Friendly Noise against Adversarial Noise: A Powerful Defense against Data Poisoning Attacks
Anonymous Author(s)
AffiliationAddress email
Abstract
Data poisoning attacks modify a subset of training examples by small adversarialperturbations to change the prediction of certain test-time data.
Existing defensemechanisms are not desirable to deploy in practice, as they often drastically harmthe generalization performance, or are attack-specific and prohibitively slow toapply.
Here, we propose a simple but highly effective approach that unlike existingmethods breaks various types of poisoning attacks with the slightest drop in thegeneralization performance.
We make the key observation that attacks exploit sharploss regions to craft adversarial perturbations which can substantially alter examples’ gradient or representations under small perturbations.
To break poisoningattacks, our approach comprises two components: an optimized friendly noise thatis generated to maximally perturb examples without degrading the performance,and a random varying noise component.
The first component takes examples fartheraway from the sharp loss regions, and the second component smooths out the losslandscape.
The combination of both components builds a very light-weight butextremely effective defense against the most powerful triggerless and backdoorpoisoning attacks, including Gradient Matching, Bulls-eye Polytope, and Sleeper Agent.
We show that our friendly noise is transferable to other architectures, andadaptive attacks cannot break our defense due to its random noise component.
Introduction
Big datasets empower large over-parameterized deep learning systems.
Such datasets are oftenscraped from the internet or other public and user-provided sources.
An adversary can easily insert asubset of malicious examples into the data collected from public sources to harm the model’s behavior.
As a result, deep learning systems trained on public data are extremely vulnerable to data poisoningattacks which modifies a subset of training examples under bounded adversarial perturbations withthe aim of changing the model’s prediction on specific test-time examples.
Powerful attacks generatepoisons that visually look innocent and are seemingly properly labeled [10, 15, 34].
This makes themhard to detect even by expert observers.
Hence, data poisoning attacks are arguably one of the mostconcerning threats to deep learning systems [19].
Various types of poisoning attacks have been proposed to challenge and exploit the vulnerabilities ofdeep learning systems.
Backdoor data poisoning attacks add a fixed but not necessarily visible triggerpattern to a subset of training data as well as the test-time target examples [13, 34, 39].
Triggerlesspoisoning attacks add bounded perturbations to a subset of training examples to make them similarto the adversarially labeled test-time target in the feature or gradient space [2, 12, 15, 32, 43].
Inboth cases, training or fine tuning the model on the poisoned training data cause the model to tomisclassify certain target examples at test-time.
There has been sustained efforts to design effective defense mechanisms [1, 7, 11, 17, 25, 27, 33, 38].
However, existing methods are highly impractical to be employed in real-world deep learningpipelines.
Firstly, majority of the existing methods are attack specific and cannot protect the systemagainst various types of data poisoning attacks [11, 27, 38].
Secondly, the provided protection isoften in expense of significantly dropping the performance of the machine learning pipeline [1, 7, 25].
Thirdly, existing methods are not effective in protecting the deep learning pipelines against adaptiveattacks which can make more powerful poisons with the knowledge of the defense in place [17, 33].
Finally, state-of-the-art defense methods are often so expensive that can hardly be applied to evenmedium-sized datasets [11, 27], and are ineffective in presence of larger number of poisons [7, 11, 27].
In this work, we propose a simple and powerful defense, namely Friendly Noise Defense (F RIE ND S ),against various types of data poisoning attacks.
In particular, we make the following key observation:data poisoning attacks exploit sharp regions of the loss to craft adversarial perturbations which cansubstantially alter examples’ gradient or representations under small perturbations.
To effectivelybreak poisoning attacks, our proposed method is composed of two noise components: first we findthe maximum perturbation that can be added to every example without considerably changing themodel’s output.
This fixed accuracy-friendly perturbation is found early in training and is transferableto other architectures.
Then, we add a varying random noise in addition to the friendly perturbation toeach example at every training iteration.
Effectively, the friendly perturbation takes examples fartheraway from the sharp loss regions exploited by the attacker.
