Indiscriminate Poisoning Attacks on Unsupervised Contrastive Learning
Authors: Hao He
Kaiwen Zha
Dina Katabi
Venue: ICLR 2023 notable top 25% (2023)
Keywords: data poisoning
contrastive learning

Abstract: Indiscriminate data poisoning attacks are quite effective against supervised learning. However, not much is known about their impact on unsupervised contrastive learning (CL). This paper is the first to consider indiscriminate poisoning attacks of contrastive learning. We propose Contrastive Poisoning (CP), the first effective such attack on CL. We empirically show that Contrastive Poisoning, not only drastically reduces the performance of CL algorithms, but also attacks supervised learning models, making it the most generalizable indiscriminate poisoning attack. We also show that CL algorithms with a momentum encoder are more robust to indiscriminate poisoning, and propose a new countermeasure based on matrix completion. Code is available at: https://github.com/kaiwenzha/contrastive-poisoning.

Published as a conference paper at ICLR 2023
INDISCRIMINATE POISONING ATTACKS ON UNSUPER- VISED CONTRASTIVE LEARNING
Hao He", Kaiwen Zha", Dina Katabi Computer Science and Artificial Intelligence Lab Massachusetts Institute of Technology (haohe, kzha, dk) @mi eduu
ABSTRACT
Indiscriminate data poisoning attacks quite effective against supervised learning. However, not much is known about their impact on unsupervised contrastive learn- ing (CL). This paper is the first to consider indiscriminate poisoning attacks of con- trastive learning. We propose Contrastive Poisoning (CP), the first effective such attack on CL. We empirically show that Contrastive Poisoning, only drastically reduces the performance of CL algorithms, but also attacks supervised learning models, making it the most generalizable indiscriminate poisoning attack. We also show that CL. algorithms with momentum encoder are more robust to indiscrimi- nate poisoning, and propose new countermeasure based on matrix completion. Code is available at: https: // tithhb..ae com/ homp/aaieen htt///aaawwaaaaaeeeeeeaeeaaaaaae wwwtrrrssiveepissseee
INTRODUCTION
Indiscriminate poisoning attacks are particular type of data poisoning in which the attacker adds the training data labels perturbations that do not target a particular class, but lead to arbitrar- ily bad accuracy on unseen test data. They also known as availability attacks (Biggio & Roli, 2018) since they render machine learning models potentially useless, or delusive attacks (Tao et al., 2021) since the added perturbations are visually imperceptible.
Clean Poisoned by using algorithm (Fowl et al.)
100
91.8
91.8
92.2
81.5
80.3
76.6
75
50
25
6.3
Supervised
SimCLR
MoCo v2
BYOL
Research on indiscriminate poisoning attacks has attracted much attention in recent years due to concerns about unauthorized or even illegal exploitation of online personal data (Prabhu & Birhane, 2021; Carlini et al., 2021). One example is reported by Hill & Krolik where commer- cial company collected billions of face images build their face recognition model without ac- quiring any consent. Indiscriminate poisoning attacks could protect from such unauthorized use of data because the added poison renders models trained on the data ineffective (Fowl et al., 2021b).
Figure 1: Accuracy of the victim model when facing the current SOTA in indiscriminate data poisoning attacks (Fowl et al., 2021a). It shows that past indiscriminate poisoning while highly effective victim models that use supervised learning is mostly ineffective when the victim uses unsupervised contrastive learning (SimCLR, MoCo, YOL). Experiment is on CIFAR-10.
All prior works on indiscriminate poisoning of deep learning are the context of supervised learning (SL), and use cross cross-entropy loss. However, advances in modern machine learning have shown that unsupervised contrastive learning (CL) can achieve the same accuracy or even exceed the performance of supervised learning core machine learning tasks (Azizi et al., 2021; Radford et al., 2021; Chen et al., 2020b; 2021; Tian et al., 2021; Jaiswal et al., 2021). 1). Hence, an individual or company that wants to use a dataset in an unauthorized manner need not use SI. Such malicious company can use CL to learn highly powerful representation using unauthorized data access.
"Equal contribution, determined via random coin flip

---

Published as a conference paper at ICLR 2023
This paper studies indiscriminate data poisoning attacks on CL. We observe that past works on indiscriminate poisoning attacks on supervised learning do not work in the face of contrastive learning. In Figure 1, we show empirically that three popular contrastive learning algorithms, SimCLR (Chen et al., 2020a), MoCo (Chen et al., 2020c), BYO (Grill et al., 2020) are still able to learn highly discriminative features from dataset poisoned using a state-of-the-art indiscriminate SL poisoning (Fowl et al., 202la). In contrast, the attack renders supervised learning completely ineffective. This is because indiscriminate poisoning of SL generates poisoning perturbations that are clustered according to the class labels (Yu et al., 2022); but such a design is unlikely to be effective against unsupervised CL because its representation learning does not involve any class labels.
We propose Contrastive Poisoning (CP), the first indiscriminate data poisoning attack that is effective against CL. The design of CP involves three components: 1) poison generation process that attacks the contrastive learning objective (e.g., the InfoNCE loss); 2) differentiation procedure that attacks data augmentation in CL: and 3) dual-branch gradient propagation scheme that attacks CL algorithms with momentum encoder. We empirically evaluate CP on multiple datasets commonly used in prior work on indiscriminate poisoning attacks (CIFAR-100-10) STL-10, and ImageNet-100). Our results reveal important new findings:
Contrastive learning is more robust to indiscriminate data poisoning than supervised learning. All prior indiscriminate poisoning attacks SL can be evaded by using CL to learn representation, then use the labels to learn a linear classifier.
Contrastive Poisoning (CP) a highly effective attack. Interestingly, the same contrastive poison can attack various CL algorithms (SimCLR, MoCo, BYOL), as well as supervised learning models.
While CP works on all CL algorithms, models that include a momentum encoder (i.e., MoCo and BYOL) are relatively more robust than those that do not (i.e., SimCLR). Furthermore, it is essential to generate the poison using momentum encoder; poisons generated without a momentum encoder, i.e., using SimCLR, do not generalize well to other CL algorithms.
The best defenses against poisoning SL. (i.e., adversarial training (Tao et al., 2021)) cannot defend against contrastive poisoning. A new data augmentation based on matrix completion works better.
2 RELATED WORK
Indiscriminate poisoning attacks. Indiscriminate poisoning attacks have been well studied in the context of classical machine learning models, like linear regression and support vector machine (Bar- reno et al., 2006; Biggio et al., 2012). Indiscriminate poisoning attacks on deep neural networks have recently become trendy topic due to the need for protecting data from unauthorized use (Muñoz- González et al., 2017; Feng et al., 2019; Shen et al., 2019; Shan et al., 2020; Cherepanova et al., 2021; Yuan & Wu, 2021; Huang et al., 2021; Fowl et al., 2021a;b).
All prior work on indiscriminate data poisoning of deep learning targets supervised learning and uses a cross-entropy loss. The closest past work to ours is in the area of targeted poisoning and backdoor attacks on contrastive learning (Carlini & Terzis, 2022; Jia et al., 2022; Liu et al., 2022). Targeted poisoning attacks perturb the training data to make the poisoned model misclassify a specific data sample (as opposed all unseen data). Backdoor poisoning attacks, on the other hand, implant backdoor into the poisoned model to manipulate its behavior only on inputs that include the backdoor trigger (as opposed any clean input). Carlini & Terzis investigates targeted attacks and backdoor attacks on a specific multi-modality contrastive learning framework called CLIP (Radford et al., 2021). Saha et al. mounts a backdoor attack on contrastive learning by adding triggers to all images from one class in the training set. Truong et al. uses the contrastive loss as a regularization to make neural networks more resilient backdoor attacks. Our work differs from all of the above attacks and is the first to focus on indiscriminate poisoning of contrastive learning.
Indiscriminate poisoning defenses. Past studies (Tao al., 2021; Huang et al., 2021; Fowl et al., 2021a; Geiping et al., 2021) have shown that adversarial training (Madry et al., 2018) is the most effective way to counter indiscriminate poisoning attacks. They also considered other defense mechanisms such protecting the learning process by using differentialll--rrvate optimizers like DP- SGD (Hong et al., 2020), and data augmentation techniques (Borgnia et al., 2021; Fowl et al., 2021a) such additive noise and Gaussian smoothing. Cutout Vress & Taylor, 2017). Mixup (Zhang et al., 2018), and CutMix (Yun et al., 2019). This past work is in the context of SL. No past work has investigated defenses against indiscriminate poisoning attacks CL.
2

