Indiscriminate Data Poisoning Attacks on Neural Networks ∗
Abstract
Data poisoning attacks, in which a malicious adversary aims to influence a model by injecting “poisoned” data into the training process, have attracted significant recent attention.
In this work, we take a closer look at existing poisoning attacks and connect them with old and new algorithms for solving sequential Stackelberg games.
By choosing an appropriate loss function for the attacker and optimizing with algorithms that exploit second-order information, we design poisoning attacks that are effective on neural networks.
We present efficient implementations by parameterizing the attacker and allowing simultaneous and coordinated generation of tens of thousands of poisoned points, in contrast to existing methods that generate poisoned points one by one.
We further perform extensive experiments that empirically explore the effect of data poisoning attacks on deep neural networks.
Our paper set up a new benchmark on the possibility of performing indiscriminate data poisoning attacks on modern neural networks.
Introduction
Adversarial attacks have repeatedly demonstrated critical vulnerabilities in modern machine learning (ML) models [25, 34, 21].
As ML systems are deployed in increasingly important settings, significant effort has been levied in understanding attacks and defenses towards robust machine learning.
In this paper we focus on data poisoning attacks .
ML models require a large amount of data to achieve good performance and thus practitioners frequently gather data by scraping content from the web [11, 37].
This gives rise to an attack vector, in which an adversary may manipulate part of the training data by injecting poisoned samples.
For example, an attacker can actively manipulate datasets by sending corrupted samples directly to a dataset aggregator such as a chatbot, a spam filter, or user profile databases; the attacker can also passively manipulate datasets by placing poisoned data on the web and waiting for collection.
Moreover, in federated learning , adversaries can also inject malicious data into a diffuse network [30, 22].
A spectrum of such data poisoning attacks exists in the literature, including targeted , indiscriminate and backdoor attacks (see Appendix A for a detailed comparison).
We focus on indiscriminate attacks for image classification, where the attacker aims at decreasing the overall test accuracy of a model by adding a small portion of poisoned points.
Current indiscriminate attacks are most effective against convex models [2, 18, 19, 31], and several defenses have also been proposed [32, 6].
However, existing poisoning attacks are less adequate against more complex non-convex models, especially deep neural networks, either due to their formulation being inherently tied to convexity or computational limitation.
For example, most prior attacks generate poisoned points sequentially.
Thus, when applied to deep models or large datasets, these attacks quickly become computationally infeasible.
To our knowledge, a systematic analysis on poisoning deep neural works is still largely missing—a gap we aim to fill in this work.
To address this difficult problem, we design more versatile data poisoning attacks by formulating the problem as a non-zero-sum Stackelberg game, in which the attacker crafts some poisoned points with the aim of decreasing the test accuracy, while the defender optimizes its model on the poisoned training set.
We exploit second-order information and apply the Total Gradient Descent Ascent (TGDA) algorithm to address the attacker’s objective, even on non-convex models.
Moreover, we address computational challenges by proposing an efficient architecture for poisoning attacks, where we parameterize the attacker as a separate network rather than optimizing the poisoned points directly.
By applying TGDA to update the attacker model directly, we are able to generate tens of thousands of poisoned points simultaneously in one pass, potentially even in a coordinated way.
In this work, we make the following contributions: (1) We construct a new data poisoning attack based on TGDA that incorporates second-order optimization.
In comparison to prior data poisoning attacks, ours is significantly more effective and runs at least an order of magnitude faster. (2) We propose an efficient attack architecture, which enables a more efficient, clean-label attack.
(3) We conduct experiments to demonstrate the effectiveness of our attack on neural networks and its advantages over previous methods.
Total Gradient Descent Ascent Attack
In this section, we formulate the indiscriminate attack and introduce our attack algorithm.
We first briefly introduce the Stackelberg game and then link it to indiscriminate data poisoning.
2.1 Preliminaries on Stackelberg Game
The Stackelberg competition is a strategic game in economics in which two parties move sequentially [36].
Specifically, we consider two players, a leader L and a follower F in a Stackelberg game, where the follower F chooses w to best respond to the action x of the leader L , through minimizing its loss function f :
[Equation]
and the leader L chooses x to maximize its loss function ℓ :
[Equation]
where ( x ∗ , w ∗ ( x ∗ )) is known as a Stackelberg equilibrium.
