnostic and transferable across networks

1 1,4 2,3 2 3 4 1 CVPR 2020 Universal Adversarial Attacks Image agnostic and transferable across networks Adversarial No defense: Baseline DNN perturbation Input image Classification Feature extraction dense Perturbed image

592 views • 6 slides
Learning Transferable Features with Deep Adaptation Networks Mingsheng Long 12 , Yue Cao 1 ,

Learning Transferable Features with Deep Adaptation Networks Mingsheng Long 12 , Yue Cao 1 ,

Learning Transferable Features with Deep Adaptation Networks Mingsheng Long 12 , Yue Cao 1 , Jianmin Wang 1 , and Michael I. Jordan 2 1 School of Software, Institute for Data Science Tsinghua University 2 Department of EECS, Department of

732 views • 15 slides
Adversarial Attacks on Node Embeddings via Graph Poisoning Aleksandar Bojchevski, Stephan

Adversarial Attacks on Node Embeddings via Graph Poisoning Aleksandar Bojchevski, Stephan

Adversarial Attacks on Node Embeddings via Graph Poisoning Aleksandar Bojchevski, Stephan Gnnemann Technical University of Munich ICML 2019 Node embeddings are used to Classify scientific papers Recommend items Classify proteins

336 views • 21 slides
Visualizing and Interpreting Deep Neural Networks Bolei Zhou Department of Information

Visualizing and Interpreting Deep Neural Networks Bolei Zhou Department of Information

Visualizing and Interpreting Deep Neural Networks Bolei Zhou Department of Information Engineering The Chinese University of Hong Kong Deep Neural Networks are Everywhere Playing Go Making Medical Decision Understanding Scenes Deep Neural

1.1k views • 46 slides
The Fundamentals of Deep Learning Building Blocks Theory with Applications Neural Units Neural

The Fundamentals of Deep Learning Building Blocks Theory with Applications Neural Units Neural

Deep Learning Antecedents Vision Case Study The Fundamentals of Deep Learning Building Blocks Theory with Applications Neural Units Neural Nets Deep Neural Nets Application ConvNets Jon Krohn LSTMs untapt jon@untapt.com

1.08k views • 106 slides
Deep Neural Nets and Features Sung-Eui Yoon ( ) Course URL:

Deep Neural Nets and Features Sung-Eui Yoon ( ) Course URL:

CS688: Web-Scale Image Search Deep Neural Nets and Features Sung-Eui Yoon ( ) Course URL: http://sgvr.kaist.ac.kr/~sungeui/IR Class Objectives Browse main components of deep neural nets Does not aim for giving in-depth

609 views • 32 slides
Neural Cleanse: Identifying and Mitigating Backdoor Attacks in Neural Networks Bolun Wang*,

Neural Cleanse: Identifying and Mitigating Backdoor Attacks in Neural Networks Bolun Wang*,

Neural Cleanse: Identifying and Mitigating Backdoor Attacks in Neural Networks Bolun Wang*, Yuanshun Yao, Shawn Shan, Huiying Li, Bimal Viswanath , Haitao Zheng, Ben Y. Zhao University of Chicago, *UC Santa Barbara, Virginia Tech

770 views • 17 slides
Deep Neural Networks and Deep Reinforcement Learning Deep Learning, Goodfellow, Bengio and

Deep Neural Networks and Deep Reinforcement Learning Deep Learning, Goodfellow, Bengio and

Deep Neural Networks and Deep Reinforcement Learning Deep Neural Networks and Deep Reinforcement Learning Deep Learning, Goodfellow, Bengio and Courville [chapt. 6,7,8]; AIMA [sect. 21.1-21.3]; Sutton and Barto, Reinforcement Learning: an

527 views • 35 slides
Concise Introduction to Deep Neural Networks Outline: Classification problems Motivating

Concise Introduction to Deep Neural Networks Outline: Classification problems Motivating

Concise Introduction to Deep Neural Networks Outline: Classification problems Motivating Deep (large) Neural Network (DNN) classifiers Neurons and DNN architectures Numerical training of DNNs (supervised deep learning) Spiking

630 views • 33 slides
Resilient Networking 6: Attacks on DNS 1 Chapter Outline Overview of DNS Known attacks

Resilient Networking 6: Attacks on DNS 1 Chapter Outline Overview of DNS Known attacks

Resilient Networking 6: Attacks on DNS 1 Chapter Outline Overview of DNS Known attacks on DNS Denial-of-Service Cache Poisoning Securing DNS Split-Split-DNS DNSSEC 2 DNS The Domain Name System Naming Service

1.15k views • 46 slides
On the Expressive Power of Deep Neural Networks Maithra Raghu, Ben Poole, Jon Kleinberg, Surya

On the Expressive Power of Deep Neural Networks Maithra Raghu, Ben Poole, Jon Kleinberg, Surya

On the Expressive Power of Deep Neural Networks Maithra Raghu, Ben Poole, Jon Kleinberg, Surya Ganguli, Jascha Sohl Dickstein Tom Brady Deep Neural Networks Recent successes in using Deep neural networks for image classification,

1.32k views • 17 slides
Training neural networks Today's lecture Learning from small data Curriculum: Active

Training neural networks Today's lecture Learning from small data Curriculum: Active

Training neural networks Today's lecture Learning from small data Curriculum: Active learning - How transferable are features in deep neural When you are not learning networks? Surrogat losses

1k views • 69 slides
Optimizing Deep Neural Networks Leena Chennuru Vankadara 26-10-2015 Table of Contents Neural

Optimizing Deep Neural Networks Leena Chennuru Vankadara 26-10-2015 Table of Contents Neural

Optimizing Deep Neural Networks Leena Chennuru Vankadara 26-10-2015 Table of Contents Neural Networks and loss surfaces Problems of Deep Architectures Optimization in Neural Networks Under fitting Proliferation of Saddle

1.67k views • 41 slides
Deep Neural Networks Reveal a Gradient in the Complexity of Neural Representations across the

Deep Neural Networks Reveal a Gradient in the Complexity of Neural Representations across the

Deep Neural Networks Reveal a Gradient in the Complexity of Neural Representations across the Ventral Stream Umut Gcl and Marcel A. J. van Gerven Article overview by Ilya Kuzovkin Computational Neuroscience Seminar University of Tartu

852 views • 63 slides

More recommend