Saved in:
| Main Authors: | , , , , , |
|---|---|
| Format: | Preprint |
| Published: |
2024
|
| Subjects: | |
| Online Access: | https://arxiv.org/abs/2412.03908 |
| Tags: |
Add Tag
No Tags, Be the first to tag this record!
|
| _version_ | 1866913960056324096 |
|---|---|
| author | Chen, Zhizhen Zhao, Zhengyu Dutta, Subrat Kishore Lin, Chenhao Shen, Chao Zhang, Xiao |
| author_facet | Chen, Zhizhen Zhao, Zhengyu Dutta, Subrat Kishore Lin, Chenhao Shen, Chao Zhang, Xiao |
| contents | Targeted data poisoning (TDP) aims to compromise the model's prediction on a specific (test) target by perturbing a small subset of training data. Existing work on TDP has focused on an overly ideal threat model in which the same image sample of the target is used during both poisoning and inference stages. However, in the real world, a target object often appears in complex variations due to changes of physical settings such as viewpoint, background, and lighting conditions. In this work, we take the first step toward understanding the real-world threats of TDP by studying its generalizability across varying physical conditions. In particular, we observe that solely optimizing gradient directions, as adopted by the best previous TDP method, achieves limited generalization. To address this limitation, we propose optimizing both the gradient direction and magnitude for more generalizable gradient matching, thereby leading to higher poisoning success rates. For instance, our method outperforms the state of the art by 19.49% when poisoning CIFAR-10 images targeting multi-view cars. |
| format | Preprint |
| id |
arxiv_https___arxiv_org_abs_2412_03908 |
| institution | arXiv |
| publishDate | 2024 |
| record_format | arxiv |
| spellingShingle | Generalizable Targeted Data Poisoning against Varying Physical Objects Chen, Zhizhen Zhao, Zhengyu Dutta, Subrat Kishore Lin, Chenhao Shen, Chao Zhang, Xiao Computer Vision and Pattern Recognition Cryptography and Security Machine Learning Targeted data poisoning (TDP) aims to compromise the model's prediction on a specific (test) target by perturbing a small subset of training data. Existing work on TDP has focused on an overly ideal threat model in which the same image sample of the target is used during both poisoning and inference stages. However, in the real world, a target object often appears in complex variations due to changes of physical settings such as viewpoint, background, and lighting conditions. In this work, we take the first step toward understanding the real-world threats of TDP by studying its generalizability across varying physical conditions. In particular, we observe that solely optimizing gradient directions, as adopted by the best previous TDP method, achieves limited generalization. To address this limitation, we propose optimizing both the gradient direction and magnitude for more generalizable gradient matching, thereby leading to higher poisoning success rates. For instance, our method outperforms the state of the art by 19.49% when poisoning CIFAR-10 images targeting multi-view cars. |
| title | Generalizable Targeted Data Poisoning against Varying Physical Objects |
| topic | Computer Vision and Pattern Recognition Cryptography and Security Machine Learning |
| url | https://arxiv.org/abs/2412.03908 |