For simplicity, we assume W = R p and the functions f and ℓ are smooth, hence the follower problem is an instance of unconstrained smooth minimization.
2.2 On Data Poisoning Attacks
There are two possible ways to formulate data poisoning as a Stackelberg game, according to the acting order.
Here we assume the attacker is the leader and acts first, and the defender is the follower.
This assumption can be easily reversed such that the defender acts first.
Both of these settings are realistic depending on the defender’s awareness of data poisoning attacks.
We will show in Sectionthat the ordering of the two parties affects the results significantly.
Non-zero-sum formulation.
In this section we only consider the attacker as the leader as the other case is analogous.
Here recall that the follower F (i.e., the defender) aims at minimizing its loss function f under data poisoning:
[Equation]
while the attacker aims at maximizing a different loss function ℓ on the validation set D v :
[Equation]
where the loss function L ( · ) can be any task-dependent target criterion, e.g., the cross-entropy loss.
Thus we have arrived at the bilevel optimization problem [23, 17, 19]:
[Equation]
Previous approaches.
While the inner minimization can be solved via gradient descent, the outer maximization problem is non-trivial as the dependence of L ( D v , w ∗ ) on D p is indirectly through the parameter w of the poisoned model.
Thus, applying simple algorithms (e.g., Gradient Descent Ascent) directly will result in zero gradient .
Nevertheless, we can rewrite the desired derivative using the chain rule: ∂ L ( D v , w [Equation] D p
[Equation]
p .
The difficulty lies in computing ∂ w ∗ ∂ D p , i.e., measuring how much the model parameter w changes with respect to the poisoned points D p .
Various approaches compute ∂ w ∗ ∂ D p by solving this problem exactly via KKT conditions [2, 18], or approximately using gradient ascent [23].
TGDA attack.
However, we can avoid such calculation using the Total gradient descent ascent (TGDA) algorithm [7, 8]: TGDA takes a total gradient ascent step for the attacker and a gradient descent step for the defender:
[Equation]
where D x := ∇ x ℓ − ∇ wx f · ∇ − 1 ww f · ∇ w ℓ is the total derivative of ℓ with respect to x , which implicitly measures the change of w with respect to D p .
We thus apply the total gradient descent ascent algorithm and call this the TGDA attack .
Avoiding computing ∂ w ∗ ∂ D p enables us to parameterize D p and generate points indirectly by treating L as a separate model.
Namely that D p =
L θ ( D ′ tr ) , where θ is the model parameter and D ′ tr is part of the training set to be poisoned.
Thus, we have arrived a poisoning attack that generates D p in a batch rather than individually, which greatly improves the attack efficiency.
Zero-sum reduction.
Previous work [19] also proposed a reduced problem of Equation (5), where the leader and the follower consider the same loss function such that f = ℓ :
[Equation]
This relaxation enables attack algorithms to optimize the outer problem directly.
However, this formulation may be problematic as the training objective optimizes on poisoned points, which does not reflect its influence on test data.
This problem is addressed by [19] with an assumption that the attacker can acquire a target model parameter, usually using a label flip attack which considers a much larger poisoning fraction ϵ .
By adding a constraint involving the target parameter w tar , the attacker can search for poisoned points that maximize the loss ℓ while keeping low loss on w tar ∗ .
However, such target parameters are hard to obtain since, as we will demonstrate, non-convex models appear to be robust to label flip attacks and there are no guarantees that w tar ∗ is the solution of Equation (5).
An Efficient Attack architecture
In this section, we discuss how we use the TGDA attack to efficiently perform data poisoning attacks.
We observe that existing data poisoning attacks have two limitations :
(1) The first limitation : existing attacks work under subtly different assumptions, on, for example, the attacker’s knowledge, the attack formulation and the training set size.
These inconsistencies result in
unfair comparisons between methods (see Table 5 in Appendix B for a detailed comparison).
Thus we set an experimental protocol for generalizing existing attacks and benchmarking data poisoning attacks for systematic analysis in the future.
Here we fix three key variants:
the attacker’s knowledge: as discussed in Appendix A, we consider training-only attacks (the attacker has access to training data D tr , the target model, and the training procedure); the attack formulation: in Section 2, we introduce three possible formulations, namely non-zero-sum, zero-sum, and zero-sum with target parameters.
We will show in the experiment section that the latter two would not work for neural networks.
the dataset size: existing works measure attack efficacy with respect to the size of the poisoned dataset, where size is measured as a fraction ϵ of the training dataset.
