How to Craft Backdoors with Unlabeled Data Alone?

• URL: http://arxiv.org/abs/2404.06694v2
• Date: Mon, 22 Apr 2024 21:27:36 GMT
• Title: How to Craft Backdoors with Unlabeled Data Alone?
• Authors: Yifei Wang, Wenhan Ma, Stefanie Jegelka, Yisen Wang,
• Abstract summary: Self-supervised learning (SSL) can learn rich features in an economical and scalable way. If the released dataset is maliciously poisoned, backdoored SSL models can behave badly when triggers are injected to test samples. We propose two strategies for poison selection: clustering-based selection using pseudolabels, and contrastive selection derived from the mutual information principle.
• Score: 54.47006163160948
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: Relying only on unlabeled data, Self-supervised learning (SSL) can learn rich features in an economical and scalable way. As the drive-horse for building foundation models, SSL has received a lot of attention recently with wide applications, which also raises security concerns where backdoor attack is a major type of threat: if the released dataset is maliciously poisoned, backdoored SSL models can behave badly when triggers are injected to test samples. The goal of this work is to investigate this potential risk. We notice that existing backdoors all require a considerable amount of \emph{labeled} data that may not be available for SSL. To circumvent this limitation, we explore a more restrictive setting called no-label backdoors, where we only have access to the unlabeled data alone, where the key challenge is how to select the proper poison set without using label information. We propose two strategies for poison selection: clustering-based selection using pseudolabels, and contrastive selection derived from the mutual information principle. Experiments on CIFAR-10 and ImageNet-100 show that both no-label backdoors are effective on many SSL methods and outperform random poisoning by a large margin. Code will be available at https://github.com/PKU-ML/nlb.

Related papers

• Phantom: Untargeted Poisoning Attacks on Semi-Supervised Learning (Full Version) [19.99079192245235]
  We introduce Phantom, the first untargeted poisoning attack in Semi-Supervised Learning (SSL) Our approach only requires adding few manipulated samples, such as posting images on social networks, without the need to control the victim. Our findings demonstrate the threat of poisoning user-generated content platforms, rendering them unsuitable for SSL in specific tasks.
  arXiv  Detail & Related papers  (2024-09-02T21:29:05Z)
• EmInspector: Combating Backdoor Attacks in Federated Self-Supervised Learning Through Embedding Inspection [53.25863925815954]
  Federated self-supervised learning (FSSL) has emerged as a promising paradigm that enables the exploitation of clients' vast amounts of unlabeled data. While FSSL offers advantages, its susceptibility to backdoor attacks has not been investigated. We propose the Embedding Inspector (EmInspector) that detects malicious clients by inspecting the embedding space of local models.
  arXiv  Detail & Related papers  (2024-05-21T06:14:49Z)
• Towards Adversarial Robustness And Backdoor Mitigation in SSL [0.562479170374811]
  Self-Supervised Learning (SSL) has shown great promise in learning representations from unlabeled data. SSL methods have recently been shown to be vulnerable to backdoor attacks. This work aims to address defending against backdoor attacks in SSL.
  arXiv  Detail & Related papers  (2024-03-23T19:21:31Z)
• Does Few-shot Learning Suffer from Backdoor Attacks? [63.9864247424967]
  We show that few-shot learning can still be vulnerable to backdoor attacks. Our method demonstrates a high Attack Success Rate (ASR) in FSL tasks with different few-shot learning paradigms. This study reveals that few-shot learning still suffers from backdoor attacks, and its security should be given attention.
  arXiv  Detail & Related papers  (2023-12-31T06:43:36Z)
• Erasing Self-Supervised Learning Backdoor by Cluster Activation Masking [65.44477004525231]
  Researchers have recently found that Self-Supervised Learning (SSL) is vulnerable to backdoor attacks. In this paper, we propose to erase the SSL backdoor by cluster activation masking and propose a novel PoisonCAM method. Our method achieves 96% accuracy for backdoor trigger detection compared to 3% of the state-of-the-art method on poisoned ImageNet-100.
  arXiv  Detail & Related papers  (2023-12-13T08:01:15Z)
• SSL-Cleanse: Trojan Detection and Mitigation in Self-Supervised Learning [27.68997463681079]
  Self-supervised learning (SSL) is a prevalent approach for encoding data representations. Trojan attacks embedded in SSL encoders can operate covertly, spreading across multiple users and devices. We introduce SSL-Cleanse as a solution to identify and mitigate backdoor threats in SSL encoders.
  arXiv  Detail & Related papers  (2023-03-16T04:45:06Z)
• An Embarrassingly Simple Backdoor Attack on Self-supervised Learning [52.28670953101126]
  Self-supervised learning (SSL) is capable of learning high-quality representations of complex data without relying on labels. We study the inherent vulnerability of SSL to backdoor attacks.
  arXiv  Detail & Related papers  (2022-10-13T20:39:21Z)
• Robust Deep Semi-Supervised Learning: A Brief Introduction [63.09703308309176]
  Semi-supervised learning (SSL) aims to improve learning performance by leveraging unlabeled data when labels are insufficient. SSL with deep models has proven to be successful on standard benchmark tasks. However, they are still vulnerable to various robustness threats in real-world applications.
  arXiv  Detail & Related papers  (2022-02-12T04:16:41Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.