DeepPoison: Feature Transfer Based Stealthy Poisoning Attack for DNNs

Abstract

Deep neural networks are susceptible to poisoning attacks by purposely polluted training data with specific triggers. As existing episodes mainly focused on attack success rate with patch-based samples, defense algorithms can easily detect these poisoning samples. We propose DeepPoison, a novel adversarial network of one generator and two discriminators, to address this problem. Specifically, the generator automatically extracts the target class' hidden features and embeds them into benign training samples. One discriminator controls the ratio of the poisoning perturbation. The other discriminator works as the target model to testify the poisoning effects. The novelty of DeepPoison lies in that the generated poisoned training samples are indistinguishable from the benign ones by both defensive methods and manual visual inspection, and even benign test samples can achieve the attack. Extensive experiments have shown that DeepPoison can achieve a state-of-the-art attack success rate, as high as 91.74%, with only 7% poisoned samples on publicly available datasets LFW and CASIA. Furthermore, we have experimented with high-performance defense algorithms such as autodecoder defense and DBSCAN cluster detection and showed the resilience of DeepPoison.

Poisoning Attacks and Defenses on Artificial Intelligence: A Survey

“…This approach is more efficient since it does not rely on attacking capability, then the number of samples necessary to cause the target model to drop in accuracy is minimum. A clear example of this is shown in DeepPoison [48] where only 7% of poisoned samples were required to cause an devastating 91% drop in accuracy, demostrating superior robustness when compared to other poisoning schemes such as: BadNets [58], Poison Frog [79], Invisible Poisoning attack [50], Fault Sneaking attack [80] and various backdoor attacks [81]- [83].…”

“…Chen et al [48] proposes DeepPoison as stealthy featurebased data poisoning attack, capable of generating poisoned training samples indistinguishable from the honest samplies for human visual inspection, then making the poisoned samples mush less identifiable throughout the training process. Also the scheme proposed displays high resistance against other defense methods, since many existing defenses account for attack success rates deployed with patch-based poisoning samples.…”

HaS-Net: A Heal and Select Mechanism to Securely Train DNNs against Backdoor Attacks

“…Turner et al [39] exploit Generative Adversarial Networks (GANs) [18] to generate a label-consistent backdoor attack, where the label of an adversarially poisoned sample is consistent for a human observer but inconsistent for the targeted DNN. Chen et al [6] extend the same idea by utilizing GANs to generate imperceptible adversarial perturbations. Another similar work [9] leverages Style-GAN to generate the poisoned samples.…”

“…We evaluate -attack on different types of defenses: (1) Februus 3 [12] (2) STRIP-ViTA 3 [17], (3) ULPdefense 4 [23] (4) Gradient-shaping 5 [20] and (5) Artificial Brain Stimulation (ABS) 4 [29]. We show that if the attacker uses -attack to poison the model, all these defenses can be significantly compromised, except Februus, which uses heatmaps 6 , instead of the statistical features, for input masking and reconstruction. Februus analyzes the model gradients for a given input to identify key regions contributing to the final decision of the model.…”

“…ULP-and ABS-defenses detect the poisoned model itself without a poisoned input 5. Gradient shaping securely trains a DNN against backdoor attacks 6. Heatmaps are gradients of a DNN output w.r.t.…”