Poisons that are learned faster are more effective

2022 IEEE/CVF Conference on Computer Vision and Pattern Recognition Workshops (CVPRW)(2022)

引用 8|浏览45
Imperceptible poisoning attacks on entire datasets have recently been touted as methods for protecting data privacy. However, among a number of defenses preventing the practical use of these techniques, early-stopping stands out as a simple, yet effective defense. To gauge poisons’ vulnerability to early-stopping, we benchmark error-minimizing, error-maximizing, and synthetic poisons in terms of peak test accuracy over 100 epochs and make a number of surprising observations. First, we find that poisons that reach a low training loss faster have lower peak test accuracy. Second, we find that a current state-of-the-art error-maximizing poison is 7× less effective when poison training is stopped at epoch 8. Third, we find that stronger, more transferable adversarial attacks do not make stronger poisons. We advocate for evaluating poisons in terms of peak test accuracy.
imperceptible poisoning attacks,entire datasets,data privacy,defenses,early-stopping,effective defense,benchmark error-minimizing,synthetic poisons,low training loss,lower peak test accuracy,current state-of-the-art error-maximizing poison,poison training,stronger adversarial attacks,more transferable adversarial attacks,stronger poisons
AI 理解论文
Chat Paper