Exploring Model Dynamics for Accumulative Poisoning Discovery
Not on the map. Why?
Abstract (arXiv)
Adversarial poisoning attacks pose huge threats to various machine learning applications. Especially, the recent accumulative poisoning attacks show that it is possible to achieve irreparable harm on models via a sequence of imperceptible attacks followed by a trigger batch. Due to the limited data-level discrepancy in real-time data streaming, current defensive methods are indiscriminate in handling the poison and clean samples. In this paper, we dive into the perspective of model dynamics and propose a novel information measure, namely, Memorization Discrepancy, to explore the defense via the model-level information. By implicitly transferring the changes in the data manipulation to that in the model outputs, Memorization Discrepancy can discover the imperceptible poison samples based on their distinct dynamics from the clean samples. We thoroughly explore its properties and propose Discrepancy-aware Sample Correction (DSC) to defend against accumulative poisoning attacks. Extensive experiments comprehensively characterized Memorization Discrepancy and verified its effectiveness. The code is publicly available at: https://github.com/tmlr-group/Memorization-Discrepancy.
Key facts. No citing papers in the map yet (data through 14 Oct 2026). Builds on 30 of its 47 references that are in the map. First posted on arXiv 6 Jun 2023.
Builds on
30 of 47 references.
References · 30
- 2015Deep Residual Learning for Image Recognitioncited by 52,096
- 2018BERT: Pre-training of Deep Bidirectional Transformers for Language Understandingcited by 40,399
- 2014Very Deep Convolutional Networks for Large-Scale Image Recognitioncited by 15,364
- 2014Explaining and Harnessing Adversarial Examplescited by 7,364
- 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,415
- 2021On the Opportunities and Risks of Foundation Modelscited by 4,033
- 2019Advances and Open Problems in Federated Learningcited by 3,046
- 2016Towards Evaluating the Robustness of Neural Networkscited by 2,998
- 2017Understanding Black-box Predictions via Influence Functionscited by 1,741
- 2019Theoretically Principled Trade-off between Robustness and Accuracycited by 1,517
- 2020On Adaptive Attacks to Adversarial Example Defensescited by 555
- 2018Poison Frogs! Targeted Clean-Label Poisoning Attacks on Neural Networkscited by 519
18 more
- 2017Wild Patterns: Ten Years After the Rise of Adversarial Machine Learningcited by 414
- 2017Certified Defenses for Data Poisoning Attackscited by 303
- 2018Characterizing Adversarial Subspaces Using Local Intrinsic Dimensionalitycited by 282
- 2021Anti-Backdoor Learning: Training Clean Models on Poisoned Datacited by 263
- 2017Detecting Adversarial Samples from Artifactscited by 245
- 2020Attacks Which Do Not Kill Training Make Adversarial Learning Strongercited by 243
- 2021Unlearnable Examples: Making Personal Data Unexploitablecited by 193
- 2020Dataset Security for Machine Learning: Data Poisoning, Backdoor Attacks, and Defensescited by 180
- 2018MMA Training: Direct Input Space Margin Maximization through Adversarial Trainingcited by 172
- 2020Adversarial Machine Learning -- Industry Perspectivescited by 122
- 2021Adversarial Examples Make Strong Poisonscited by 119
- 2020Strong Data Augmentation Sanitizes Poisoning and Backdoor Attacks Without an Accuracy Tradeoffcited by 89
- 2016Data Poisoning Attacks on Factorization-Based Collaborative Filteringcited by 83
- 2018Label Sanitization against Label Flipping Poisoning Attackscited by 73
- 2019Learning to Confuse: Generating Training Time Adversarial Data with Auto-Encodercited by 70
- 2021Better Safe Than Sorry: Preventing Delusive Adversaries with Adversarial Trainingcited by 59
- 2018Data Poisoning Attacks against Online Learningcited by 27
- 2021Accumulative Poisoning Attacks on Real-time Datacited by 10
Built on by
Not cited yet.