Pretraining Security for Deep Learning

Hi guys, today I would like to share some of my readings from yesterday about the pretraining security in deep learning. I will cover the basic methods from these three papers:

1. PoisonedEncoder: Poisoning the Unlabeled Pre-training Data in Contrastive Learning
2. Poisoning and Backdooring Contrastive Learning
3. Poisoning the Unlabeled Dataset of Semi-Supervised Learning

The first two are about how to poison contrastive learning models and the last one is about poisoning semi-supervised models. I will share the basic ideas and the things that I praise. OK, here we go :)

1. PoisonedEncoder: Poisoning the Unlabeled Pre-training Data in Contrastive Learning

The idea for poisoning contrastive learning models is easy for this paper. We want the network to misclassify some prescribed target inputs into the prescribed target classes. Recall that the contrastive learning methods aim to learn an encoder that produces similar feature vectors for two randomly cropped views of an image. Given some reference pictures from the target class, poisoning the contrastive learning encoder means we would like the encoder to map the target input into a similar embedding just like the reference ones, i.e, to maximize the similarity between the embeddings of target input and reference input. By exploiting the working nature of contrastive learning, we could concatenate the two pictures, so that the two randomly cropped views could be one from the target one, and the other from the reference one. Therefore, we can add these “artificially generated” pictures into the unlabeled training dataset to poison the pretrained contrastive learning models.

The paper adopts four ways to concatenate the pictures, and the algorithm will randomly choose one for each “synthetic picture”. This method proves to truly work in the experiment parts, and we will cover that in the second article.

2. Poisoning and Backdooring Contrastive Learning

Unlike the first paper which tends to poison the single-model contrastive learning model, this paper reaches a tougher goal: poisoning the multi-modal contrastive learning models, like CLIP. Multi-modal contrastive learning models consist of an image feature encoder, a text encoder, map the inputs to the same embedding space and maximize the similarity between the same image-text pair and minimize similarity between different image-text examples. This method, poisons the feature encoder, by constructing a caption set using the desired “wrong” target label. Since the model overfits against the training set, it’s simple to just add the “poisoned” image-caption pairs into the training set that would reach the goals. This also works for the backdoor attack. Adding the backdoor pattern trigger and the artificial caption set, the model can be easily fooled by only contaminating 0.0001% of the training examples.

3. Poisoning the Unlabeled Dataset of Semi-Supervised Learning

The last one is a little bit different from the first two, as it focuses on another problem about how to poison semi-supervised models. Semi-supervised learning is one kind of method that can both utilize the labeled training set as well as the unlabeled test set which is of the same distribution as the training set. The models need to assign pseudo labels for the unlabeled portion and use the pseudo labels for strengthening the training of the classifier. How to bridge the gap between trustworthy labeled examples with unlabeled examples during the training? Lots of methods use the technique of interpolation. This method adopts a similar smart move to poison the model. Given the target input and reference input, the algorithm constructs a linear pixel-wise blending between the reference and the target.

For each pair of target images and reference images, the algorithm would generate a series of interpolations to gradually reach the target input from the reference one.

The analysis of why this poisoning method works is extremely brilliant. Therefore I would like to repeat it here. Interested readers can refer to Section 3.1 of the paper.

This attack relies on the reason that semi-supervised machine learning is able to be so effective. Initially, only a small number of examples are labeled. During the first few epochs of training, the model begins to classify these labeled examples correctly, as the confidence on the labeled examples grows, the neural network will also begin to assign the correct label to any point nearby these examples. There are two reasons that this happens (I think the two reasons the author proposes are really convincing!): First, it turns out that neural networks are Lipchitz-continuous with a low constant. Thus if we have f(x)=y, then for small perturbations, usually we will have f(x+ϵ)=y+δ. Second, because models apply data augmentation, they are already trained on perturbed inputs x+ϵ, this reinforces the low average-case Lipschitz constant.

Therefore, any nearby unlabeled examples will now start to be classified correctly with high confidence. After the confidence assigned to these nearly unlabeled examples becomes sufficiently large, the training algorithm begins to treat these as if they were labeled examples. This will assign the target labels to the mixed poisoned data points and gradually to the target input.

OK, here are all the things I would like to share today. See you next time!

😀