Witches' Brew: Industrial Scale Data Poisoning via Gradient Matching

Understand

Data Poisoning attacks modify training data to maliciously control a model trained on such data.

• In this work, we focus on targeted poisoning attacks which cause a reclassification of an unmodified test image and as such breach model integrity.
• We consider a particularly malicious poisoning attack that is both "from scratch" and "clean label", meaning we analyze an attack that successfully works against new, randomly initialized models, and is nearly imperceptible to humans, all while perturbing only a small fraction of the training data.
• Previous poisoning attacks against deep neural networks in this setting have been limited in scope and success, working only in simplified settings or being prohibitively expensive for large datasets.