An f-Divergence-Based Certified Robustness Framework Against Backdoor Poisoning Attacks
A Certified Robustness Framework for Backdoor Poisoning Attacks using $f$-Divergences
Translation in progress — untranslated text is omitted.
Researchers propose a certified robustness framework based on f-divergence for defending against data poisoning and backdoor poisoning attacks. The framework randomizes inputs by combining data subsampling with noise added to features, labels and test samples, and provides a composable certification procedure that can handle any combination of threat model and noise-adding strategy, covering several previous certification mechanisms as special cases. The authors state that the experiments provide, for the first time, certification for poisoning adversaries under general ℓp constraints with bagging combined with Laplace, Gaussian and Uniform noise.
- Machine learning systems trained on untrusted data face data poisoning and backdoor poisoning attacks; the authors argue that existing randomized smoothing certified defenses apply only to specific threat models and simple smoothing mechanisms, and struggle to handle composite threats.
- The threat model is decomposed into four independent axes: number of contaminated samples, feature, label, and test perturbation; the smoothing mechanism combines data subsampling (bagging) with feature, label, and test noise; certification is reduced to convex optimization under f-divergence constraints, and a recombination joint convexity bound is used to handle the mixture distribution.
- Certifies ℓ1, ℓ2, ℓ∞ feature adversaries on MNIST, CIFAR10, and binary classification variants; the authors report that under the backdoor adversary the method in this paper is clearly better than RAB (still above 45% at R=2% on MNIST-17, while RAB drops to zero after R=0.5%), and exactly reproduces the certificates of Jia et al. and BagFlip.
- The authors note that the method requires training thousands of base learners, does not exploit dataset or base-learner properties, and that the trade-off between subsampling and noise addition is insufficiently understood; experiments cover only image classification on MNIST, CIFAR10, and their binary variants.
Related events and news
1 events · 0 news mentions
- This event's paper
研究者提出基于f散度的后门投毒认证鲁棒性框架
Related papers
- Why Backdooring Neural Networks is so Easy?Analysis / interpretabilityarXiv