However, some works subsample and thus reduce the size of the training dataset.
As we show in Figure 1, attack efficacy is not invariant to the size of the training set: larger training sets appear to be harder to poison.
Furthermore, keeping ϵ fixed, a smaller training set reduces the number of poisoned data points and thus the time required for methods that generate points sequentially, potentially concealing a prohibitive runtime for poisoning the full training set.
Thus we consider not only a fixed ϵ , but also the complete training set for attacks.
(2) The second limitation: they approach the problem by optimizing individual points directly, thus having to generate poisoned points one by one
Thus we design a new poisoning scheme that allows simultaneous and coordinated generation of D p in batches requiring only one pass that involves three stages:
Pretrain: The goals of the attacker L are to: reduce the test accuracy (i.e., successfully attack) and generate D p that is close to D tr (i.e., thwart potential defenses).
The attacker achieves the first objective during the attack by optimizing ℓ .
However, ℓ does not enforce that the distribution of the poisoned points will resemble those of the training set.
To this end, we pretrain L to reconstruct D tr , producing a parameter vector θ pre .
This process is identical to training an autoencoder.
For the defender, we assume that F is fully trained to convergence.
Thus we perform standard training on D tr to acquire F with w pre .
Attack: We generate poisoned points using the TGDA attack.
We assume that the attacker can inject ϵN poisoned points, where
N = |D tr | and ϵ is the power of the attacker, measured as a fraction of the training set size.
(a) Initialization: We take the pretrained model L with parameter θ pre and F with pretrained parameter w pre as initialization of the two networks; the complete training set D tr ; a validation set D v and part of the training set as initialization of the poisoned points D 0 p =
D tr [0 : ϵN ] .
(b) TGDA attack: We then perform TGDA attack using the updates in Section 2.
We use total gradient ascent to update attacker parameter θ of L , and gradient descent to update defender parameter w of F .
(c) Label Information: We specify that D 0 p = { x i , y i } ϵNi =1 .
Prior works (e g., [19, 23]) optimize x to produce x p , and perform a label flip on y to produce y p .
This approach neglects label information during optimization.
In contrast, we fix y p = y
and concatenate x and y to D p
= { x i ; y i ϵNi
=
as
input to L .
Thus we generate poisoned points by considering the label information
We emphasize that we do not optimize or change the label during the attack, but merely use it to aid the construction of the poisoned x p .
Thus, our attack belongs to the clean label category.
Testing : Finally, we discuss how we measure the effectiveness of an attack.
In a realistic setting, the testing procedure should be identical to the pretrain procedure, such that we can measure the effectiveness of D p fairly.
The consistency between pretrain and testing is crucial as the model F is likely to underfit with fewer training steps.
Experiments
We evaluate our TGDA attack on various models for image classification tasks and show the efficacy of our method for poisoning neural networks.
Specifically, our results confirm that: (1) By applying the Stackelberg game formulation and incorporating second-order information, we can attack neural networks with improved efficiency and efficacy using the TGDA attack; (2) The efficient attack architecture further enables the TGDA attack to generate D p in batches; (3) The poisoned points are visually similar to clean data, making the attack intuitively resistant to defenses.
4.1 Experimental Settings
Dataset: We consider image classification on the MNIST [5] (60,000 training and 10,000 test images), and CIFAR-10 [20] (50,000 training and 10,000 test images) datasets.
We are not aware of prior work
[Table] [Table]
that performs indiscriminate data poisoning on a dataset more complex than MNIST or CIFAR-10, and, as we will see, even these settings give rise to significant challenges in designing efficient and effective attacks.
Indeed, some prior works consider only a simplified subset of MNIST (e [Table] g., binary classification on 1’s and 7’s, or subsampling the training set to 1,000 points) or CIFAR-10 (e [Table]
g., binary classification on dogs and fish).
In contrast, we set a benchmark by using the full datasets for multiclass classification.
Baselines: Among existing attacks, only a few can be directly compared with our method due to their attack formulations.
For instance, the Poison SVM [2] and KKT [19] attacks can only be applied to convex models for binary classification; the Min-max [19] and the Model targeted [33] attacks can be only applied to convex models.
Thus we compare with two baseline methods that can attack neural networks: the Back-gradient attack [23] and the Label flip attack [2].