The random noise component smoothsout the loss landscape, and does not allow the crafted adversarial perturbation to match the target’sgradient or representation closely.
Despite being very light-weight, the combination of the two noisycomponents can effectively protect deep learning systems against various types of poisoning attacks,with minimum drop in the generalization performance.
We note that the random noise component of F RIE ND S makes it extremely difficult for an adaptiveattacker to break our defense.
Adaptive attacks can bypass defenses by taking the defense mechanisminto account when generating poisons.
For F RIE ND S , while an attacker may use the knowledge ofthe optimization procedure to bypass the friendly noise component, they need to take into account aprohibitively large number of random noise combinations when generating attacks.
This makes italmost impossible for the attacker to ensure the effectiveness of an attack in presence of F RIE ND S .
Through extensive experiments, we show that our light-weight method renders state-of-the-arttargeted attacks, including Gradient Matching [10], Bullseye Polytope [2], Feature Collision [32],and Sleeper Agent [34] ineffective, with only a slight decrease in the performance.
We also showthat the optimized noise component generated based on a particular architecture can be applied todefend other architectures against data poisoning attacks.
Therefore, it is easy to apply F RIE ND S toreal-world deep learning pipelines with minimal additional costs.
Related Work
Targeted Data Poisoning Attacks.
Data poisoning attacks on deep networks have been exploredalong two directions - triggered and triggerless attacks.
Triggered attacks, or backdoor attacks, aim tomisclassify samples containing a ‘trigger’ patch as a pre-determined target class during inference time.
In the transfer learning or finetuning setting, earlier works of [8, 13, 23] relied on label modification orunbounded image perturbations.
These attacks are, however, easy to detect.
Subsequently, [30, 34, 39]introduced clean-label and visually imperceptible backdoor attacks.
Recently, [34] proposed the firstclean-label hidden backdoor attack that is effective on victim models trained from scratch.
Triggerlessdata poisoning attacks aim to misclassify a given target as a pre-determined adversarial class, byadding optimized bounded perturbations to a subset of training examples.
Such attacks either optimizefor feature matching [2, 32, 43] or gradient matching [10] between poisoned and target images, oruse meta-learning to solve the poisoning problem directly via bilevel optimization [15] .
Defense Strategies.
Existing defenses against data poisoning can be divided into filtering and robusttraining methods.
Filtering methods detect outliers in feature space using thresholding [35] andnearest neighbors [27], or activation space [7], or through decomposition of the feature covariancematrix [38].
These defenses typically assume that only small subsets of the data are poisoned, henceremoving such points do not significantly harm generalization.
In practice, this assumption may nothold, and such defenses can be easily broken by increasing the number of poisons.
Moreover, suchmethods increase training time by orders of magnitudes, as the filtering step requires training themodel with poisons, followed by (usually expensive) filtering, and model retraining [7, 27, 35, 38].
Robust training methods apply randomized smoothing [41], strong data augmentation [4], or modelensembling [21].
Other methods impose constraints on gradient magnitudes and directions [14],detects and removes poisons with gradient ascent [22], or apply adversarial training [11, 25, 37].
Deferentially private (DP) training methods have also been explored to defend against data poisoning[1, 5, 16].
Robust training techniques usually involve a significant trade-off between generalizationand poison success rate [1, 14, 22, 25, 37], or are computationally very expensive [11, 25].
Comparedto augmentation-based and adversarial training methods, our method is simple, fast, and maintainsgood generalization performance.
Compared to data augmentation, the random noise componentof F RIE ND S is considerably more effective in smoothing the loss landscape, due to its much largerspace of independent pixel-level transformations.
Random and Adversarial Noise.
It is shown that small perturbations can result in large changesin the output of a deep network [36].
Hence, application of random and adversarial noise has beenstudied in various domains.
In particular, [28] uses Gaussian noise to defend against query-basedblack box attacks, and [29] shows that additive augmentations of Gaussian or Speckle noise is asimple yet very strong baseline for robustness against image corruptions.
Application of optimizednoise has been mainly studied in the context of adversarial training.
