Indiscriminate Poisoning Attacks Are Shortcuts

Da Yu, Huishuai Zhang, Wei Chen, Jian Yin, Tie-Yan Liu

Keywords: Data Security, Data Poisoning, Shortcuts

Abstract: Indiscriminate data poisoning attacks, which add imperceptible perturbations to training data to maximize the test error of trained models, have become a trendy topic because they are thought to be capable of preventing unauthorized use of data. In this work, we investigate why these perturbations work in principle. We find that the perturbations of advanced poisoning attacks are almost linear separable when assigned with the target labels of the corresponding samples. This is an important population property for various perturbations that were not unveiled before. Moreover, we further confirm that linear separability is indeed the workhorse for poisoning attacks. We synthesize linear separable data as perturbations and show that such synthetic perturbations are as powerful as the deliberately crafted attacks. Our finding also suggests that the shortcut learning problem is more serious than previously believed as deep learning heavily relies on shortcuts even if they are of an imperceptible scale and mixed together with the normal features. It also suggests that pre-trained feature extractors can be a powerful defense.

One-sentence Summary: We show poisoning attacks provide shortcuts to the target model by using linear separable perturbations.

Community Implementations: [ 5 code implementations](https://www.catalyzex.com/paper/arxiv:2111.00898/code)