BrainWash: A Poisoning Attack to Forget in Continual Learning

Ali Abbasi,Parsa Nooralinejad,Hamed Pirsiavash,Soheil Kolouri
2023-11-24
Abstract:Continual learning has gained substantial attention within the deep learning community, offering promising solutions to the challenging problem of sequential learning. Yet, a largely unexplored facet of this paradigm is its susceptibility to adversarial attacks, especially with the aim of inducing forgetting. In this paper, we introduce "BrainWash," a novel data poisoning method tailored to impose forgetting on a continual learner. By adding the BrainWash noise to a variety of baselines, we demonstrate how a trained continual learner can be induced to forget its previously learned tasks catastrophically, even when using these continual learning baselines. An important feature of our approach is that the attacker requires no access to previous tasks' data and is armed merely with the model's current parameters and the data belonging to the most recent task. Our extensive experiments highlight the efficacy of BrainWash, showcasing degradation in performance across various regularization-based continual learning methods.
Machine Learning,Artificial Intelligence,Cryptography and Security
What problem does this paper attempt to address?
### What problem does this paper attempt to solve? This paper aims to explore and solve the vulnerability problem of Continual Learning (CL) systems when facing adversarial attacks, especially attacks that induce forgetting. Specifically, the author proposes a new data - poisoning method named "BrainWash" to attack the continual learning model and make it forget the tasks it has learned before. #### Main problems: 1. **Adversarial attacks on continual learning systems**: Although continual learning performs well in handling continuous data streams, its resistance to adversarial attacks has not been fully studied. This paper focuses in particular on how to significantly reduce the model's performance on previous tasks by poisoning the data of the current task, that is, inducing forgetting. 2. **Minimizing the attacker's requirements**: The attacker only needs to access the current parameters of the model and the data of the most recent task, without the need to know the data of previous tasks or the specific continual learning algorithm. This makes the attack more realistic and difficult to prevent. 3. **Verifying the effectiveness of the attack**: Through extensive experiments, verify the effectiveness of the BrainWash attack on different benchmark datasets and multiple regularization - based continual learning algorithms. #### Specific objectives: - Design a new data - poisoning attack method (BrainWash) specifically for regularization - based continual learning methods to maximize forgetting of previous tasks. - Demonstrate the effects of the BrainWash attack in different scenarios, including the "Reckless Threat Model" and the "Cautious Threat Model". - Provide a detailed ablation study to gain a deep understanding of the working mechanism of BrainWash and its impact. ### Brief summary: This paper reveals the vulnerability of continual learning systems in the face of adversarial attacks by introducing the BrainWash attack, and shows how to significantly reduce the model's memory of previous tasks by cleverly manipulating the data of the current task. This research not only poses challenges to the security of continual learning, but also provides an important reference for future defense mechanisms. --- If you have more specific questions or need further explanation, please feel free to let me know!