找出最难被攻击的样本，让数据投毒攻击评估更真实。
Are Targeted Data Poisoning Attacks as Effective as We Think?
- 用干净模型训练动态识别易/难攻破样本
- 在真实数据集上验证了攻击成功率差异显著
- 适合安全研究者和防御系统设计者参考
目标性数据投毒攻击通过向训练集中注入恶意样本，操纵模型对特定测试样本的预测结果。然而，现有评估方法仅报告随机选取目标的平均攻击成功率，掩盖了最坏情况下的真实效果。本文认为，应聚焦最难被攻击的样本进行评估。这一思路同样适用于防御：由于目标攻击在分布层面无痕迹，防御者应主动识别最脆弱样本并实施针对性防护。本文基于仅有的干净模型信息，提出方法以识别测试数据集中最易与最难被投毒的样本。具体地，采用干净训练过程的粗粒度评估，结合投毒距离与预算的细粒度分类。实验表明，这些指标能可靠区分样本的投毒脆弱性，支持严格的最坏情况评估与主动的漏洞感知防御。
原文摘要 · Abstract (English)
Targeted data poisoning attacks manipulate model predictions on specific test samples by injecting malicious data into training. Yet existing evaluations report average attack success rates over randomly selected targets, obscuring true worst-case effectiveness. We argue that the right evaluation focuses on the hardest samples to poison. The same reasoning applies to defense: since targeted attacks leave no footprint at the distribution level, defenders should proactively identify the most vulnerable samples and apply targeted countermeasures. Given a test dataset, this paper identifies both the easiest and hardest to poison examples based on only clean model information. Specifically, we offer coarse evaluations using clean training dynamics, and fine-grained classification on poison class using poison distances and budgets. Our experiments show these metrics reliably stratify samples by poisoning vulnerability, enabling both rigorous worst-case evaluation and proactive vulnerability-aware defense.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。