---

Published as a conference paper at ICLR 2023
3 THREAT MODEL
Attacker objective. We consider the standard setting, where contrastive learning used learn feature extractor in a self-supervised manner without labels (Chen et al., 2020a). The feature extractor then fixed, and used to train predictive head on some downstream task of interest.
The ultimate goal of our attack is to poison the training set to cause the contrastive model learned by the victim become a poor feature extractor. The performance the feature extractor is evaluated on downstream task with task-specific predictor. We focus on the setting where the predictor is linear. This evaluation approach known as lineur probes (Alain Bengio, 2017).
Attacker capability. In the context of indiscriminate poisoning attacks, the attacker is usually assumed to have the ability to access the training data of the victim and poison this dataset to degrade the performance of the victim's 's learned model. The attacker however cannot interfere with the victim's 's architecture choice, model initialization, and training routines.
The victim may one of the common CL algorithms (e.g., SimCLR, MoCo, BYOL). In study, we consider both cases of the victim's 's algorithm being known or unknown to the attacker. As in past work on indiscriminate poisoning (Yu al., 2022), the attacker is allowed to modify large portion of the clean training samples. By default, we poison 100% of the data in our experiments. However, the attacker is constrained to only perturb the data samples without touching the labels, and the perturbation should be imperceptible. We follow the convention of prior works which allows the attacker perturb the data in &o ball with 8/255 radius.
Notations. We use D for the dataset, X' and Y for the data and label space. We consider classification tasks with C' classes, i.e., y [C] h X' + Ay denotes a classifier, which is a composition of a feature extractor f X + R and linear predictor
R - Ay, where Ay is the probability simplex; I denotes a loss function; L(h; D) is the averaged loss of a model on the dataset D. We use (h:(h; D) to refer to the cross-entropy loss used to learn classifier h. We use Laa (f: D) to refer to the contrastive loss (e.g. InfoNCE) used to learn feature extractor f.
We formalize indiscriminate poisoning attacks unsupervised contrastive learning as follows. First, the attacker has clean version of the training data D. and generates poisoned version D,. The victim applies certain contrastive learning algorithm Dp. and obtains a poisoned feature extractor fp = arg min, (f; Dp). To evaluate its goodness, we employ a new labeled downstream dataset De. and train a linear predictor 9p = arg ming z LeE (go fo: Dz). The accuracy of the resulting classifier hp 9p fp on the downstream dataset D. is used assess the effectiveness of the attack.
4 CONTRASTIVE POISONING
We propose new indiscriminate data poisoning attack, Contrastive Poisoning (CP), that disables CL algorithms from learning informative representations from training data. The design of CP has three components that together deliver highly potent attack, which describe below.
4.1 CONTRASTIVE POISON GENERATION
CL algorithms (SimCLR, MoCo, BYOL) contain feature encoder and a predictor. The idea underlying our poison generation is to learn data perturbations that, when added to a clean dataset, fool the feature extractor of the victim and make it optimize the contrastive learning objective without really learning semantic information. To achieve this goal, the attacker first chooses a target CL algorithm (like SimCLR or MoCo) and co-optimizes both the feature extractor fa (with parameter 8) and the perturbations 8(r). Specifically, we solve the following optimization:
E ((o.) (fo: (2, 8(z;)) 9,8: Se
min
(I)
where Lai (fo; {z; + ((x))) is the CL loss (e.g., InfoNCE) computed on a batch of samples. Our algorithm solves the above optimization by alternating between updating the feature extractor for To steps and updating the poisoning noise for T3 steps. The feature extractor is optimized via (stochastic) gradient descent while the poisoning perturbation is optimized via projected gradient descent (Madry al., 2018) to fulfill the requirement of bounded lor norm.
3

---

Published as a conference paper at ICLR 2023
Algorithm 1 Contrastive Poisoning
Input: clean dataset De learning rate 7J6, 188 number of total rounds T'; number of updates in each round To. T3 for the feature extractor, poisoning perturbations; number of PGD steps Tp.
2:
for outer iteration= ... do
3:
for inner iteration= 1, 1.2..... To do
4: Sample a batch data (xi) Dr
5: f 0 no C {z. + (=))
6: end for
7:
for inner iteration= 1,2, ..... T3 do
8: Sample a batch of data ((r,,0i) for iteration= 2. Tp do
~ De
9:
Compute gradient gi f- Vo, LaLa(Jo for + { 8(r;) < II, (6(x;) 18 sign(gi) (gi)
11:
for sample-wise poisoning
12:
8(y) + II. (((,) signig Zy 9:)) Ay
b for class-wise poisoning
end for
14: end for
end for
16:
Output: poisoned dataset D, fx + d(z) De).
Sample-wise and class-wise perturbations. We consider two variants of contrastive poisoning: (I) sample-wise poisoning, which adds specific noise to each image, and (2) class-wise poisoning, which adds the same poison to all samples in the same class. Intuitively sample-wise poisoning provides more capacity to attack, but has the downside of increased learning overhead and potentially being too optimized to a specific CL algorithm. In Section 5.3, we empirically study the efficacy and properties of the two types of poisoning attacks. Algorithm 1 illustrates the poison generation procedure for both attack types.
4.2 DUAL BRANCH POISON PROPAGATION
Optimizing the noise to poison supervised learning is relatively straightforward; we can get the gradient through the cross-entropy loss function, e.g., (=l(x(((z), Contrastive learning algorithms more complicated since the computation of loss requires contrasting multiple data samples, and potentially the use momentum encoders. Figure 2 illustrates the three contrastive learning see, MoCo and BYOL have momentum
frameworks, SimCLR, MoCo, and BYOL. As encoder which is updated via an exponential moving average of the normal encoder. In standard contrastive training, the gradient does not flow back through the momentum encoder, illustrated by the black arrows in Figure 2. However, we note that the gradient from the momentum encoder indispensable for learning the poisoning noise. We propose learn the noise via gradients from both branches of the encoder and momentum encoder (blue arrows in Figure 2). We call it a dual branch scheme. To compare, we call learning noise via the standard gradient flow, a single branch scheme. Later in Section 5.5b, we empirically show that the proposed dual branch scheme learns much stronger poisons for both MoCo and BYO..
4.3 ATTACKING CL DATA AUGMENTATIONS
Supervised learning uses weak data augmentations or no augmentations. Hence some prior work on poisoning SL has ignored data augmentations. Contrastive learning however uses strong augmenta- tions, which are critical to the success of CL. If ignored, these augmentations can render the poison ineffective.
Hence, to optimize the poisoning noise to attack CL augmentations, we have to optimize the poisoning perturbations by pack-propagating the gradients through the augmented views the input samples. Fortunately, all data augmentations used in CL algorithms are differentiable. For example, brightness adjustment is one augmentation where the output O is the input image multiplied by factor ri. differentiable as 80..... a. T4 (e=e' jc=e',b= A== w=="] where h w, h', w' are the spatial coordinates and e, d' are the RGB channel indices. In Appendix A, show the differentiability of all CL data
4

