Transferable Availability Poisoning Attacks
Yiyong Liu Michael Backes Xiao Zhang
We consider availability data poisoning attacks, where an adversary aims to
degrade the overall test accuracy of a machine learning model by crafting small
perturbations to its training data. Existing poisoning strategies can achieve
the attack goal but assume the victim to employ the same learning method as
what the adversary uses to mount the attack. In this paper, we argue that this
assumption is strong, since the victim may choose any learning algorithm to
train the model as long as it can achieve some targeted performance on clean
data. Empirically, we observe a large decrease in the effectiveness of prior
poisoning attacks if the victim uses a different learning paradigm to train the
model and show marked differences in frequency-level characteristics between
perturbations generated with respect to different learners and attack methods.
To enhance the attack transferability, we propose Transferable Poisoning, which
generates high-frequency poisoning perturbations by alternately leveraging the
gradient information with two specific algorithms selected from supervised and
unsupervised contrastive learning paradigms. Through extensive experiments on
benchmark image datasets, we show that our transferable poisoning attack can
produce poisoned samples with significantly improved transferability, not only
applicable to the two learners used to devise the attack but also for learning
algorithms and even paradigms beyond.