Enhancing the Antidote: Improved Pointwise Certifications against Poisoning Attacks
Fuente:
arXiv
Saved in:
| Main Authors: | , , , , |
|---|---|
| Format: | Preprint |
| Published: |
2023
|
| Subjects: | |
| Online Access: | |
| Tags: |
Add Tag
No Tags, Be the first to tag this record!
|
| _version_ | 1866917615757164544 |
|---|---|
| author | Liu, Shijie Cullen, Andrew C. Montague, Paul Erfani, Sarah M. Rubinstein, Benjamin I. P. |
| author_facet | Liu, Shijie Cullen, Andrew C. Montague, Paul Erfani, Sarah M. Rubinstein, Benjamin I. P. |
| contents | Poisoning attacks can disproportionately influence model behaviour by making small changes to the training corpus. While defences against specific poisoning attacks do exist, they in general do not provide any guarantees, leaving them potentially countered by novel attacks. In contrast, by examining worst-case behaviours Certified Defences make it possible to provide guarantees of the robustness of a sample against adversarial attacks modifying a finite number of training samples, known as pointwise certification. We achieve this by exploiting both Differential Privacy and the Sampled Gaussian Mechanism to ensure the invariance of prediction for each testing instance against finite numbers of poisoned examples. In doing so, our model provides guarantees of adversarial robustness that are more than twice as large as those provided by prior certifications. |
| format | Preprint |
| id |
arxiv_https___arxiv_org_abs_2308_07553 |
| institution | arXiv |
| publishDate | 2023 |
| record_format | arxiv |
| spellingShingle | Enhancing the Antidote: Improved Pointwise Certifications against Poisoning Attacks Liu, Shijie Cullen, Andrew C. Montague, Paul Erfani, Sarah M. Rubinstein, Benjamin I. P. Machine Learning Cryptography and Security Poisoning attacks can disproportionately influence model behaviour by making small changes to the training corpus. While defences against specific poisoning attacks do exist, they in general do not provide any guarantees, leaving them potentially countered by novel attacks. In contrast, by examining worst-case behaviours Certified Defences make it possible to provide guarantees of the robustness of a sample against adversarial attacks modifying a finite number of training samples, known as pointwise certification. We achieve this by exploiting both Differential Privacy and the Sampled Gaussian Mechanism to ensure the invariance of prediction for each testing instance against finite numbers of poisoned examples. In doing so, our model provides guarantees of adversarial robustness that are more than twice as large as those provided by prior certifications. |
| title | Enhancing the Antidote: Improved Pointwise Certifications against Poisoning Attacks |
| topic | Machine Learning Cryptography and Security |
| url | https://arxiv.org/abs/2308.07553 |