---

used to Published as a conference paper at ICLR 2023
contrastive loss
contrastive
MSE loss
grad
grod
SPM
piad gmad
g.3d
similarit
similarity
similaity
quiue
predictor
+
attring eneiyria
moving Menticg
moving MAweAAMM
encoder
encoder
encoder
momentum encoder
encoder
momentum encoder
image
MNg
image
image
perturbation
perturbation
perturbation
(a) SimCLR
(b) MoCo v2
(c) BYOL
Figure 2: Contrastive learning frameworks and the gradient flow used to optimize the encoder (i.e., feature extractor) and the noise. The gradient flow for optimizing the encoder shown in dashed black arrows and the flow for optimizing the noise in dashed blue arrows.
augmentations. Thus, to generate the contrastive poison we differentiate the data augmentation and back-propagate the gradients all the way to the input.
5 ATTACK EXPERIMENTS
We evaluate contrastive poisoning (CP) on multiple benchmark datasets: CIFAR-10/-100 (Krizhevsky et al., 2009), STL.-10 (Coates et al., 201 1), and Image ImageNet- 100 is randomly selected 100-class subset of the ImageNet ILSVRC-2012 dataset (Russakovsky et al., 2015), containing 131.77K images. As common in prior work (Huang al., 2021; Fowl et al., 2021a), by default, we assume the victim uses ResNet-18, and the attacker generates the poisoning perturbations using ResNet-18. In Section 5.5c, show ablation results that demonstrate that data poisoning generalizes to other model architectures.
We consider three well-known contrastive learning frameworks: SimCLR (Chen et al., 2020a), MoCo(v2) (Chen et al., 2020c), and BYOL (Grill et al., 2020). For reference, some experiments, also evaluate ing (AP) (Fowl et al., a) and unlearnable example (UE) (Huang et al., 2021). In the rest of the paper, we use CP (S) and CP (C) as abbreviations for sample-wise and class-wise contrastive poisoning.
prior SOTA poisoning attacks against supervised learning: adversarial poison-
Please refer Appendix B for details about the training and evaluation protocols, e.g., dataset split, spper-parameters for CL frameworks and linear probing, as well as the generate each attack.
5.1 CL ACCURACY THE FACE OF INDISCRIMINATE ATTACKS
We validate our attacks on CIFAR-10, CIFAR-100, and ImageNet-100. Here, we assume the attacker uses the same CL algorithm the victim, and study attack transferability in Section 5.3. Table I reports the linear probing accuracy for different attack types against different victim CL algorithms. As reference, in the first and second rows, we show the accuracy of training on clean data and clean data plus uniformly distributed random noise bounded by [-8/255, 8/ 8/255). respectively.
The results in Table show that both sample wise and class-wise contrastive poisoning are highly effective in poisoning CL. They also show that CL algorithms that include momentum encoder are less vulnerable than those that do not. For example, as illustrated by the bold numbers Table 1, the strongest attack on CIFAR-10 causes SimCLR's accuracy to drop to 44.9%, whereas the strongest attacks on MoCo and BYL cause the accuracy to drop to 55.1% and 56.9%, respectively. We believe the increased robustness of MoCo and BYOL is due additional constraints on the poison, which not only has to make two views of an image similar, but also has to make them similar through two different branches (encoder and momentum encoder).
5

---

Published as a conference paper at ICLR 2023
Table I: Performance of indiscriminate poisoning attacks different contrastive learning algorithms and datasets. Table reports percentage accuracy (%, 4). For reference, we show the accuracy on clean data and clean data added random noise. The best attack performance is shown in bold.
CIFAR-10
CIFAR-100
ImageNet-100 SimCLR
Attack Type
SimCLR
MoCo v2
BYOL
SimCLR
MoCo v2
BYOL
NOXE
91.8
91.8
92.2
63.6
65.2
65.3
69.3
RANDOM NOISE
90.4
90.1
90.7
58.5
59.8
61.0
67.5
CONTRASTIVE POISONING (S)
44.9
55.1
59.6
19.9
21.8
41.9
48.2
CONTRASTIVE POISONING (C)
68.0
61.9
56.9
34.7
41.9
39.2
55.6
Table 2: Impact indiscriminate poisoning of one dataset on downstream tasks, where the linear
predictor is learned using a different clean dataset. Table reports percentage accuracy (%, 4) on features learned from poisoned CIFAR- 100mageeett000000 with different downstream tasks. For reference, we also show the performance in the absence of attack.
Poisoning CIFAR-10
Poisoning ImageNet-100
Attack Type
CIFAR-10 CIFAR-100
STL-10
ImageNet- 100
CIFAR-10
STL-10
NONE
91.8
47.2
78.2
69.3
72.5
82.0
CONTRASTIVE POISONING (S)
44,9
16.7
43.1
48.2
59.9
67.8
CONTRASTIVE POISONING (C)
68.0
28.7
58.4
55.6
62.9
71.6
5.2
IMPACT ON DOWNSTREAM TASKS AND DATASETS
CL is widely-used for representation learning, where the goal is to learn good feature extractor using unsupervised data. One can then apply the feature extractor to multiple downstream tasks by training a task-specific linear predictor
new labeled dataset suitable for the downstream task.
The results in Table 2 show that after being poisoned, the feature extractor's 's discriminative ability on other datasets gets suppressed. Here, the victim uses SimCLR. We test the representations learned on two poisoned datasets, CIFAR-10 and ImageNet-100. The linear predictor is learned and tested on multiple datasets including, 1IFAR-10/-100 STL-10, and ImageNett100) As shown in Table 2, the accuracy on all downstream datasets drops unanimously, though the downstream datasets are clean and different from the poisoned dataset.
5.3 TRANSFERABILITY ACROSS CL ALGORITHMS
In practice, the attacker may not know which CL algorithm the victim uses. Thus, ideally, the attacker wants the poisoned data be equally harmful regardless of which exact CL algorithm the victim uses. Thus, in this section, we assess the transferability of a particular attack across three potential victim CL algorithms (SimCLR, MoCo, BYOL), We conduct the experiments on CIFAR- 10, and report the accuracy in Table Bold indicates the most effective attack, and blue shading indicates the most transferable. For reference, in the first two rows, we also include the results of directly applying prior SOTA poisoning attacks against supervised learning.
Table 3: Accuracy for different victim's CL algs.
Vietim's Algorithm MoCo
Attack Type + Amacker's Alg.
SimCLR
BYOL.
ADVERSARIAL POISONING UNI UNLEARNABLE EXAMPLE
$1.5
80.3
78.6
91.3
90.9
91.6
PoIsONING (SIMCLR)
82.0
CONTRASTIVE POISONING (MoCo)
CONTRASTIVE POISONING (8) (BYOL)
65.1
612
59.6
CONTRASTIVE POISONING (C) (SMMLLR)
68.0
68.4
67.2
CONTRASTIVE PoIsONING (C) (MoCo)
60.9
61.9
59.5
CONTRASTIVE POISONING (BYL)
607
The results show that prior poisoning attacks designed for supervised learning are very weak in countering contrastive learning, regardless of the victim's 's CL algorithm. In contrast, contrastive poisoning is highly effective. However, while sample-wise CP tends to be the most damaging, it does not transfer well as class-wise CP. In terms of transferability Table shows attack that BYOL and class-wise CP provides the best tradeoff between transferability and efficacy, and causes the accuracy CIFAR-10 to drop about 60%, regardless of whether the victim uses SimCLR, MoCo, or BYOL.

