利用监督学习漏洞，让自监督模型更抗数据投毒。
Exploiting Supervised Poison Vulnerability to Strengthen Self-Supervised Defense
- 用监督学习的漏洞生成对抗样本，训练自监督模型。
- 在ImageNet-100上提升最低准确率16%、平均9%。
- 适合关注模型鲁棒性与防御投毒的研究者。
可用性投毒通过在图像中引入与类别相关的捷径特征，使基于污染数据训练的监督学习模型在真实数据集上失效。自监督学习（SSL）通过数据增强实现实例判别，被认为对投毒攻击具有较强防御能力。然而，我们在CIFAR-10和ImageNet-100上扩展研究多种投毒方法后发现，SSL性能常显著低于干净数据训练，远未达理想水平。为此，我们利用监督学习对投毒攻击的脆弱性，提出在监督学习上进行对抗训练（AT），以模糊投毒特征并引导自监督模型学习鲁棒特征。所提防御方法VESPR（Vulnerability Exploitation of Supervised Poisoning for Robust SSL）在七种常见可用性投毒下超越六种已有防御方法。在ImageNet-100上，其使被污染模型的最低测试准确率提升16%，平均准确率提升9%。通过分析与消融实验，揭示了VESPR学习鲁棒类别特征的机制。
原文摘要 · Abstract (English)
Availability poisons exploit supervised learning (SL) algorithms by introducing class-related shortcut features in images such that models trained on poisoned data are useless for real-world datasets. Self-supervised learning (SSL), which utilizes augmentations to learn instance discrimination, is regarded as a strong defense against poisoned data. However, by extending the study of SSL across multiple poisons on the CIFAR-10 and ImageNet-100 datasets, we demonstrate that it often performs poorly, far below that of training on clean data. Leveraging the vulnerability of SL to poison attacks, we introduce adversarial training (AT) on SL to obfuscate poison features and guide robust feature learning for SSL. Our proposed defense, designated VESPR (Vulnerability Exploitation of Supervised Poisoning for Robust SSL), surpasses the performance of six previous defenses across seven popular availability poisons. VESPR displays superior performance over all previous defenses, boosting the minimum and average ImageNet-100 test accuracies of poisoned models by 16% and 9%, respectively. Through analysis and ablation studies, we elucidate the mechanisms by which VESPR learns robust class features.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。