Abstract:Deep Neural Networks (DNNs) can handle increasingly complex tasks, albeit they require rapidly expanding training datasets. Collecting data from platforms with user-generated content, such as social networks, has significantly eased the acquisition of large datasets for training DNNs. Despite these advancements, the manual labeling process remains a substantial challenge in terms of both time and cost. In response, Semi-Supervised Learning (SSL) approaches have emerged, where only a small fraction of the dataset needs to be labeled, leaving the majority unlabeled. However, leveraging data from untrusted sources like social networks also creates new security risks, as potential attackers can easily inject manipulated samples. Previous research on the security of SSL primarily focused on injecting backdoors into trained models, while less attention was given to the more challenging untargeted poisoning attacks. In this paper, we introduce Phantom, the first untargeted poisoning attack in SSL that disrupts the training process by injecting a small number of manipulated images into the unlabeled dataset. Unlike existing attacks, our approach only requires adding few manipulated samples, such as posting images on social networks, without the need to control the victim. Phantom causes SSL algorithms to overlook the actual images' pixels and to rely only on maliciously crafted patterns that \ourname superimposed on the real images. We show Phantom's effectiveness for 6 different datasets and 3 real-world social-media platforms (Facebook, Instagram, Pinterest). Already small fractions of manipulated samples (e.g., 5\%) reduce the accuracy of the resulting model by 10\%, with higher percentages leading to a performance comparable to a naive classifier. Our findings demonstrate the threat of poisoning user-generated content platforms, rendering them unsuitable for SSL in specific tasks.

Unlabeled Backdoor Poisoning in Semi-Supervised Learning

Unlabeled Backdoor Poisoning on Trained-from-scratch Semi-Supervised Learning

Trojaning semi-supervised learning model via poisoning wild images on the web

How to Craft Backdoors with Unlabeled Data Alone?

Clean-image Backdoor: Attacking Multi-label Models with Poisoned Labels Only

Deep Neural Backdoor in Semi-Supervised Learning: Threats and Countermeasures

Poisoning the Unlabeled Dataset of Semi-Supervised Learning

An Embarrassingly Simple Backdoor Attack on Self-supervised Learning

Clean-Annotation Backdoor Attack against Lane Detection Systems in the Wild

Erasing Self-Supervised Learning Backdoor by Cluster Activation Masking

Phantom: Untargeted Poisoning Attacks on Semi-Supervised Learning (Full Version)

Exploiting Supervised Poison Vulnerability to Strengthen Self-Supervised Defense

Under-confidence Backdoors Are Resilient and Stealthy Backdoors

Wicked Oddities: Selectively Poisoning for Effective Clean-Label Backdoor Attacks

Exploiting Machine Unlearning for Backdoor Attacks in Deep Learning System

Circumventing Backdoor Defenses That Are Based on Latent Separability

Defending Against Repetitive Backdoor Attacks on Semi-supervised Learning through Lens of Rate-Distortion-Perception Trade-off

Poisoning-based Backdoor Attacks for Arbitrary Target Label with Positive Triggers

A Unified Framework for Data Poisoning Attack to Graph-based Semi-supervised Learning

Silent Killer: A Stealthy, Clean-Label, Black-Box Backdoor Attack

Self-supervised learning backdoor defense mixed with self-attention mechanism