Moreover, it is also possible to apply certain targeted attack method (e.g., MetaPoison [17]) in the context of the indiscriminate attack.
Thus we compare with MetaPoison on CIFAR-10 under our unified architecture.
See Appendix C for a detailed list of our experimental settings (hardware and package, model details, dataset split, pretrain hyperparameters and complete baseline methods).
4.2 Comparison with Benchmarks
MNIST.
We compare our attack with the Back-gradient and the Label flip attacks with ϵ = 3% on
MNIST in Table 1.
Since the Back-gradient attack relies on generating poisoned points sequentially, we cannot adapt it into our unified architecture and run their code directly for comparison.
For the label flip attack, we flip the label according to the rule that y ← 10 − y as there are 10 classes.
We observe that label flip attack, though very efficient, is not effective against neural networks.
Although [23] shows empirically that the Back-gradient attack is effective when attacking subsets of MNIST (1,000 training samples, 5,000 testing samples), we show that the attack is much less effective on the full dataset.
We also observe that the complexity of the target model affects the attack effectiveness significantly.
Specifically, we find that neural networks are generally more robust against indiscriminate data poisoning attacks, among which, the CNN architecture is even more robust.
Overall, our method outperforms the baseline methods across the three target models.
Moreover, with our unified architecture, we significantly reduce the running time of poisoning attacks by more than an order of magnitude.
CIFAR-10.
We compare our attack with the Label flip attack and the MetaPoison attack with ϵ = 3% on CIFAR-10 in Table 2.
We omit comparison with the Back-gradient attack as it is too computationally expensive to run on CIFAR-10.
We observe that the TGDA attack is very effective at poisoning the CNN architecture, but the running time becomes infeasible on larger models (e.g.,
ResNet).
Also, MetaPoison is a more efficient attack (meta-learning with 2 unrolled steps are much quick than calculating total gradient), but since its original objective is to perform targeted attack, its application on indiscriminate attack is not effective.
Moreover, the difference between the efficacy of the TGDA attack on MNIST and CIFAR-10 suggests that indiscriminate attacks may be dataset dependent, with MNIST being harder to poison than CIFAR-10.
[Table] [Table]
4.3 Ablation Studies:
Who acts first.
In Section 2, we assume that the attacker is the leader and the defender is the follower, i [Table] e., that the attacker acts first.
Here, we examine the outcome of reversing the order, where the defender acts first.
Table 3 shows the comparison.
We observe that across all models, reversing the order would cause a less effective attack.
This result shows that even without any defense strategy, the target model would be more robust if the defender acts one step ahead of the attacker.
Attack formulation.
In Section 2, we discuss a relaxed attack formulation, where ℓ = f and the game is zero-sum.
We perform experiments on this setting and show results in Table 4.
We observe that the non-zero-sum formulation is significantly more effective, and in some cases, the zero-sum setting actually increases the accuracy after poisoning.
We also find that using target parameters would not work for neural networks as they are robust to label flip attacks even when ϵ is large.
We ran a label flip attack with ϵ = 100% and observed only 0.1% and 0.07% accuracy drop on NN and
CNN architectures, respectively.
This provides further evidence that neural networks are robust to massive label noise, as observed by [26].
4.4 Visualization of attacks
We visualize some poisoned points D p generated by the TGDA attack in Figure 2.
The poisoned samples against NN and CNN are visually very similar with D tr , which provides heuristic evidence that the TGDA attack may be robust against data sanitization algorithms.
We further quantitatively evaluate the robustness of TGDA attack agaisnt data sanitization algorithms in Appendix C.
Checklist
For all authors... (a) Do the main claims made in the abstract and introduction accurately reflect the paper’s contributions and scope?
[Yes] (b) Did you describe the limitations of your work?
[Yes] (c) Did you discuss any potential negative societal impacts of your work?
[N/A] (d) Have you read the ethics review guidelines and ensured that your paper conforms to them?
[Yes] 2.
If you are including theoretical results... (a) Did you state the full set of assumptions of all theoretical results?
[Yes] (b) Did you include complete proofs of all theoretical results?
[Yes] 3.
If you ran experiments... (a) Did you include the code, data, and instructions needed to reproduce the main experimental results (either in the supplemental material or as a URL)?
[Yes] (b) Did you specify all the training details (e.g., data splits, hyperparameters, how they were chosen)?
[Yes] (c) Did you report error bars (e.g., with respect to the random seed after running experiments multiple times)?