---

Published as a conference paper at ICLR 2023
5.4 POISONING BOTH SL AND CL
Table 4: Attack efficacy on SL and CL.
We show our proposed attack, class-wise con- trasting poisoning is effective on both SL and
Attack Type Attacker's 's Alg.
Victim's Algorithm Supervised SimCLR
CL. In Table 4, we see that contrasting poisons, no matter generated by which CL framework, can always reduce the accuracy of SL to about 10%. (The dataset is CIFAR-10.) It can success- fully disable the SL since its class-wise structure shortcuts SL and makes the model associate the class with the noise attached instead of the content of images. The result is significant and means the victim cannot defend our attack even if he/she labels all the poisoned data and runs SL. The result also suggests that contrastive poisoning is the strongest indiscriminate poisoning attack. On the one hand, CP poisons SL as well as prior poisons against SL. On the other hand, CP is the only poison that is effective on CL.
ADVERSARIAL POISONING
8.7
UNLEARNABLE R. EXAMPLISS Ins
19.9
91.3
CONTRASTIE CINTRASTIVE POISONING (C) (SMMLR))
10.2
68.0
CONTRASTIVE POISONING (C) (MoCo)
10.0
60.9
CONTRASTIVE POISONING (C) (BYLL)
10.1
60.7
5.5 ANALYSIS OF CONTRASTIVE POISONING
(a) Attack efficacy and the fraction of poi- soned data. We evaluate attack efficacy as function of the percentage of poisoned data,
Table 5: Accuracy of different poisoning ratios.
Prianing Phiooing (3)
w/5
50%
CLEAN ONLY (100% p)
70.6
78.6
85.2
80.9
89.2
$9.5
The experiments are conducted on CIFAR-10 with SimCLR. Table 5 reports the attack perfor- mance as a function of the percentage of data that gets poisoned. For reference, we also show the accuracy if the victim model is trained using only the 100% p clean samples. The results show, for both class-wiss and sample-we wise contrastive poisoning, the attack power gradually decreases as the percentage of poisoned data decreases. This gradual decline is desirable and means that the attacker can control the impact of the poison by changing p. We also note that in comparison to past work on indiscriminate poisoning of SI., CP is much more resilient the reduction in the fraction of poisoned data than past attacks whose poisoning effects quickly diminish when the data is not 100% poisoned (Shan et al., 2020).
CONTRASTIVE ProsSNINGG (C)
26.5
66
89.5
$9.8
COMMASIINE POSONING (8)
59.1
K37
38.1
$9.6
(b) Importance of the dual-branch scheme for CL algorithms with a momentum encoder. We compare the accuracy resulting from a dual- branch scheme where the noise gradient is back- propagated through both the branch with and without momentum encoder, and a single- branch scheme that does not back-propagate the noise gradient through the momentum branch. The experiment is conducted CIFAR-10. We evaluate both types of contrastive poisoning. The attacker uses the same CL algorithm as the victim. As shown in Table 6, back-propagating the gradient along both branches unanimously improves the attack effectiveness and leads to 7% to 20% drop in accuracy over the single branch scheme. This is because back prooppaapggg the gradient to the noise through both branches allows the noise to learn how to adversely change the output of the momentum encoder as well, instead of only attacking the encoder.
Table 6: Attack results of poisoning generated with dual-branch gradient v.s. single-branch gradient.
Attacker Algoritim
SimCLR
Victin Algorithm McCo V2
DYOL
(S) + MoCo (SINGLE)
65.9
74.8
67.2
CP (S) + MoCo V2 (DLAL)
(+11.))))
55.1 (+19.7)
7+.1(+
CP (C) MoCo V2 (SINGLE)
69.4
71.6
70.0
CP
MoCo (DEAL)
(+..5
61.9 (+9.7)
(+155)
CP (5) + DYOL (SINGLE)
71.6
73,8
79,9
CP (S) + BYOL (DUAL)
65.1 (+6.5)
64.2 (+9.6)
59.6
CP (C) BYOL (SINGLE)
68.3
70.4
66.7
CP BYUL (DUAL)
(47.6)
(+8.6)
(+9.8)
(c) Impact of model architecture. We gen- erate contrastive poisons using ResNet-18 18 and
Table 7: Attack transferability across architectures.
Amack Typ
V0G-19
R8
Rodaa-0
DomoNNa-1211
MobileNaa2
SimCLR. The victim runs SimCLR on these poi- soned datasets and tries different model architec- tures including VGG- 19, ResNett18, ResNet-50, DenseNet-1211 1211 and MobileNetV2. The results are shown in Table 7. We can see that our attacks are effective across different backbone architectures.
Nowe
883
93.5
$9.4
CPOS) CPIC)
15.1
46.9
49.1
45.4
42.6
655
68.0
71.
69.6
516
(d) Understanding CP noise. In Figure 3, we visualize the noise generated by contrastive poisoning against SimCLR, and compare it to the noise generated by prior attacks against supervised learning. (A visualization of the MoCo and BYOL noise can be found in Appendix C. We observe that the noise that poisons supervised learning has much simpler patterns than the noise that poisons SimCLR. Intuitively, this indicates that poisoning contrastive learning is harder than poisoning supervised
7

---

Published as a conference paper at ICLR 2023
plano
car
dog frog horse
plane
bird
cat
dog
frog horsa ship
mack
(a) Poisoning noise for supervised learning.
(b) Poisoning noise for SimCLR.
Figure 3: Visualization of the poisoning noise for supervised learning and contrastive learning. Note that some types of noise are sample-wise, we randomly sample one from each class to visualize.
E6k
Paieared
Possored
Firtwwkingg
Polsoned
416
Unfformty
306
20c
Vina
10k
200 Epoch
300
0.2
0.4
0.8
3.8
Costra Distanou (Two Views)
(a)
(b)
(d)
Figure 4: (a.b) Progression of the alignment and the uniformity loss during training. (c) Illustration of the poisoned encoder aligning poisoned image but not clean image. (d) Histograms of the cosine distance between the embeddings of two views of poisoned image (blue), clean image (orange).
learning. This is compatible with the results Figure and Table which show that SL more vulnerable to poisoning attacks than CL.
Next, we explain the working mechanism of the CP noise: (1) it does not work by shortcutting the classification task as all prior poisons did; (2) works by shortcutting the task of aligning two augmented views of single image, Specifically, prior work has observed that the noise that poisons supervised learning tends to cluster according to the original class labels as shown in Figure 5(a), and is linearly separable (Yu et al., 2022). We apply the same test on noise for attacking SimCLR and find it is not linearly separable, as shown in Figure 5(b). The reason for noise
Linear Accuracy: 1.00
Linear Accuracy 0. 34
(a) noise attacks SL (h) noise attacks CL Figure 5: t-SNE of the poisoning noise. for SL being linearly separable is that the supervised learning loss (i.e., CE) focuses on classification. Thus, shortcut the SL loss, the attack inserts in each image noise that makes easy to classify the images without looking at their content. Hence, the noise is clustered according to the classes.
In contrast, the CL loss (e.g., InfoNCE) is not focused on classification. The InfoNCE loss can be interpreted as a combination of alignment (aligning different views of the same image) and uniformity (spreading features) (Wang & Isola, 2020). To understand which component is shortcutted by the poisoning noise, we monitor the progression of their values during training. Figure 4(a.b) shows an example running SimCLR on CIFAR-10 poisoned by class-wise CP. Blue curves are the loss computed the poisoned dataset while the orange curves the loss computed the clean dataset, for comparison. We can see is the aligmment that is severely shortcutted as there is a huge gap between the poisoned alignment loss and the clean alignment loss. It means poisons deceive the model to believe it aligns the two views of the same image while not achieving it, i.e., the cosine distance between features of two views of the poisoned image is small while that distance for the clean image is large (Figure 4(c)). We show the distance histograms in Figure 4(d). We can see the distance between poisoned features is always close zero while the distance between clean features could be as large as one.
6 DEFENSES
(a) Adversarial training. Prior research on indiscriminate poisoning attacks against SL shows that adversarial training is the most effective countermeasure (Tao et al., 2021; Fowl et al., 2021a). Intuitively, it is because the poisoned data is in small loo ball of the clean data. Adversarial robustness ensures that the model makes the same prediction within a small neighborhood around an input sample. Thus, its good accuracy the poisoned training set translate to the clean
8

