论文标题
强大的数据增强可以消毒中毒和后门攻击，而无需精确折衷
Strong Data Augmentation Sanitizes Poisoning and Backdoor Attacks Without an Accuracy Tradeoff
论文作者
论文摘要
数据中毒和后门攻击通过恶意修改培训数据来操纵受害者模型。鉴于这种日益严重的威胁，最近对行业专业人员的调查显示，私营部门对数据中毒的恐惧越来越高。在面对越来越强烈的攻击时，许多以前防御中毒的防御能力要么失败，要么会大大降低表现。但是，我们发现强大的数据增强（例如混合和cutmix）可以大大降低中毒和后门攻击的威胁而无需交易绩效。我们进一步验证了这种针对自适应中毒方法的简单防御的有效性，并与包括流行的差异私人SGD（DP-SGD）防御在内的基线相比。在后门的背景下，CutMix大大减轻了攻击，同时将验证精度提高了9％。
Data poisoning and backdoor attacks manipulate victim models by maliciously modifying training data. In light of this growing threat, a recent survey of industry professionals revealed heightened fear in the private sector regarding data poisoning. Many previous defenses against poisoning either fail in the face of increasingly strong attacks, or they significantly degrade performance. However, we find that strong data augmentations, such as mixup and CutMix, can significantly diminish the threat of poisoning and backdoor attacks without trading off performance. We further verify the effectiveness of this simple defense against adaptive poisoning methods, and we compare to baselines including the popular differentially private SGD (DP-SGD) defense. In the context of backdoors, CutMix greatly mitigates the attack while simultaneously increasing validation accuracy by 9%.
