Framework certifies backdoor-poisoning robustness with f-divergences
Original title: A Certified Robustness Framework for Backdoor Poisoning Attacks using $f$-Divergences
It mixes subsampling with feature, label, and test noise and recovers earlier certificates as special cases.
A paper proposes a general certification framework for machine-learning systems trained on untrusted data against data and backdoor poisoning. It expresses limits on corrupted training examples, feature and label perturbations, and test-time corruptions, then randomizes inputs through subsampling plus feature, label, and test-sample noise. Certificates based on f-divergences compose arbitrary threat models and noising strategies. Experiments certify general ℓp-constrained poisoning under bagging with additive Laplace, Gaussian, and Uniform noise.
- Existing train-time smoothing defenses cover only specific threat models.
- The procedure recovers several prior certification regimes exactly.
- It is the first such certificate for general ℓp poisoning under bagging.
- Noises evaluated are Laplace, Gaussian, and Uniform.
From the original article
1 min read at arxiv.orgMachine learning systems trained on untrusted data are vulnerable to data and backdoor poisoning attacks, in which an adversary corrupts training and test samples to manipulate predictions at inference time. Randomized smoothing yields provable defenses against such attacks, but existing applications to train-time robustness are limited to specific threat models and smoothing mechanisms.
By Evan Rose · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.