---

Published as a conference paper at ICLR 2023
test set. To enhance adversarial robustness of contrastive learning, several specialized adversarial training frameworks have been proposed: Kim et al. proposes to take adversarial examples of an anchor its positive samples; Jiang et al. proposes to use secondary encoder that is trained with adversarial examples and contrast it with a normally trained encoder. The current SOTA framework is AdvCL (Fan et al., 2021) which uses high-frequency image components and pseudo-supervision stimulus to augment contrastive adversarial training. In our experiment, we test the defense power of AdvCL against indiscriminate poisoning attacks on CL.
(b) Data augmentation. Data augmentations have also been extensively studied as defense mecha- nisms against poisoning attacks (Tao et al., 2021; Huang et al., 2021). We test three traditional data augmentations:
Random Noise, which adds random white noise to the input: Gauss Smooth which applies Gaussian filter to the input; and Cutout (DeVs Taylor, 2017) which excises certain parts of the input. We further propose new data augmentation based on Matrix Completion. The augmentation has two steps: first, it randomly drops pixels in the image; second, it reconstructs the missing pixels via matrix completion techniques (Chatterjee, 2015).
(c) Experiments and results. We conduct our experiments on CIFAR-10 using SimCLR and ResNet-18. For AdvCL, we use its default configurations CIFAR-10. For data aug- mentations, we ablate their hyper-parameters. Specifically, for Random Noise, the standard deviation of the white noise to be small (a = 8/255) or large (o = 64/ 64/255). For Gauss-Smooth, we control the size of the Gaus- sian kernel to be small (3 3) or large (15 x 15).
Table 8: Performance of various defenses.
Defense Methoul
CP (S)
CP (C)
Average
No DEFENSE
44.9
68.9
56.9
RANDOM
8/255)
54.1
90.3
72.2
control
RANDOM NOISE (a 64/255)
73.6
73.6
73.6
GAUSS SMOOTH (I=
47.8
GAUSS SMOOTH (A 15)
59.7
62.0
60.9
CUTOUT
47.7
75.0
61.4
ADVERSARIAL TRAINING
79.3
82.3
80.8
MATRIX COMPLETION
85.6
88.2
86.9
For Cutout, we follow standard setting that excises a single hole of size 16 x 16. For Compix-Completion, we adopt pixel dropping probability of 0.25 and reconstruct the missing pixels using the universal singular value thresholding (USVT) algorithm (Chatterjee, 2015) with 50% of singular values clipped. In Appendix C.3, we visualize those augmentations.
CLEAN DATA
Table 8 shows that among all defenses, only Adversarial Training and Matrix Completion can stably work under both attacks. Further, Matrix Completion gives the best defense accuracy. On average achieves 86.9% accuracy which is 5.9% higher than the second best strategy, adversarial training. This is because adversarial training methods, although effective, have limited performance upper- bound because they trade-off accuracy for increased robustness (Zhang et al., 2019), which means adversarial training unavoidably hurts the model's performance on clean data. Our results also reveal that sample-wise poison is more resilient to augmentation-basse defenses than class-wise poison, which is highly sensitive to the defense mechanisms.
7 CONCLUDING REMARKS
This paper provides the first study of indiscriminate data poisoning attacks against contrastive learning (CL.) It shows that prior indiscriminate poisoning attacks (which have targeted SI. can be overcome by using CL. To attack CL., it proposes a new, contrastive poisoning, and demonstrates its effectiveness. Furthermore, it shows that contrastive poisoning can poison both SL and CL. The paper also studies defense mechanisms and shows that data augmentation based on matrix completion is most effective against indiscriminate poisoning of CL.
We also highlight some limitations. In particular, the more transferable attack (i.e., class-wise CP) requires the attacker to have the labels. Having access labels, however, is assumed in all prior indiscriminate poisoning attacks. Another potential limitation is the attacks typically require poisoning a relatively large percentage of data. Again this a general limitation for indiscriminate poisoning of both SL and CL. In fact, our work reduces the required fraction of poisoned data. Also, in indiscriminate poisoning, the attacker usually the dataset owner who wants to share the data while preventing others from extracting sensitive information. Many sensitive datasets have small number of owners (e.g., a medical institution sharing pathology slides or x-ray images, a weather service sharing satellite images) in which case the owner can poison most or all of the shared data. We believe that these limitations do not hamper the value of the paper in providing the deep learning community with novel findings and solid understanding of the growing area of data poisoning.

---

Published as a conference paper at ICLR 2023
ACKNOWLEDGEMENTS
We are grateful to Peng Cao for reviewing and polishing the paper. We thank Yilun Xu and the members of the NETMIT group for reviewing the early drafts of this work and providing valuable feedback. We extend our uppreciation to the anonymous reviewers/area chair for their insightful comments and constructive suggestions that greatly helped improving the quality of the paper. Lastly, we acknowledge the generous support from the GIST-MIT program, which funded this project.
REFERENCES
Guillaume Alain and Yoshua Bengio. Understanding intermediate layers using linear classifier probes. In International Conference on Learning Representations Workshop, 2017.
Shekoofeh Azizi, Basil Mustafa, Fiona Ryan, Zachary Beaver, Jan Freyberg, Jonathan Deaton, Aaron Loh, Alan Karthikesalingam, Simon Kornblith, Ting Chen, et al. Big seff-supervised models advance medical image classification. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pp. 3478-3488, 2021.
Marco Barreno, Blaine Nelson, Russell Sears, Anthony D Joseph, and Doug Tygar. Can machine learning be secure? In Proceedings of the 2006 ACM Symposium on Information, computer and communications security, pp- 16 25, 2006.
Battista Biggio and Fabio Roli. Wild patterns: Ten years after the rise of adversarial machine learning. Pattern Recognition, 84:317-331, 2018
Battista Biggio, Blaine Nelson, and Pavel Laskov. Poisoning attacks against support vector machines. In Proceedings of the 29th International Conference on Machine Learning, pp. 1467-1474, 2012.
Eitan Borgnia, Jonas Geiping, Valeriia Cherepanova, Liam Fowl, Arjun Gupta, Amin Ghiasi, Furong Huang. Micah Goldblum, and Tom Goldstein. Dp-instahide: Provably defusing poisoning and backdoor attacks with differentially private data augmentations. arXiv preprint arXiv:2103.02079 2021.
Nicholas Carlini and Andreas Terzis. Poisoning and backdooring contrastive learning. In International Conference Learning Representations, 2022.
Nicholas Carlini, Florian Tramer, Eric Wallace, Matthew Jagielski, Ariel Herbert-Voss,, Katherine Lee, Adam Roberts, Tom Brown, Dawn Song, Ulfar Erlingsson, al. Extracting training data from large language models. 30th USENIX Security Symposium (USENIX Security 21), pp- 2633 (633-2650, 2021.
Sourav Chatterjee. Matrix estimation by universal singular value thresholding. The Annals of Statistics, 43(1):177-214, 2015.
Ting Chen, Simon Kornblith, Mohammad Norouzi, and Geoffrey Hinton. A simple framework for contrastive learning of visual representations. In International conference on machine learning, pp. 1597-1607. PMLR, 2020a.
Ting Chen, Simon Kornblith, Kevin Swersky, Mohammad Norouzi, and Geoffrey E Hinton. Big self-supervised models strong semi-supervise learners. Advances in neural information processing systems, 13:22243-22255. 2020b.
Xinlei Chen, Haoqi Fan, Ross Girshick, and Kaiming He. Improved baselines with momentum contrastive learning. arXiv preprint arXiv:2003. 04297, 2020c.
Xinlei Chen, Saining Xie, and Kaiming He. An empirical study of training self-supervised vision transformers. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pp. 9640-9649,2000
Valeriaa Cherepanova, Micah Goldblum, Harrison Foley, Shiyuan Duan. John Dickerson, Gavin Taylor, and Tom Goldstein. Lowkey: leveraging adversarial attacks to protect social media users from facial recognition. In International Conference Learning Representations, 2021.
10