[Yes] (d) Did you include the total amount of compute and the type of resources used (e.g., type of GPUs, internal cluster, or cloud provider)?
[Yes] 4.
If you are using existing assets (e.g., code, data, models) or curating/releasing new assets... (a) If your work uses existing assets, did you cite the creators?
[Yes] (b) Did you mention the license of the assets?
[Yes] (c) Did you include any new assets either in the supplemental material or as a URL?
[No] (d) Did you discuss whether and how consent was obtained from people whose data you’re using/curating?
[N/A] (e) Did you discuss whether the data you are using/curating contains personally identifiable information or offensive content?
[N/A] 5.
If you used crowdsourcing or conducted research with human subjects... (a) Did you include the full text of instructions given to participants and screenshots, if applicable?
[N/A] (b) Did you describe any potential participant risks, with links to Institutional Review Board (IRB) approvals, if applicable?
[N/A] (c) Did you include the estimated hourly wage paid to participants and the total amount spent on participant compensation?
[N/A]
A Background on Data Poisoning Attacks
In this appendix, we categorize existing data poisoning attacks according to the attacker’s power and objectives , and specify the type of attack we study in this paper.
A.1 Power of an attacker
Injecting poisoned samples.
Normally, without breaching one’s database (i.e., changing the existing training data D tr ), an attacker can only inject poisoned data, actively or passively to the defender’s database, such that its objective can be achieved when the model is retrained after collection.
Where the goal of the attacker can be presented as:
[Equation]
where w ∗ is the desired model parameter, which realizes its respective objectives.
We focus on such attacks and further categorize such objectives in the next subsection.
Perturbing training data D tr .
An attacker may change D tr directly on one occasion, where the attacker is also the “defender”.
Such an attacker can be the dataset owner, who intends to preserve a proprietary dataset to release but prevents others from benefiting by training it [16, 38, 10, 9], thus allows modification up to the entire D tr to make it unlearnable.
For simplicity, we refer to injecting poisoned samples as data poisoning attacks , and perturbing training data as dataset protection in this paper.
A.2 Objective of an attacker
Data poisoning attacks can be further classified into three categories according to the adversary’s objective [12].
See Figure 3 for a taxonomic illustration.
Targeted attack.
The attacker adds poisoned data D p and acquire w ∗ such that a particular target example from the test set is misclassified as the base class [29, 1, 15, 40].This topic is well studied in the literature, and we refer the reader to [28] for an excellent summary of existing methods.
Backdoor attack.
This attack aims at misclassifying any test input with a particular trigger pattern [14, 35, 4, 27].
Note that backdoor attacks require access to the input during inference time to plant the trigger.
Indiscriminate attack.
This attack aims to acquire w ∗ by injecting poisoned data which decreases the model accuracy overall (or deny of service).
We consider image classification tasks where
[Table]
the attacker aims to reduce the overall classification accuracy.
Existing methods make different assumptions on the attacker’s knowledge:
• Perfect knowledge attack: the attacker has access to both training and test data ( D tr and D test ), the target model, and the training procedure (e.g., the min-max attack of [19]).
• Training-only attack: the attacker has access to training data D tr , the target model, and the training procedure (e.g., [23, 3]). • Training-data-only attack: the attacker only has access to the training data D tr (e.g., the label flip attack of [2]).
In this work, we focus on training-only attacks because perfect knowledge attacks are not always feasible due to the proprietary nature of the test data, while existing training-data-only attacks are weak and often fail for deep neural networks, as we show in Section 4.
B Experimental Protocol
We first summarize existing indiscriminate data poisoning attacks in Table 5, where we identify that such attacks work under subtly different assumptions, on, for example, the attacker’s knowledge and the training set size.
These inconsistencies result in unfair comparisons between methods .
C Additional Experiments C.1 Experimental Settings
Hardware and package: Experiments were run on a cluster with T4 and P100 GPUs.
The platform we use is PyTorch.
Specifically, autodiff can be easily implemented using torch.autograd .
As for the total gradient calculation, we follow [39] and apply conjugate gradient for calculating
Hessian-vector products.
Dataset: We consider image classification on the MNIST [5] (60,000 training and 10,000 test images), and CIFAR-10 [20] (50,000 training and 10,000 test images) datasets.
We are not aware of prior work that performs indiscriminate data poisoning on a dataset more complex than MNIST or CIFAR-10, and, as we will see, even these settings give rise to significant challenges in designing efficient and effective attacks.