[6] uses Generative Adversarial
Networks (GANs) to generate adversarial perturbations, and [24] relies on meta-learning to learna noise generator to defend against adversarial perturbations.
Moreover, [26, 42] demonstrate thetransferability of adversarial perturbations across architectures and domains.
In data poisoning, smallrandom noise generated from a particular distribution has been shown to be ineffective for breakingattacks and harmful on the generalization performance [11].
In contrast, we show that randomnoise combined with our proposed noise optimization approach, can make a highly effective defensemechanism against data poisoning attacks and achieve a superior generalization performance.
F RIE ND S : Friendly Noise Defense against Data Poisoning Attacks
Targeted data poisoning attacks modify a fraction of training data points by adding optimizedperturbations that are within an l ∞ -norm ξ -bound.
The optimization is done with the objective ofchanging the prediction of a target example x t in the test set to an adversarial label y adv .
A smallperturbation bound ξ ensures that the poisoned examples remain visually similar to the original(base) training data points.
Poisons crafted by such attacks look innocent to human observer and areseemingly labeled correctly.
Hence, they are called clean-label attacks.
Targeted clean label datapoisoning attacks can be formulated as the following bilevel optimization problem:
[Equation]
Require:
Train dataset X , Model f θ , LR η opt , λ , small number T for i ∈
[ T ] do
[Equation]
epochs end for for x i ∈
X do
Initialize noise [-ϵ 
-]for
= to T do
[Equation]
end for
Store noise ϵ i =
ϵ Ti for example x i end for where
C = { δ ∈ R n × m : ∥ δ ∥ ∞ ≤ ξ, δ i =
∀
i / ∈ V p } is the constraint set defining the set of validpoisons, V is the training data, and V p is the set of poisoned training examples.
To address theabove optimization problem, powerful poisoning attacks such as Meta Poison (MP) [15], Gradient
Matching(GM)
[10], Bull-eyes Polytope (BP) [2], and Sleeper Agent [34] craft the poisons to mimicthe gradient (equivalently representation in transfer learning) of the adversarially labeled target, i.e.,
[Equation]
Minimizing the training loss on RHS of Eq.(1) also minimizes the adversarial loss on LHS of Eq.
3.1 Powerful Poisons Fall in Sharp Loss Regions
Based on Eq.
(2), we make the following key observation.
To substantially change the gradient of atraining example ∇L ( x t , y adv , θ )
≈ ∇L ( x i
+ δ i , y i , θ ) , under bounded perturbation
∥ x i + δ i ∥ ∞ ≤∥ x i ∥ ∞ + ξ , the attacker needs to exploit the highly non-convex nature of the loss by finding sharpregions in a ball of radius ξ around example x i .
If such regions can be found, the example can beslightly modified to fall in the sharp region and further optimized there to match the target gradient.
Fig. 2(c) shows that the undefended model’s output around every poison has a large variance.
Suchnon-linearities can be exploited by attackers to craft poisons effectively.
As poisons rely on sharp loss regions to match a particular gradient or representation, they are highlysensitive to small perturbations.
Indeed, slightly perturbing the poisons considerably change their gradient and make them ineffective.
The main idea behind our friendly noise defense method, F RIE ND S ,is to maximally perturb the training examples to make the poisons ineffective.
However, perturbingtraining examples should be done in a way that does not harm the generalization performance ofthe model.
To address this, our method is composed of two components: First, we find maximumperturbation that can be added to every training example without changing its prediction.
Intuitively,this pulls examples far away from sharp loss regions that may have been exploited by the attacker.
Tofurther break the attack, we add varying random noise to every example during the training.
Thissmooths out the loss and consecutively changes the poisons gradient and makes the crafted poisonsineffective.
Below, we discuss each component in more details.
3.2 Optimizing the Friendly Noise: Taking Poisons away from Sharp Regions
The first component of our method finds the maximum perturbation that can be added to everyexample without considerably changing the model’s output.
To do so, for every example x i weoptimize for the largest noise ϵ i within an l ∞ norm ζ -bound that results in a similar class probabilities,measured by KL-divergence.
