Features which are robust to adversarial attacks are also robust to several poisoning attacks
Résumé
Most data poisoning methods target naive deep networks. Yet, it is well known that those networks exhibit strong sensitivity to perturbations. Inversely, in this paper, I show that several data poisoning attacks (e.g. poison frog) are ineffective as soon as there are applied on features made robust to adversarial attacks, on both CIFAR and MNIST datasets. This result stresses that some state of the art data poisoning results may have been corrupted by adversarial sensibility and should be further checked on robust networks instead of naive ones. Code is available at github.com/achanhon/AdversarialModel/V4.
Fichier principal
DTIS2021-101-DTIS2021-101-Acceptée-Acceptée.pdf (382.73 Ko)
Télécharger le fichier
Origine | Fichiers produits par l'(les) auteur(s) |
---|