DP-InstaHide：可证明地通过不同的私有数据增强来化解中毒和后门攻击
DP-InstaHide: Provably Defusing Poisoning and Backdoor Attacks with Differentially Private Data Augmentations
摘要：
数据投毒和后门攻击操纵训练数据以在受害者模型中诱发安全漏洞。这些攻击可以使用差分私有（DP）训练方法来证明，尽管这会导致模型性能急剧下降。InstaHide方法最近被提出作为DP训练的替代方案，该方法利用了混淆增强的假定隐私属性，尽管没有严格的保证。在这项工作中，我们表明，强大的数据增强，如混合和随机加性噪声，无效的毒药攻击，而持久只有一个小的准确性权衡。为了解释这些发现，我们提出了一种训练方法DP-InstaHide，它将混合正则化器与加性噪声相结合。对DP-InstaHide的严格分析表明，mixup确实具有隐私优势，并且使用k路mixup的训练可证明比朴素的DP机制产生至少k倍的DP保证。由于混淆（与噪声相对）对模型性能有益，因此DP-InstaHide提供了一种机制，用于实现比其他已知DP方法更强的对抗中毒攻击的经验性能。
英文摘要：
Data poisoning and backdoor attacks manipulate training data to induce security breaches in a victim model. These attacks can be provably deflected using differentially private (DP) training methods, although this comes with a sharp decrease in model performance. The InstaHide method has recently been proposed as an alternative to DP training that leverages supposed privacy properties of the mixup augmentation, although without rigorous guarantees. In this work, we show that strong data augmentations, such as mixup and random additive noise, nullify poison attacks while enduring only a small accuracy trade-off. To explain these finding, we propose a training method, DP-InstaHide, which combines the mixup regularizer with additive noise. A rigorous analysis of DP-InstaHide shows that mixup does indeed have privacy advantages, and that training with k-way mixup provably yields at least k times stronger DP guarantees than a naive DP mechanism. Because mixup (as opposed to noise) is beneficial to model performance, DP-InstaHide provides a mechanism for achieving stronger empirical performance against poisoning attacks than other known DP methods.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
