Paper: Transferable Availability Poisoning Attacks (ICLR-2024)

Reviewer comment (Reproducibility):
The authors should check their code regarding the CL and SupCL evaluation for poisoning attacks, especially how transforms (augmentations) are performed when preparing the poisoned dataset. It seems that the data augmentation for each image is fixed before the CL (SupCL) training starts in their code. For example, in this case, each positive pair consists of two fixed augmented images. However, the CL (SupCL) algorithm applies different data augmentations each time it reads an image. Once this part of code is not properly configured, the reliability of the algorithm is questionable. For these reasons, I have significant concerns about the CL and SupCL evaluation results reported in this paper.

Author response:
For evaluating CL and SupCL, we follow the implementation from CP[3] and Supervised Contrastive Learning[5] to perform data augmentations, that is, we treat the poisoned data samples as clean ones and apply data augmentations on them. All the data augmentations are in a random manner, so I don’t think the augmented images will be fined each time. You can also check the code of these two papers for how the evaluation of poisoning attacks is performed.

Reviewer comment (Theory):
The main machanism of TP is kind of vague. This paper claims that “we propose Transferable Poisoning (TP) to generate poisoning perturbations with shared high-frequency characteristics that can be transferred across different learning paradigms (Section 3).” It is unclear why high-frequency perturbation should be a goal for generating transferable poisoning attacks. The proposed algorithm even does not explicitly optimize the frequency of perturbations. In Figure 4, all four attacks are high-frequency but three of them, namely CC, SCP, and WTP have poor transferability. Does it contradict the claim?

Author response:
Please refer to our answer to Q3 in global response. The poisons generated by TAP (specified for supervised learning) and CP (specified for unsupervised contrastive learning) share similar high-frequency patterns. Since TP is based on these two methods, the generated poisons will also have high-frequency characteristics, and the poisons will not only be effective in supervised and unsupervised contrastive learning, but can also transfer to other related learning paradigms. Other alternatives (CC, SCP and WTP) that also have high-frequency patterns but have poor transferability, which further demonstrates that the way to utilize the information from supervised and unsupervised contrastive learning is very important.

Reviewer comment (Experiments):
Table 1, 2, 4 do not consider BYOL that was used in the paper of CP. What is the attack performance of TP against BYOL on CIFAR-10 and CIFAR-100?

Author response:
First, we provide the results for other baseline methods in Table 8 in the updated paper, and it shows that our method still performs better than the baseline methods. We also change the framework of contrastive learning for other methods (CP and TUE) and report the results in Table 11 in the updated paper. Our method demonstrates more superiority in this setting.

Reviewer comment (Experiments):
In Table 1, is SimCLR used for CP and TUE perturbation generation? However, SimCLR is not surely the best generation algorithm for transferability of CP and TUE. To be a fair comparison, it is helpful to consider CP and TUE attacks based on other CL algorithms as well as class-wise CP attacks which are effective for SL.

Author response:
First, we provide the results for other baseline methods in Table 8 in the updated paper, and it shows that our method still performs better than the baseline methods. We also change the framework of contrastive learning for other methods (CP and TUE) and report the results in Table 11 in the updated paper. Our method demonstrates more superiority in this setting.

Reviewer comment (Experiments):
As the algorithm involves contrastive training, it possibly costs too much time to generate TP perturbations, especially on Tiny-ImageNet and ImageNet. Can you provide time consuming comparison of your TP with existing transferable methods like AP, (class-wise) CP, and TUE? Considering availability poisoning attacks are a sort of data protection means, low efficiency of generation might hinder the applications in real world scenarios.

Author response:
Please refer to the new Table 10 in the updated paper. As our method involves contrastive learning, the optimization time is comparatively longer, but it is still less than CP.

Reviewer comment (Experiments):
The experiment is not very systematic. Baseline methods are only compared on the CIFAR-10 dataset. In Figure 3, poisoning ratio = 0 (clean accuracy) is not shown.

Author response:
3. Baseline methods for other datasets?
    
Please refer to Table 8 in our updated paper for the results tested on CIFAR-100. Our method still performs better than baseline methods.

Reviewer comment (Experiments):
This method may be computationally hard to be applied to 224*224 images, e.g., ImageNet Images. But I think this problem also exists in previous works.

Author response:
4. High computational cost for large-scale dataset?
    
As our method needs to optimize the poisons with unsupervised contrastive learning, we admit that the computational cost is comparatively high. But like what the reviewer commented, the scalability issue also exists in previous works. Improving the efficiency and scalability of poisoning attacks is an interesting future work.

Reviewer comment (Experiments):
The defenses (e.g., empirical defenses and provable defenses) against poisoning attacks are not discussed. Also, the defenses are not considered.

Author response:
5. No defense is discussed?
    
Liu et al.[6] propose to use image compression operation to defend against availability poisoning attack. They claim that a simple JPEG operation is effective to defend against poisons with high frequency and requires much less computational cost than adversarial training. Thus we apply JPEG to defend against our method and report the results in table 9 in the updated paper. It shows that the JPEG operation can indeed recover the accuracy to some extent, while they are still lower than the model trained with clean data.

