论文标题
针对数据中毒攻击的基于随机选择的认证防御框架的框架
A Framework of Randomized Selection Based Certified Defenses Against Data Poisoning Attacks
论文作者
论文摘要
神经网络分类器容易受到数据中毒攻击的影响，因为攻击者可以降低甚至操纵其预测，只能彻底毒化几个培训样本。但是，启发式防御的鲁棒性很难衡量。基于选择的防御能力可以通过平均分类器对从训练集采样的子数据集的预测来实现认证的鲁棒性。本文提出了一个针对数据中毒攻击的基于随机选择的防御措施的框架。具体而言，我们证明满足某些条件的随机选择方案与数据中毒攻击具有鲁棒性。我们还得出了合格的随机选择方案的认证半径的分析形式。我们的框架得出的袋装半径比以前的工作更紧。我们的框架使用户通过利用有关训练集和中毒模型的先验知识来提高鲁棒性。考虑到更高水平的先验知识，我们可以在理论上和实际上都能达到更高的认证准确性。根据三个基准数据集的实验：MNIST 1/7，MNIST和CIFAR-10，我们的方法的表现优于最先进的方法。
Neural network classifiers are vulnerable to data poisoning attacks, as attackers can degrade or even manipulate their predictions thorough poisoning only a few training samples. However, the robustness of heuristic defenses is hard to measure. Random selection based defenses can achieve certified robustness by averaging the classifiers' predictions on the sub-datasets sampled from the training set. This paper proposes a framework of random selection based certified defenses against data poisoning attacks. Specifically, we prove that the random selection schemes that satisfy certain conditions are robust against data poisoning attacks. We also derive the analytical form of the certified radius for the qualified random selection schemes. The certified radius of bagging derived by our framework is tighter than the previous work. Our framework allows users to improve robustness by leveraging prior knowledge about the training set and the poisoning model. Given higher level of prior knowledge, we can achieve higher certified accuracy both theoretically and practically. According to the experiments on three benchmark datasets: MNIST 1/7, MNIST, and CIFAR-10, our method outperforms the state-of-the-art.