Formally for each example x i , we find perturbation
ϵ i as follows:
[Equation]
We generate a fixed accuracy-friendly perturbation for every data point by solving problem (3)once, using a few Stochastic Gradient Descent (SGD) steps.
There is a trade-off between thetime of generating the optimized perturbations and their effectiveness.
In particular, the optimizedperturbations need to be generated and added to the training examples early in training, before the [Figure] attack succeeds (Fig. 2(a)).
At the same time for the perturbations to be effective, they should begenerated after the decision boundary is shaped (Fig. 2(b)).
We found that training for as few as5 epochs before solving the optimization problem (3) yields effective perturbations that reduce theattack success rate without harming the model’s performance.
The pseudocode can be found in Alg.1.
To better understand the effect of our friendly noise, we first look at the histogram of the noise added toevery pixel in the training data.
Fig.
3(a) shows that our method mainly targets certain pixels in everyimage by adding the maximum amount of perturbation, and leaves the rest of the image untouched.
Certain semantic regions have been shown to be much more robust to perturbations [3].
Perturbingthe more robust areas does not considerably change the model’s behavior and training dynamics.
Onthe other hand, the least robust areas are very sensitive to perturbations, hence small amounts of noisein such areas result in a relatively large change in the model’s behaviour.
We visualize the poisonsbefore and after adding our friendly noise in Fig.
We see that our friendly noise successfully targetscertain areas in every image that are robustly learned, by adding the maximum possible perturbation.
Intuitively, perturbing the more robust areas pulls examples far away from the sharp regions of theloss, and perturbing the less robust regions move them closer to the sharp regions.
Our friendlyperturbation successfully pulls the poisons far away from the sharp regions that may have beenutilized by the attack.
By moving along the level curve of the loss, the important features used forclassifications are preserved and hence model predictions remain unchanged, but the adversarialpoison perturbations can no longer closely match the target gradient or representation.
Hence, thecrafted adversarial perturbations added to the examples augmented with our friendly noise cannotpoison the model.
Hence, our method reduces the attack success rate while preserves the trainingdynamics and ensures minimum drop in the test accuracy.
Next, we discuss how adding a random variable random noise can further improve the model’srobustness against poisoning attacks.
3.3 Adding Random Noise: Smoothing the Loss
As discussed, our friendly perturbation mainly targets the robust areas of the image and pulls examplesfar away from the sharp loss regions, without considerably changing the training dynamics.
To furtherimprove model’s robustness against poisoning attacks, we add a variable random noise to the trainingexamples at every training iteration.
Effectively, adding the variable random noise smooths out theloss landscape.
In doing so, the optimized poison perturbations cannot match the target gradient, ason a smooth manifold the gradients do not change considerably in a small ball around every example.
Consequently, adding the random noise considerably drops the attack success rate.
The pseudocodeof our defense, F RIE ND S , can be found in Alg. 2.
The small varying random noise can be sampled from various distributions.
In particular, we samplefrom 3 different random noise distributions: (1) Bernoulli: noise is randomly sampled from {− µ, µ } ,(2) Uniform: noise is randomly sampled from [ − µ, µ ] , and (3) Gaussian: noise is sampled fromthe normal distribution N (0 , µ ) .
Fig.
3 compares the distribution of random noise sampled from
Algorithm
Require: Train dataset X , Random Noise Distribution A, Epoch to start defense def _ epoch
Run Algorithm 1 to generate { ϵ i } | X | i
= for i = def _ epoch to n _ epochs do for x i ∈
X do
Sample random noise µ i ∼ A
Set ˆ x i
=
x
i
+ ϵ
i + µ i and add to dataset ˆ X end for θ i
= θ i − 1 − η ∇ θ
L
( θ i − 1 , ˆ X )
▷ SGD update step with new dataset ˆ X end for
[Figure]
these distributions combined with the optimized perturbation obtained from Eq.
We can see thatuniform noise perturbs all the pixels similarly, and hence small amount of uniform noise does notharm the model’s performance but cannot effectively breaks poisons.
