Rethinking Label Flipping Attack: From Sample Masking to Sample Thresholding

doi:10.1109/TPAMI.2022.3220849

	Rethinking Label Flipping Attack: From Sample Masking to Sample Thresholding
	Xu, Qianqian 1; Yang, Zhiyong 2; Zhao, Yunrui 2; Cao, Xiaochun 3; Huang, Qingming 4,5,6,7
	2023-06-01
发表期刊	IEEE TRANSACTIONS ON PATTERN ANALYSIS AND MACHINE INTELLIGENCE
ISSN	0162-8828
卷号	45 期号:6 页码:7668-7685
摘要	Nowadays, machine learning (ML) and deep learning (DL) methods have become fundamental building blocks for a wide range of AI applications. The popularity of these methods also makes them widely exposed to malicious attacks, which may cause severe security concerns. To understand the security properties of the ML/DL methods, researchers have recently started to turn their focus to adversarial attack algorithms that could successfully corrupt the model or clean data owned by the victim with imperceptible perturbations. In this paper, we study the Label Flipping Attack (LFA) problem, where the attacker expects to corrupt an ML/DL model's performance by flipping a small fraction of the labels in the training data. Prior art along this direction adopts combinatorial optimization problems, leading to limited scalability toward deep learning models. To this end, we propose a novel minimax problem which provides an efficient reformulation of the sample selection process in LFA. In the new optimization problem, the sample selection operation could be implemented with a single thresholding parameter. This leads to a novel training algorithm called Sample Thresholding. Since the objective function is differentiable and the model complexity does not depend on the sample size, we can apply Sample Thresholding to attack deep learning models. Moreover, since the victim's behavior is not predictable in a poisonous attack setting, we have to employ surrogate models to simulate the true model employed by the victim model. Seeing the problem, we provide a theoretical analysis of such a surrogate paradigm. Specifically, we show that the performance gap between the true model employed by the victim and the surrogate model is small under mild conditions. On top of this paradigm, we extend Sample Thresholding to the crowdsourced ranking task, where labels collected from the annotators are vulnerable to adversarial attacks. Finally, experimental analyses on three real-world datasets speak to the efficacy of our method.
关键词	Data models Training data Training Deep learning Predictive models Testing Optimization Label flipping attack machine learning
DOI	10.1109/TPAMI.2022.3220849
收录类别	SCI
语种	英语
资助项目	National Key R & D Program of China[2018AAA0102000] ; National Natural Science Foundation of China[U21B2038] ; National Natural Science Foundation of China[61931008] ; National Natural Science Foundation of China[62025604] ; National Natural Science Foundation of China[U1936208] ; National Natural Science Foundation of China[6212200758] ; National Natural Science Foundation of China[61976202] ; Fundamental Research Funds for the Central Universities ; Youth Innovation Promotion Association CAS ; Strategic Priority Research Program of Chinese Academy of Sciences[XDB28000000] ; China National Post-doctoral Program for Innovative Talents[BX2021298] ; China Postdoctoral Science Foundation[2022M713101]
WOS研究方向	Computer Science ; Engineering
WOS类目	Computer Science, Artificial Intelligence ; Engineering, Electrical & Electronic
WOS记录号	WOS:000982475600070
出版者	IEEE COMPUTER SOC
引用统计
文献类型	期刊论文
条目标识符	http://119.78.100.204/handle/2XEOYT63/21226
专题	中国科学院计算技术研究所期刊论文_英文
通讯作者	Huang, Qingming
作者单位	1.Chinese Acad Sci, Inst Comp Technol, Key Lab Intelligent Informat Proc, Beijing 100190, Peoples R China 2.Univ Chinese Acad Sci, Sch Comp Sci & Technol, Beijing 100049, Peoples R China 3.Sun Yat Sen Univ, Sch Cyber Sci & Technol, Shenzhen Campus, Shenzhen 518107, Peoples R China 4.Univ Chinese Acad Sci, Sch Comp Sci & Technol, Beijing 101408, Peoples R China 5.Univ Chinese Acad Sci, Key Lab Big Data Min & Knowledge Management BDKM, Beijing 101408, Peoples R China 6.Chinese Acad Sci, Inst Comp Technol, Key Lab Intelligent Informat Proc, Beijing 100190, Peoples R China 7.Peng Cheng Lab, Shenzhen 518055, Peoples R China
推荐引用方式 GB/T 7714	Xu, Qianqian,Yang, Zhiyong,Zhao, Yunrui,et al. Rethinking Label Flipping Attack: From Sample Masking to Sample Thresholding[J]. IEEE TRANSACTIONS ON PATTERN ANALYSIS AND MACHINE INTELLIGENCE,2023,45(6):7668-7685.
APA	Xu, Qianqian,Yang, Zhiyong,Zhao, Yunrui,Cao, Xiaochun,&Huang, Qingming.(2023).Rethinking Label Flipping Attack: From Sample Masking to Sample Thresholding.IEEE TRANSACTIONS ON PATTERN ANALYSIS AND MACHINE INTELLIGENCE,45(6),7668-7685.
MLA	Xu, Qianqian,et al."Rethinking Label Flipping Attack: From Sample Masking to Sample Thresholding".IEEE TRANSACTIONS ON PATTERN ANALYSIS AND MACHINE INTELLIGENCE 45.6(2023):7668-7685.