Abstract:Machine learning models have achieved great success in supervised learning tasks for end-to-end training, which requires a large amount of labeled data that is not always feasible. Recently, many practitioners have shifted to self-supervised learning methods that utilize cheap unlabeled data to learn a general feature extractor via pre-training, which can be further applied to personalized downstream tasks by simply training an additional linear layer with limited labeled data. However, such a process may also raise concerns regarding data poisoning attacks. For instance, indiscriminate data poisoning attacks, which aim to decrease model utility by injecting a small number of poisoned data into the training set, pose a security risk to machine learning models, but have only been studied for end-to-end supervised learning. In this paper, we extend the exploration of the threat of indiscriminate attacks on downstream tasks that apply pre-trained feature extractors. Specifically, we propose two types of attacks: (1) the input space attacks, where we modify existing attacks to directly craft poisoned data in the input space. However, due to the difficulty of optimization under constraints, we further propose (2) the feature targeted attacks, where we mitigate the challenge with three stages, firstly acquiring target parameters for the linear head; secondly finding poisoned features by treating the learned feature representations as a dataset; and thirdly inverting the poisoned features back to the input space. Our experiments examine such attacks in popular downstream tasks of fine-tuning on the same dataset and transfer learning that considers domain adaptation. Empirical results reveal that transfer learning is more vulnerable to our attacks. Additionally, input space attacks are a strong threat if no countermeasures are posed, but are otherwise weaker than feature targeted attacks.

From Adversarial Examples to Data Poisoning Instances: Utilizing an Adversarial Attack Method to Poison a Transfer Learning Model

Clean-image Backdoor: Attacking Multi-label Models with Poisoned Labels Only

Assessing Vulnerabilities of Adversarial Learning Algorithm through Poisoning Attacks

Invisible Poisoning: Highly Stealthy Targeted Poisoning Attack

Transferable Availability Poisoning Attacks

MetaPoison: Practical General-purpose Clean-label Data Poisoning

Poisoning-based Backdoor Attacks for Arbitrary Target Label with Positive Triggers

Wicked Oddities: Selectively Poisoning for Effective Clean-Label Backdoor Attacks

Transferable Clean-Label Poisoning Attacks on Deep Neural Nets

A Concealed Poisoning Attack to Reduce Deep Neural Networks’ Robustness Against Adversarial Samples

Hidden Poison: Machine Unlearning Enables Camouflaged Poisoning Attacks

Amplifying Membership Exposure via Data Poisoning

Concealed Data Poisoning Attacks on NLP Models

Class-Targeted Poisoning Attacks Against DNNs

Witches' Brew: Industrial Scale Data Poisoning via Gradient Matching

Accumulative Poisoning Attacks on Real-time Data

Learning to Poison Large Language Models During Instruction Tuning

De-Pois: An Attack-Agnostic Defense against Data Poisoning Attacks

Indiscriminate Data Poisoning Attacks on Pre-trained Feature Extractors

Poison Forensics: Traceback of Data Poisoning Attacks in Neural Networks

Exploring the Limits of Model-Targeted Indiscriminate Data Poisoning Attacks