Larger uniform noise, however,has a larger effect on the model’s performance.
Bernoulli and Gaussian noise target a smaller numberof pixels but add a larger perturbation to them.
Hence, they are more effective in reducing the attacksuccess rate, but they harm the test accuracy more as they the larger perturbation may be added to themore sensitive areas.
Figures 3(b) to 3(d) shows the distribution of random noise combined with ouroptimized noise added to different pixels.
We observe that random noise is added to regions wherefriendly noise is less dominant, hence resulting in a significant perturbation to an overall greaternumber of pixels to negate poisoning attacks.
Fig. 2(c) shows that the standard deviation of the model output in a ball around every examplebecomes considerably smaller after adding each component of our defense.
This clearly demonstratesthe effect of our defense and explains its effectiveness.
3.4 Adaptive attacks
Adaptive attacks can respond to a novel defense algorithm when the attacker is aware of the defense.
If the defense algorithm is known to the attacker beforehand, the attacker can generate more powerfulpoisons by taking into account the specific defense in place.
For example, Gradient Matching [10]and Sleeper Agent [34] demonstrated that by including augmented examples as well as originalexamples during poison generation in Eq.
(2), they can obtain robustness against standard dataaugmentations like crops and flips, when the augmentation technique is preempted by the attacker.
For F RIE ND S , the prohibitively large search space of random noise permutations and its pixel-wiseindependence property makes it nearly impossible for adaptive attacks to break.
That is, whilean attacker may use the knowledge of the time and optimization procedure to bypass the friendlyperturbation component of F RIE ND S , they needs to take into account a prohibitively large numberof random noise combinations to bypass the random noise component.
For example, for a fixed
Bernoulli noise, with p pixels there are 2 p combinations that an attacker should take into account toensure the poisons’ effectiveness.
For real images this becomes prohibitively expensive.
Similarly fora fixed Gaussian and uniform noise, there are an infinite number of combinations to be consideredduring the poison generation to ensure attack’s robustness.
Note that our method applies a varyingrandom noise at every iteration, which also needs to be taken into account by the attacker.
This makes
F RIE ND S robust against adaptive attacks.
[Table]
[Table]
Experiments
4.1 Implementation details
We evaluate our defense method against both triggerless data poisoning and backdoor attacks undertwo attack settings - training from scratch and transfer learning.
Following the works of [10, 11, 31],we evaluate our method primarily on CIFAR-10, ResNet-18.
We also normalize and augment trainingimages with default CIFAR-10 augmentations as used in [11].
For all models trained from scratch, weuse a learning rate starting at 0.1 and decaying by a factor of 10 at epochs 30,
[Table]
and 70.
For transferlearning, we decay learning rate at epochs 15, [Table] and 35.
When applying our method, we clamp thegenerated friendly perturbations using ζ = [Table] and add bounded random noise.
For the random noisecomponent, we set µ = 16 in our experiments.
We also normalize the image as a pre-processingstep.
We optimize friendly perturbations using SGD with momentum 0.9 and Nesterov acceleration,perform a hyperparamter search along LR = { 10 , 20 , 50 , 100 } and λ = { 1 , 10 } , and optimize eachbatch of 128 samples for 20 epochs.
Following previous works, we report poison success rate (orpoison accuracy) as the percentage of datasets poisoned at the end of training.
We run all experimentsand timings on an NVIDIA A40 GPU.
4.2 From-Scratch Setting
First, we evaluate our method on poisoning attacks targeted towards victim models trained fromscratch.
Such attack assumes a gray-box scenario, where attackers have knowledge of the victimarchitecture, but have no knowledge of the specific initialization of the victim’s model.
Similar tothe settings used in [31], which proposes a standardized benchmark for backdoor and data poisoningattacks, benchmark settings, we generate poisoning attacks by selecting 1% of training examples aspoisons, which are perturbed within the l ∞ ball of some radius ξ .