Indeed, some prior works consider only a simplified subset of MNIST (e.g., binary classification on 1’s and 7’s, or subsampling the training set to 1,000 points) or CIFAR-10 (e.g., binary classification on dogs and fish).
In contrast, we set a benchmark by using the full datasets for multiclass classification.
Training and validation set: During the attack, we need to split the clean training data to the training set D tr and validation set D v .
Here we split the data to 70% training and 30% validation, respectively.
[Table]
[Table]
Thus, for the MNIST dataset, we have |D tr | = 42000 and |D v | = 18000 .
For the CIFAR-10 dataset, we have |D tr | = 35000 and |D v | = 15000 .
Attacker models and Defender models: (1) For the attacker model, for MNIST dataset: we use a three-layer neural network, with three fully connected layers and leaky ReLU activations; for
CIFAR-10 dataset, we use an autoencoder with three convoluational layers and three conv transpose layers.
The attacker takes the concatenation of the image and the label as the input, and generates the poisoned points.
(2) For the defender, we examine three target models for MNIST:
Logistic
Regression, a neural network (NN) with three layers and a convolutional neural network (CNN) with two convolutional layers, maxpooling and one fully connected layer; and only the CNN model for
CIFAR-10 (as CIFAR-10 contains RBG images).
Hyperparameters: (1) Pretrain: we use a batch size of 1,000 for MNIST and 256 for CIFAR-10, and optimize the network using our own implementation of gradient descent with torch.autograd .
We choose the learning rate as 0.1 and train for 100 epochs.
(2) Attack: for the attacker, we choose α = 0 .
01 , m = 1 by default; for the defender, we choose β = 0 .
1 , n = 20 by default.
We set the batch size to be 1,000 for MNIST; 256 for CIFAR10 and train for 200 epochs, where the attacker is updated using total gradient ascent and the defender is updated using gradient descent.
We follow [39] and implement TGA using conjugate gradient.
We choose the poisoning fraction ϵ = 3% by default.
Note that choosing a bigger ϵ will not increase our running time, but we choose a small ϵ to resemble the realistic setting in which the attacker is limited in their access to the training data. 3) Testing:
we choose the exact same setting as pretrain to keep the defender’s training scheme consistent.
Baselines: There is a spectrum of data poisoning attacks in the literature.
However, due to their attack formulations, only a few attacks can be directly compared with our method.
For instance, the Poison
SVM [2] and KKT [19] attacks can only be applied to convex models for binary classification; the
Min-max [19] and the Model targeted [33] attacks can be only applied to convex models.
Thus we compare with two baseline methods that can attack neural networks: the Back-gradient attack [23] and the Label flip attack [2].
Moreover, it is also possible to apply certain targeted attack method (e.g.,
MetaPoison [17]) in the context of the indiscriminate attack.
Thus we compare with MetaPoison on
CIFAR-10 under our unified architecture.
We follow [17] and choose K = 2 unrolled inner steps,outer steps and an ensemble of 24 inner models.
C.2 Against Defenses:
To further evaluate the robustness of TGDA attack against data sanitization algorithms:
(1) We perform the loss defense [19] by removing 3% of training points with the largest loss.
We compare with pGAN [24], which include constraint on the similarity between clean and poisoned sample thus inherently robust against defenses.
In Table 6, we observe that although we do not add explicit constraint on detectability in our loss function, our method still reaches comparable robustness against such defenses with pGAN.
(2) We examine the robustness of our TGDA attack against strong data augmentations, e.g., the MaxUp defense 3 [13]
In a nutshell, MaxUp generates a set of augmented data with random perturbations and then aims at minimizing the worst case loss over the augmented data.
Such training technique addresses overfitting and serves as a valid defense against adversarial examples.
However, it is not clear if MaxUp is a good defense against indiscriminate data poisoning attacks.
Thus, we implement MaxUp under our testing protocol, where we add random perturbations to the training and the poisoned data, i.e., {D tr ∪ D p } , and then minimize the worst case loss over the augmented set.
We report the results in Table 7, where we observe that even though MaxUp is a good defense against adversarial examples, it is not readily an effective defense against indiscriminate data poisoning attacks.
Part of the reason we believe is that in our formulation the attacker anticipates the retraining done by the defender, in contrast to the adversarial example setting.