论文标题
数据中毒的自动回旋扰动
Autoregressive Perturbations for Data Poisoning
论文作者
论文摘要
从社交媒体上刮擦的一种方法来获取数据集的一种流行率，导致人们对未经授权使用数据的疑问越来越担心。已经提出了数据中毒攻击是一种反对刮擦的堡垒，因为它们通过添加微小的，不可察觉的扰动来使数据“无法获得”。不幸的是，现有方法需要了解目标体系结构和完整的数据集，以便可以训练替代网络，其参数用于生成攻击。在这项工作中，我们引入了自回旋（AR）中毒，这种方法可以生成中毒的数据而无需访问更广泛的数据集。提出的AR扰动是通用的，可以在不同的数据集上应用，并且可以毒化不同的架构。与现有的未脱离方法相比，我们的AR毒物更具抵抗力的防御能力，例如对抗性训练和强大的数据增强。我们的分析进一步洞悉了使有效的数据毒物的原因。
The prevalence of data scraping from social media as a means to obtain datasets has led to growing concerns regarding unauthorized use of data. Data poisoning attacks have been proposed as a bulwark against scraping, as they make data "unlearnable" by adding small, imperceptible perturbations. Unfortunately, existing methods require knowledge of both the target architecture and the complete dataset so that a surrogate network can be trained, the parameters of which are used to generate the attack. In this work, we introduce autoregressive (AR) poisoning, a method that can generate poisoned data without access to the broader dataset. The proposed AR perturbations are generic, can be applied across different datasets, and can poison different architectures. Compared to existing unlearnable methods, our AR poisons are more resistant against common defenses such as adversarial training and strong data augmentations. Our analysis further provides insight into what makes an effective data poison.
