论文标题
Bullseye Polytope：可扩展的清洁标签中毒攻击，可提高可转移性
Bullseye Polytope: A Scalable Clean-Label Poisoning Attack with Improved Transferability
论文作者
论文摘要
神经网络安全性的最新来源是清洁标签数据集中毒攻击的出现，其中正确标记的毒药样本被注入培训数据集中。尽管这些毒药样本对人类观察者来说是合法的，但它们包含恶意特征，这些特征会触发推断期间有针对性的错误分类。我们提出了针对转移学习的可扩展和可转移的清洁标签中毒攻击，该攻击在特征空间中的目标图像附近创建了毒图像。我们的攻击，靶心多层，在端到端转移学习中，将当前最新面临的攻击成功率提高了26.75％，同时将攻击速度提高了12倍。我们通过在毒药样品（例如，从不同的角度）加入了同一对象的多个图像（例如，从不同的角度）将Bullseye Polytope扩展到更实用的攻击模型。我们证明，此扩展将攻击转移性提高了16％以上，以在不使用额外的毒品样本的情况下（同一物体的）图像（同一物体的）图像。
A recent source of concern for the security of neural networks is the emergence of clean-label dataset poisoning attacks, wherein correctly labeled poison samples are injected into the training dataset. While these poison samples look legitimate to the human observer, they contain malicious characteristics that trigger a targeted misclassification during inference. We propose a scalable and transferable clean-label poisoning attack against transfer learning, which creates poison images with their center close to the target image in the feature space. Our attack, Bullseye Polytope, improves the attack success rate of the current state-of-the-art by 26.75% in end-to-end transfer learning, while increasing attack speed by a factor of 12. We further extend Bullseye Polytope to a more practical attack model by including multiple images of the same object (e.g., from different angles) when crafting the poison samples. We demonstrate that this extension improves attack transferability by over 16% to unseen images (of the same object) without using extra poison samples.