---

Published as a conference paper at ICLR 2023
Adam Coates, Andrew Ng. and Honglak Lee. An analysis of single-layer networks in unsupervised feature learning. In Proceedings of the fourteenth international conference on artificial intelligence and statistics, pp.
JMLR Workshop and Conference Proceedings, 2011.
Terrance Vries and Graham W Taylor. Improved regularization convolutional neural networks with cutout. arXiv preprint arXiv: 170.00452,, 2017.
Lijie Fan, Sijia Liu, Pin-Yu Chen, Gaoyuan Zhang, and Chuang Gan. When does contrastive learning preserve adversarial robustness from pretraining to finetuning? In Advances in Neural Information Processing Systems, volume 34, 2021.
Feng, Qi-Zhi Cai, and Zhi-Hus Zhou. Learning to confuse: generating training time adversarial data with auto-encoder. In Advances in Neural Information Processing Systems, pp. 11971-11981, 2019.
Liam Fowl, Micah Goldblum, Ping-yeh Chiang, Jonas Geiping, Wojtek Czaja, and Tom Goldstein. Adversarial examples make strong poisons. In Advances in Neural Information Processing Systems, volume 34, pp. 00339-333311 2021a.
Liam Fowl, Ping-yeh Chiang, Micah Goldblum, Jonas Geiping, Arpit Amit Bansal, Wojeiech Czaja, and Tom Goldstein. Protecting proprietary data: Poisoning for secure dataset release. arXiv preprint arXiiv:2105 100.022833 2021b.
Jonas Geiping, Liam Fowl, Gowthami Somepalli, Micah Goldblum, Michael Moeller, and Tom Goldstein. What doesn't kill you makes you robust (er): Adversarial training against poisons and backdoors. arXiv preprint 1xXiv:2122.36622 2021.
Jean-Bastien Grill, Florian Strub, Florent Altché, Corentin Tallec, Pierre Richemond, Elena Buchatskaya, Carl Doersch, Bernardo Avila Pires, Zhaohan Guo, Mohammad Gheshlaghi Azar, et al. Bootstrap your own latent-a new approach to self-supervised learning. Advances Neural Information Processing Systems, 33:21271-21288 2020.
Kaiming He, Haoqi Fan, Yuxin Wu, Saining Xie, and Ross Girshick. Momentum contrast for unsupervised visual representation learning. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp.
2020.
Kashmir Hill and Aaron Krolik. How photos of your kids are powering surveillance technology. The New York Times, 2019.
Sanghyun Hong, Varun Chandrasekaran, Yigitcan Kaya, Tudor Dumitraş, and Nicolas Papernot. On the effectiveness of mitigating data poisoning attacks with gradient shaping. arXiv preprint MrXiv:2002.114000 2020.
Hanxun Huang, Xingjun Ma, Sarah Monazam Erfani, James Bailey, and Yisen Wang. Unlearn- able examples: Making personal data unexploitable. In International Conference on Learning Representations, 2021.
Ashish Jaiswal, Ashwin Ramesh Babu, Mohammad Zaki Zadeh, Debapriya Banerjee, and Fillia Makedon. A survey on contrastive self-supervised learning. Technologies, 9(1:2, 2021.
Jinyuan Jia, Yupei Liu, and Neil Zhenqiang Gong. BadEncoder: Backdoor attacks to pre-trained encoders in supervied learning. In IEEE Symposium on Security and Privacy, 2022.
Ziyu Jiang, Tianlong Chen, Ting Chen, and Zhangyang Wang. Robust pre-training by adversarial contrastive learning. In Advances in Neural Information Processing Systems, 2020.
Minseon Kim, Jihoon Tack, and Sung Ju Hwang. Adversarial self-supervised contrastive learning. Advances in Neural Information Processing Systems, 33:2983-2994 2020.
Alex Krizhevsky, Geoffrey Hinton, al. Learning multiple layers of features from tiny images. 2009.
Hongbin Liu, Jinyuan Jia, and Neil Zhenqiang Gong. Poisonedencoder: Poisoning the unlabeled pre-training data in contrastive learning. arXiv preprint arXiv:2205.06440 2022.
11

---

Published as a conference paper at ICLR 2023
Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. In International Conference on Learning Representations, 2018.
Luis Muñoo-GGozzäer,, Battista Biggio, Ambra Demontis, Andrea Paudice, Vasin Wongrassamee, Emil C Lupu, and Fabio Roli. Towards poisoning of deep learning algorithms with back-gru graddggddient optimization. In Proceedings of the 10th ACM Workshop Artificial Intelligence and Security, pp. 27-38, 2017.
Vinay Uday Prabhu and Abeba Birhane. Large image datasets: A pyrrhic win for computer vision? In Winter Conference on Applications of Computer Vision, 2021.
Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agarwal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, et al. Learning transferable visual models from natural language supervision. In Proceedings of the 38th International Conference on Machine Learning, volume 139, pp. 8748-8763. PMLR. 2021.
Olga Russakovsky, Jia Deng, Hao Su, Jonathan Krause, Sanjeev Satheesh, Sean Ma, Zhiheng Huang, Andrej Karpathy, Aditya Khosla, Michael Bernstein, al. Imagenet large scale visual recognition challenge. International journal of computer vision, (1(())2111-2555) 2015.
Aniruddha Saha, Ajinkya Tejankar, Soroush Abbasi Koohpayegani, and Hamed Pirsiavash. Backdoor attacks on self-supervised learning. arXiv preprint arXiv:2105.10122 2021.
Shawn Shan, Emily Wenger, Jiayun Zhang, Huiying Li, Haitao Zheng, and Ben Y Zhao. Fawkes: Protecting privacy against unauthorized deep learning models. In 29th USENIX Security Symposium (USENIX Security 20), pp. 1589-1604, 2020.
Juncheng Shen, Xiaolei Zhu, and De Ma. Tensorelog: An imperceptible poisoning attack on deep neural network applications. IEEE Access, 7:41498-41 2019.
Lue Tao, Lei Feng, Jinfeng Yi, Sheng-Jun Huang, and Songcan Chen. Better safe than sorry: Pre- venting delusive adversaries with adversarial training. Advances in Neural Information Processing Systems, 34, 2021.
Yonglong Tian, Olivier Henaff, and Aäron van den Oord. Divide and contrast: Self- Self-supervised learning from uncurated data. In Proceedings of the IEEE/CVF International Conference on Computer Vision. pp. 10063-10074, 2021.
Loc Truong, Chace Jones, Brian Hutchinson, Andrew August, Brenda Praggastis, Robert Jasper, Nicole Nichols, and Aaron Tuor. Systematic evaluation of backdoor data poisoning attacks on image classifiers. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition Workshops, pp. 788-789, 2020.
Tongzhou Wang and Phillip Isola. Understanding contrastive representation learning through align- ment and uniformity on the hypersphere. In International Conference on Machine Learning, pp. 9939. PMLR, 2020.
Da Yu, Huishuai Zhang, Wei Chen, Jian Yin, and Tie-Yan Liu. Availability attacks create shortcuts. In Proceedings of the 28th ACM SIGKDD Conference on Knowledge Discovery and Data Mining. pp. 2367-2376, 2022.
Chia-Hung Yuan and Shan-Hung Wu. Neural tangent generalization attacks. In International Conference on Machine Learning, pp. 12230- 12240. PMLR, 2021.
Sangdoo Yun, Dongyoon Han, Scong Joon Oh. Sanghyuk Chun, Junsuk Choe, and Youngjoon Yoo. Cutmix: Regularization strategy to train strong classifiers with localizable features. In Proceedings of the IEEF/CVF International Conference on Computer Vision, pp. 6023-6032 2019.
Hongyang Zhang, Yaodong Yu, Jiantao Jiao, Eric Xing, Laurent El Ghaoui, and Michael Jordan. Theoretically principled trade-off between robustness and accuracy. In International Conference on Machine Learning, pp. 7472-7482, PMLR, 2019.
Hongyi Zhang, Moustapha Cisse, Yann N Dauphin, and David Lopez-Paz. mixup: Beyond empirical risk minimization. In International Conference on Learning Representations, 2018.
12