Unless otherwise specified, we setξ =
The victim model is initialized with the same architecture targeted by the attack based on a [Table] [Table]
[Table] different random trained using [Table]
Comparison and Ablation Study
We evaluate our method and baseline defenses against the Witches’ Brew, or Gradient Matching,attack [10].
It is the current state-of-the-art among data poisoning attacks when applied to thefrom-scratch setting, and is adapted to be effective against data augmentation and differential privacy[11].
We follow the settings proposed by [11], under which we generate 20 different attack datasetsfor ResNet-18 trained on CIFAR10 with a 1% budget bounded by ξ = 16 , with a slight modificationwhile [11] uses 40 epochs for training, we use 80 epochs to show that our method easily scales toreal-world training pipelines.
This is because 40 epochs of training only yields 92 .
01% test error,while 80 epochs yield 93 .
In Tab. 1, we show that we outperform state-of-the-art defenses[7, 11, 14, 25, 27].
We achieve the same 0 .
00% poison success rate with 91 .
52% test accuracy, animprovement over of 0 .
23% over state-of-the-art [11] which yields 91 .
29% test accuracy at the samepoison success rate.
Most importantly, F RIE ND S completes in 37 mins, 7 .
3 x faster than [11] whichcompletes in 4.5hrs.
We also strongly outperform other baseline defense methods simultaneously inall three metrics - poison success rate, test accuracy, and runtime.
In Tab. 3, we show that F RIE ND Salso effectively defends against MetaPoison [15], reducing the poison success rate from 45 .
% to20 . 00% with an accuracy gain from 87 .
61% to 90 .
82% resulted from applying augmentations.
We further show that our approach is effective against backdoor attacks, in particular, against the
Sleeper Agent attack [34].
Sleeper Agent is the current state-of-the-art clean-label backdoor attack,and the only such attack shown to be effective in from-scratch settings.
Following their evaluationprotocol, we generate 24 poisoned datasets with ξ = 16 , and evaluate our defense by training 24victim models respectively for 40 epochs and test poison success rate on 1000 target backdoor imagesper dataset.
We compare our method against other defenses evaluated by [34] in Tab. 2.
Here,
F RIE ND S successfully defends against [34] by reducing poison accuracy from 83 .
48% to 21 .
52%with only a small drop in test accuracy from 91 .
56% to 89 .
We outperform the next best method,
Spectral Signatures [38], by lowering poison accuracy by 14 .
18% while maintaining similar testaccuracy.
[14] achieves the lowest poison success rate at 13 .
14% , but causes a significant drop in testaccuracy to 70 . 00% , and [9] achieves 92 .
26% test accuracy but suffers from 62 .
68% poison accuracy.
We also perform an ablation on each components of F RIE ND S in Tab. 4.
We show that naivelyapplying Friendly Noise ( ζ = 32 ) yields a high poison success rate of 10% .
On the other hand,applying random noise ( µ = 32 ) yields low poison success rates but also results in a significanttest accuracy tradeoff (e.g. > 4 . 0% drop for Gaussian and Bernoulli noise).
Here, we show that [Table] applying F RIE ND S by proportionately combining friendly noise ( ζ = 16 ) with each of the randomnoise components ( µ = 16 ) maintains high test accuracy (i.e. only 2 . 0% drop) while keeping poisonsuccess rate close to 0.
4.3 Transfer learning
Next, we evaluate our method on data poisoning and backdoor attacks designed for the transferlearning scenario [2, 32].
Here, the attacks are crafted based on a pretrained network with the goal ofachieving poisoning when transfer learning is performed using the generated poisoned dataset.
Forthe transfer learning scenario used in poisoning benchmarks [11, 31], the linear layer (classifier) ofthe pretrained model is re-initialized and trained with the poisoned dataset, while other layers (featureextractor) remain fixed during the training.
Similar to the from-scratch setting, attacks are limited toa budget of 1% and ξ = 16 .
However, we generate F RIE ND S at the beginning of training insteadof after 5 training epochs, since the feature extractor is already initialized.
We note that this is notthe true transfer learning setting, since the pretraining and transfer learning datasets are the same.
However, as [10, 11] note, this presents an effective worst-case scenario to evaluate poisoning attacks.
