Current browse context:
cs.CR
Change to browse by:
References & Citations
Computer Science > Cryptography and Security
Title: DeepPoison: Feature Transfer Based Stealthy Poisoning Attack
(Submitted on 6 Jan 2021 (v1), last revised 8 Jan 2021 (this version, v2))
Abstract: Deep neural networks are susceptible to poisoning attacks by purposely polluted training data with specific triggers. As existing episodes mainly focused on attack success rate with patch-based samples, defense algorithms can easily detect these poisoning samples. We propose DeepPoison, a novel adversarial network of one generator and two discriminators, to address this problem. Specifically, the generator automatically extracts the target class' hidden features and embeds them into benign training samples. One discriminator controls the ratio of the poisoning perturbation. The other discriminator works as the target model to testify the poisoning effects. The novelty of DeepPoison lies in that the generated poisoned training samples are indistinguishable from the benign ones by both defensive methods and manual visual inspection, and even benign test samples can achieve the attack. Extensive experiments have shown that DeepPoison can achieve a state-of-the-art attack success rate, as high as 91.74%, with only 7% poisoned samples on publicly available datasets LFW and CASIA. Furthermore, we have experimented with high-performance defense algorithms such as autodecoder defense and DBSCAN cluster detection and showed the resilience of DeepPoison.
Submission history
From: Zhanglongyuan Longyuan [view email][v1] Wed, 6 Jan 2021 15:45:36 GMT (12350kb,D)
[v2] Fri, 8 Jan 2021 04:07:19 GMT (12389kb,D)
Link back to: arXiv, form interface, contact.