---

Published as a conference paper at ICLR 2023
A DIFFERENTIABILITY OF DATA AUGMENTATIONS
In this section, we show that the image augmentations used in common contrastive learning meth- ods (e.g., SimCLR, MoCo, BYOL) are differentiable. We categorize the augmentations into two groups: (1) geometric transformations that change the spatial locations of pixels; (2) color space transformations that modify the pixel values.
Let E R xW denote the RGB input image of height and width W, O E R3xPxQ denote the output image of height P and width Q. P, Q not necessarily the same H, W since some augmentations may change the size of the image such as crop and resize.
Geometric transformations include cropping, resizing, and horizontal flipping, which can be considered as affine transformations.
Cropping: Given the coordinate of top-left cropping location (cz, Cy) in the input image, the affine transformation matrix (in homogeneous coordinate) can be written as:
1 0
-c
0
1 Cg
0
0
Resizing: the affine transformation matrix can be written as:
P/H
0
T
0
Q/W
1
0
Horizontal flipping: the affine transformation matrix can be written as:
0
0
T = 0
-1
W -
Given the affine transformation matrix T, the pixel value of location (c,1, (e 1,, p (0, P 1). a E 10.1...., 1)) in the output image can be computed as
Oc.p--
Σ h,
OChaan
Ie
P g
where for cropping and horizontal flipping, Oh, 1 if T-1
otherwise Oh, For
resizing, ah,w depends on the interpolating methods. general, ah.w is the interpolation weighting
factor if locations (h, w) in the input image are the pixels to be used for interpolating the pixel
h
y
value of location (h', w') where
w/
TT1
q
otherwise ah
0. Take the nearest neighbor
i
interpolation example, Oh,w 1 if (h, w) is the nearest to (h', w')
W pH P Q
otherwise
O'h, 0. The above computation is differentiable since 00.,p
Ohh,w-
Color space transtormations include grayscaling, brightness, contrast, and saturation adjustment. Those operations are pixel-wise and do not change the image size. Thus H = P and W = QQ
RGB grayscale: Oe... 0.299 1o, 0.587 41.pa + 0.114 12. Vc,p,q. p.q. T, where is the brightness adjustment factor.
Brightness adjustment: O
Contrast adjustment: O = r. + (1 rz) mean(G). JJ, where r. is the contrast adjustment factor, G is the grayscaled image of T, and J3, is all-ones tensor.
Saturation adjustment: O = + (1 r.)) G, where is the saturation adjustment factor and G is the grayscaled image of T.
Hue adjustment: O f(rn- s(I), +()),, where is the hue adjustment factor, is the HSV to RGB function, h, s, v are functions mapping RGB to hue, saturation and value which axes of HSV color space. Note that f, h, 8, all differentiable.
13

---

Published as a conference paper at ICLR 2023
As can be seen from the above representations, the operations are all differentiable iie., all p0a.p determined by the above equations.
Implementation. We implement our own differentiable data augmentations by leveraging the design of an open-source differentiable computer vision library. Koria kornia). We do not directly use Kormia in our code since it uses an image processing backend inconsistent with PyTorch. Kornia uses OpenCV as the backend for image processing operations while Py Torohh uses PII.. We have implemented our differentiable augmentations using PII. to make them consistent with PyTorch.
com/kornia/
B EXPERIMENT DETAILS
B.1 DETAILS OF DATASET SPLIT
We follow the standard dataset split for contrastive learning.
For CIFAR-10/100 we use 50K for both pre-training the encoder and training the linear classifier, and 10K to the linear classifier.
For ImageNet- 100, 1226.7K for training and 5K for testing.
For STL-10, only use it for linear probing. It has standard split of 5K labeled trainset and 8K testset.
B.2 DETAILS OF CONTRASTIVE LEARNING
Table 9: perpee-prramttes for different contrastive learning algorithms in experiments.
SimCLR
MoCo v2
BYOL
Optimizer
SGD
SGD
SGD
Weight Decay
10-4
10-
10-4
Learning Rate (LR)
0.5
0.3
1.0
LR Scheduler
Cosine
Cosine
Cosine
Encoder Momentum
0.99
0.999
Loss function
InfoNCE 0.5
InfoNCE 0.2
MSE
InfoNCE temperature
Both the victim and attacker require training contrastive learning models. We follow the standard configurations for each contrastive learning framework Chen et (2020a); He et al. (2020); Grill et al. (2020). Table lists the hyper-parameterss specific to each framework. For CIFAR-10/- 10/-100, the models are trained for 1000 epochs with a batch size of 512. For ImageNet-100, the models are trained for 200 epochs with batch size of 128.
Linear probing. When training the linear classifier to evaluate the learned representation, we use an SGD optimizer with momentum of 0.9, weight decay of O, and an initial learning rate of 1.0 for CIFAR-10/-100 and 10.0 for ImageNet- 100. The learning rate decays by factor of 0.2 at epoch 60, 75, and 90. We set batch size 512 and train the linear classifier for 100 epochs. Those linear probing hyper-parameter are the same for CL algorithms.
B.3 DETAILS OF CONTRASTIVE POISONING
On the attacker side, we co-learn the poisoning noise and a feature extractor as shown in Algorithm 1. For saiple-wise CP. T = 600. Т₃ = 100, Т3 100, т, 5. For class-wise CP, T 200, T, 20. T3 = 20, T, = 1. both attacks, we set the PGD learning rate y) to one tenth of the radius of the Loo ball, i.e.. updates, i.e. more total updating rounds T and more PGD steps T, since each sample has its own perturbation which gives a lot of parameters frequent alternating, i.c. smaller T, and Tç. because, for class-wise perturbation, each of them will be updated by many samples in
e/10 0.8/555. In general, the principles are sample-wise CP needs more
learn On the other hand, class-wis CP needs more
batch. We do not want over-optimize them such that
14

---

Published as a conference paper at ICLR 2023
they over-fit the model fo that time point instead of focusing the whole dynamics of the model evolving.
B.4 COMPUTING RESOURCES CONSUMPTION
Hardwares. We run CIFAR-10/-100 experiments on NVIDIA TITAN Xp GPUs. We run ImageNet- 100 experiments on 4 NVIDIA Tesla V100 GPUs.
Rumning time for CIFAR-10/-100. (1) On the attacker side, generating noise using contrastive poisoning takes 8-12 hours. (2) On the victim side, training a contrastive learning model (e.g.. SimCLR, MoCo, BYOL) takes 8-10 hours.
Running time for ImageNeet1000. (1) On the attacker side, generating noise using contrastive poisoning takes 20-30 hours. (2) On the victim side, training contrastive learning model (e.g..
SimCLR) takes 15-20 hours.
C ADDITIONAL VISUALIZATIONS
C.1 POISONING NOISE
Figure 6 visualizes the poisoning noise against MoCo v2 and BYOL. We can see that those noises learned from MoCo v2, BYOL, well as SimCLR (shown in Figure 3), share similar structures. Especially, the class-wise error-miimmziing poisoning (EMP-CL-C) learned from three contrastive learning frameworks has similar chessboard-like patterns. This may explain why EMP-CL-C transfers very well on attacking different CL frameworks.
(S)
CP
plane
car
bird
cat deer dog frog horse ship
truck
(a) Poisoning noise for MoCo v2.
CP (S)
CP (C)
plane
bird
cat
deer
dog frög
horse
ship
truck
(b) Poisoning noise for BYOL..
Figure 6: Visualization of the poisoning noise for MoCo v2 and BYOL. Note that for the sample-wise
noise, we randomly sample one from each class to visualize.
C.2 ANALYSIS OF SAMPLE-WISE CONTRASTIVE POISONING NOISE
In the main paper (Figure 4), we show the progression of the alignment loss and the uniformity loss when training SimCLR on CIFAR-10 10 poisoned by class-wise wiis contrastive poisoning, as well as the histogram the cosine distance of two views
poisoned data in the embedding space.
We apply the same test to sample-wist wise contrastive poisoning and get similar results class-wise contrastive poisoning. Figure shows the loss progressions of sample-wise contrastive poisoning. The curves show the InfoNCE loss and the alignment loss are severely shortcutted. Figure 8 shows the distance histograms of the embeddings of the two views of the image poisoned by sample-wise CP (in blue). We can the distance of poisoned features is always close
Further, comparing the loss curves between sample-wise CP and class-wise CP, we can find that sample-wise CP leads to larger gap between the poisoned and clean alignment losses than class-war wise CP. indicates that sample-ve wise CP has a stronger shortcutting effect. This is consistent with the fact that sasple-wise CP has the highest attacking efficacy SimCLP RR, shown in Table 3.
15