We show that in Tab. 3 that even in such cases, we reduce poison success rate from 100% to 35% forthe Bullseye Polytope attack [2], and from 100% to 30% for the Poison Frogs attack [32].
4.4 Transferability across Architectures
We show that perturbations generated by F RIE ND S are transferable across architectures.
In Tab.
5,we show using Gradient Matching ξ = 16 that F RIE ND S optimized using smaller architectures, inparticular AlexNet [18] and LeNet [20], can be directly used for larger achitectures like ResNet18.
This presents a significant advantage in terms of computational costs, since F RIE ND S can begenerated using smaller, and hence faster, models.
Crucially, this makes the generated friendly noisefree to be directly applied to (much larger) architectures.
Conclusion
We proposed a simple and highly effective defense mechanism, F RIE ND S , that protects deep learningpipelines against various types of poisoning attacks.
Our defense is built on the key observationthat poisoning attacks exploit sharp regions of the loss to craft adversarial perturbations that whenadded to an example, can substantially alter its gradient or representations.
F RIE ND S relies on twocomponents to break the poisons: an accuracy-friendly perturbation that is generated to maximallyperturb examples without degrading the performance, and a random varying noise component.
Thefirst component takes examples farther away from the sharp loss regions, and the second componentsmooths out the loss landscape.
Both components combined together build a very light-weightbut highly effective defense against the most powerful triggerless and backdoor poisoning attacks,including Gradient Matching, Bull-eyes Polytope, Poison Frogs, and Sleeper Agent, in transferlearning or training from scratch scenarios.
F RIE ND S is impossible to break with adaptive attacksand our friendly noise can be transferred to other architecture.
This makes it almost free to apply toreal-world deep learning pipelines.
Our defense is particularly targeted towards clean-label poisoningattacks that are generated under bounded perturbations.
Such settings are the most difficult to defend,as generated poisons can easily fool even an expert observer.
In contrast, unbounded attacks can beeasily detected by manual or automated filtering mechanisms, through a single pass over the dataset.
Checklist
For all authors...
(a) Do the main claims made in the abstract and introduction accurately reflect the paper’s
contributions and scope?
[Yes]
(b) Did you describe the limitations of your work?
[Yes]
(c) Did you discuss any potential negative societal impacts of your work?
[N/A]
(d) Have you read the ethics review guidelines and ensured that your paper conforms to
them?
[Yes]
If you are including theoretical results...
(a) Did you state the full set of assumptions of all theoretical results?
[N/A]
(b) Did you include complete proofs of all theoretical results?
[N/A]
If you ran experiments...
(a) Did you include the code, data, and instructions needed to reproduce the main experi-
mental results (either in the supplemental material or as a URL)?
[Yes]
(b) Did you specify all the training details (e
g., data splits, hyperparameters, how theywere chosen)?
[Yes](c)
Did you report error bars (e
g., with respect to the random seed after running experiments multiple times)?
[Yes]
(d) Did you include the total amount of compute and the type of resources used (e.g., typeof GPUs, internal cluster, or cloud provider)?
[Yes]
If you are using existing assets (e
g., code, data, models) or curating/releasing new assets...
(a) If your work uses existing assets, did you cite the creators?
[Yes]
(b) Did you mention the license of the assets?
[N/A]
(c) Did you include any new assets either in the supplemental material or as a URL?
[Yes]
(d) Did you discuss whether and how consent was obtained from people whose data you’re
using/curating?
[N/A]
(e) Did you discuss whether the data you are using/curating contains personally identifiable
information or offensive content?
[N/A]
If you used crowdsourcing or conducted research with human subjects...
[Table]
(a) Did you include the full text of instructions given to participants and screenshots, if
[Table]
applicable?
[N/A]
[Table]
(b) Did you describe any potential participant risks, with links to Institutional Review
[Table]
Board (IRB) approvals, if applicable?
[N/A]
[Table]
(c) Did you include the estimated hourly wage paid to participants and the total amountspent on participant compensation?
[N/A]
[Table]