Reviewer comment (Evaluation):
No defense evaluation or discussion is provided. Since the attack requires datasets with 100% poisoning samples, the reviewer believes it would be straightforward to defeat or break its transferability. A discussion of possible defenses should be included as part of responsible vulnerability disclosure.

Author response:
Liu et al.[6] propose to use image compression operation to defend against availability poisoning attack. They claim that a simple JPEG operation is effective to defend against poisons with high frequency and requires much less computational cost than adversarial training. Thus we apply JPEG to defend against our method and report the results in table 9 in the updated paper. It shows that the JPEG operation can indeed recover the accuracy to some extent, but they are still lower than the model trained with clean data.

Reviewer comment (Novelty):
There is little emphasis on the motivation for studying transferability across learning paradigms, which limits the impact of the findings. It would greatly benefit the paper to explain the practical contexts where this kind of transferability might be relevant, offering concrete examples and detailing how the conducted experiments address these cases. This is particularly crucial given the pragmatic nature of the contribution.

Author response:
We explain the motivation of our work in the introduction. To put it simple, since the three main learning paradigms (supervised, semi-supervised and unsupervised learning) can reach similar performance in various machine learning tasks, the victim may choose any learning algorithm from them to train their model. However, the current availability poisoning attacks often target for a specific learning paradigm and have poor transferability across different learning paradigms. Therefore, we propose to study the attack transferability on the level of learning paradigms.

Reviewer comment (Experiments):
While the frequency analysis provides an intriguing perspective on the problem, it could be explored more thoroughly. The authors argue that generating high-frequency perturbations is key to crafting transferable poisoning attacks. This idea is supported by a simple frequency analysis of perturbations generated by existing methods, and so the proposed approach combines two existing ‘high-frequency’ poisoning schemes. Nevertheless, there is no attempt to substantiate this claim with evidence confirming the necessity of high-frequency perturbations for achieving transferability.

Author response:
Please refer to our answer to Q2 in global response. The current visualizations can clearly show that TAP and CP can generate poisons with similar high-frequency patterns, which are more different to the low-frequency poisons generated by EM and both low- and high-frequency poisons generated by TUE. Since we do not claim that only high-frequency poisons can have transferability nor poisons with higher frequency can have better transferability, we think that using a loss function to modify the frequency or providing quantitative results will not provide further explanations.

Reviewer comment (Evaluation):
The results in the tables lack error bars.

Author response:
We admit that using error bars will make the results more reliable. We will provide it later due to the limited computational resources.

Reviewer comment (Evaluation):
The frequency analysis is limited to a simple visualisation of the perturbations’ spectrum. Could you provide a more quantitative comparison? Additionally, please define the spectrum and add a scale to the spectrum plots (ticks are missing).

Author response:
Please refer to our answer to Q2 in global response. The current visualizations can clearly show that TAP and CP can generate poisons with similar high-frequency patterns, which are more different to the low-frequency poisons generated by EM and both low- and high-frequency poisons generated by TUE. Since we do not claim that only high-frequency poisons can have transferability nor poisons with higher frequency can have better transferability, we think that using a loss function to modify the frequency or providing quantitative results will not provide further explanations.

Reviewer comment (Experiments):
Can you insert a frequency constraint on the generated perturbations by modifying the loss function? What happens if you impose high or low-frequency perturbations when using different combinations of attack methods? Could this be a way to test the requirement for transferable perturbations to be high-frequency?

Author response:
Please refer to our answer to Q2 in global response. The current visualizations can clearly show that TAP and CP can generate poisons with similar high-frequency patterns, which are more different to the low-frequency poisons generated by EM and both low- and high-frequency poisons generated by TUE. Since we do not claim that only high-frequency poisons can have transferability nor poisons with higher frequency can have better transferability, we think that using a loss function to modify the frequency or providing quantitative results will not provide further explanations.

Reviewer comment (Writing):
In section 4.3 you say that MoCov2 is used both for poison generation and evaluation. Could you please elaborate? Also, what does Framework mean in Table 4?

Author response:
The Framework means the working mechanisms of different unsupervised contrastive learning, such as SimCLR and MoCov2. So in section 4.3, we change the framework from SimCLR to MoCov2 to generate the poisons and also involve MoCov2 as one unsupervised contrastive learning algorithm to evaluate the generated poisons.

Reviewer comment (Evaluation):
I am not sure I understand the result in Fig. 3, panel C. Is there an explanation for the model performing better when trained on perturbed data? Why only in this case?

Author response:
As for panel C in figure 3 where the training algorithm is semi-supervised learning, both the labeled and unlabeled data are partially poisoned, so for the model trained with poisoned data, the algorithm is more likely to involve the unlabeled data that will be helpful for the training including part of the unlabeled poisoned data, which means the model can learn more information and the results will be better. While for other settings, all poisoned data take part in the training originally, so the results will be worse than model trained with the rest of the clean data.

Reviewer comment (Evaluation):
What is the computational cost of the proposed strategies? A comment on the computational costs should be added to the main text.

Author response:
Please refer to the new Table 10 in the updated paper. As our method involves contrastive learning, the optimization time is comparatively longer, but it is still less than CP.