---

Published as a conference paper at ICLR 2023
Uniform (Poisored]
-1.0
Uniform (Clean)
1.5
InfoNCE (Poisored)
(Clean)
-25
-3.0
Alignment (Poisoned)
Aligiment (Glean)
-3.5
100
200
300
400
300
Epoch
Epoch
Epoch
Figure 7: Loss progression of SimCLR CIFAR-16 10 poisoned by sample-wise CP.
50k
Poisoned Clean
40k
30k
20k
10k
0.2
0.4
0.6
0.8
1.0
Cosine Distance (Two Views)
Figure 8: Histograms of the cosine distance between the embeddings two views image poisoned by sample-wise CP (blue), clean image (orange).
C.3 DATA AUGMENTATION FOR DEFENSE
Figure 9 visualizes the data augmentations that to defend against indiscriminate poisoning of contrastive learning for ten randomly selected CIFAR-10 images. In the figure, the order of augmentations is the same the order in Table 8.
clean
noise (g-0.03)
noise (a=0.25)
smooth (k<33)
smooth (k=15)
matrix completion
Figure 9: Visualization of the data augmentations (introduced in Section 6) for defending against indiscriminate poisoning attacks.
16


Reviews:
[{"review_id": "Xv8l5FMIIuF", "reviewer": "Reviewer_gmqR", "summary": "", "questions": "", "limitations": "", "rating": 8, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "This paper studies clean-label availability attacks against unsupervised contrastive learning. The authors first observe that previous poisons, designed to compromise supervised learning, fail to harm contrastive learning algorithms, such as SimCLR and BYOL. Then, the authors propose a new attack method tailored to compromise contrastive learning. Surprisingly, the proposed attack is not only effective for contrastive learning, but also for supervised learning. ", "summary_of_the_review": "The paper explains why previous poisons fail and shows how to effectively compromise contrastive learning. This paper observes many novel empirical findings. These constitute a thorough study of clean-label availability attacks against unsupervised contrastive learning. ", "strength_and_weaknesses": "Strengths:\n\n- This paper is the first to study availability attacks against unsupervised contrastive learning.\n- A dual branch scheme is proposed to mitigate the optimization obstacles and thus boost the attack performance.\n- Experiments provide several novel observations:\n  - It is an interesting observation that sample-wise CP mostly performs better, while class-wise CP can transfer better.\n  - While almost all previous poisons in this area are linearly separable, the proposed poison is not. This would make availability attacks more undetectable.\n  - A very simple data augmentation method based on Matrix Completion is proposed to mitigate poisons. The authors find that this simple method can perform better than adversarial training.\n\nWeaknesses:\n\n- Given that Matrix Completion is very effective in defending against the proposed attack, it is natural then to ask whether this simple method can defend against previous poisons, such as unlearnable examples and adversarial poisoning.\n- Table 8 tests the defense power of AdvCL (i.e. a type of adversarial training) against the proposed poisons. Is the perturbation radius of adversarial training $\\epsilon=8/255$? Prior work (Tao et al., 2021, Figure 5) has shown that adversarial training with small $\\epsilon$ could perform better. Is this also true in the context of unsupervised contrastive learning? By the way, adversarial training was first identified by Tao et al as a promising defense against those poisons. Thus, the last sentence of the introduction needs to polishing.\n- There are availability attacks that can work by injecting dirty labels into the training data (Biggio et al., 2012). That is to say, not all availability attacks are imperceptible. Thus, the first sentence of the introduction needs to polishing.", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "4: All of the claims and statements are well-supported and correct.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work."}, "extra_text": {}}, {"review_id": "KxiDCjHz-q", "reviewer": "Reviewer_vT93", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "This paper poisons unlabeled training data of contrastive learning (CL) to reduce the test accuracy of linear probing. The imperceptible poisons are iteratively optimized to minimize the CL objective function. After the poisons are generated, the authors add them to the training set and run the target CL algorithm from scratch. When the entire training set is poisoned, there is a clear drop in the linear probing accuracy, e.g., from ~90% to ~50% on CIFAR-10.\n\n\nThe poison generation proceeds as follows. At each iteration, the model parameters are first updated to minimize CL loss and then the poisons are also updated to minimize CL loss. This follows the basic idea in Huang et al (2021) although Huang et al (2021) minimize classification instead of CL loss. One worth mentioning difference is the authors show data augmentations of common CL algorithms are differentiable. They take the gradients of data augmentation into consideration when updating the poisons.\n\nThe authors analyze why the poisons work. They show the poisons work by shortcutting the instance-wise CL task, whose objective is to produce similar representations of two different augmented views. They show the poisoned embeddings of two augmented views are close while the clean embeddings are far.\n", "summary_of_the_review": "Given that this paper is the first to show it is possible to design shortcuts for instance-wise CL task, I recommend acceptance.", "strength_and_weaknesses": "**Strength**\n\n1. This paper gives the first attack against contrastive learning. It is interesting to know that one can find shortcuts for the instance-wise CL task.\n\n2. Several interesting tricks, e.g., letting the gradient back through the momentum encoder and differentiable data augmentations, are proposed to improve the attack.\n\n3. The authors show several defenses, including a newly proposed matrix completion, that can be used to defend against contrastive poisoning.\n\n**Weaknesses**\n\n1. How important is using differentiable data augmentations? I do not see an ablation study on this. Will the poisons be useless without this trick?\n\n2. In Figure 4 you explain why contrastive poisoning works but only use class-wise poisons. It would be better if you could include the results of sample-wise poisons.\n\n3. Most of the experiments assume the attacker has full access to the training data. Although most of previous works also use this assumption, it does not change the fact that it would probably be unrealistic.\n\n4. The explanation of why CP works is that it provides shortcuts for the model to produce similar representations of different augmented views. If this is true, it is possible to directly optimize the poison so that it remains unchanged when the data augmentation is applied. For example, a circle is invariant to rotation. This data/model independent approach is more efficient than the optimization procedure.\n", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}, {"review_id": "Kq4r49wyJd", "reviewer": "Reviewer_Cwex", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": 5, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "This paper considers an adversarial setting for contrastive learning: the attacker is allowed to add imperceptible perturbation to all training samples of CL, which will reduce CL's effectiveness as a feature extractor. Experiments show that downstream task's performance will be lowered by the poisoning.", "summary_of_the_review": "Overall, this is a paper with solid empirical evaluation but slightly lacking novelty. To me, it is on the borderline. ", "strength_and_weaknesses": "**Strength**\n\nThis paper is technically sound. The experiments considers a wide range of baselines. I appreciate the effort.\n\n**Weaknesses**\n\nAs the authors have self-identified in the limitation, the attack setting seems to be slightly artificial: the attacker has control over *all* training data is a very strong assumption... The attack mechanism is not too surprisingly novel either. I feel that the paper has presented much empirical evidence of what effect the attack is able to bring, but fails to provide in-depth analysis of its implication. For example, on Page 8, the authors have shown that noise in SL attack is sometimes linear separable, while that in CL attack is not. It is a very interesting observation. However, does that mean linear separable noise is easier to detect? or, what does this linear (non)separability suggest? In future edition or work, the authors may dig further the implication of such phenomena to contrastive learning or more general learning problem. Such insights could be more helpful than the attack/defense itself, given that the adversarial setting is not very common in practice.\n\n", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "4: All of the claims and statements are well-supported and correct.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "4: The contributions are significant, and do not exist in prior works."}, "extra_text": {}}]

Author rebuttal:

Decision: Accept: notable-top-25%