Skip to content

aks2203/poisoning-benchmark

Repository files navigation

Just How Toxic is Data Poisoning? A Unified Benchmark for Backdoor and Data Poisoning Attacks

Updated to include new benchmarks on TinyImageNet dataset (November 2020)

This repository is the official implementation of Just How Toxic is Data Poisoning? A Unified Benchmark for Backdoor and Data Poisoning Attacks.

CIFAR-10

Transfer Learning
Attack White-box (%) Black-box (%)
Feature Collision 22.0 7.0
Convex Polytope 33.0 7.0
Bullseye Polytope 85.0 8.5
Clean Label Backdoor 5.0 6.5
Hidden Trigger Backdoor 10.0 9.5
From Scratch Training
Attack ResNet-18 (%) MobileNetV2 (%) VGG11 (%) Average (%)
Feature Collision 0 1 3 1.33
Convex Polytope 0 1 1 0.67
Bullseye Polytope 3 3 1 2.33
Witches' Brew 45 25 8 26.00
Clean Label Backdoor 0 1 2 1.00
Hidden Trigger Backdoor 0 4 1 2.67

TinyImageNet

Transfer Learning
Attack White-box (%) Black-box (%)
Feature Collision 49.0 32.0
Convex Polytope 14.0 1.0
Bullseye Polytope 100.0 10.5
Clean Label Backdoor 3.0 1.0
Hidden Trigger Backdoor 3.0 0.5
From Scratch Training
Attack VGG11 (%)
Feature Collision 4
Convex Polytope 0
Bullseye Polytope 44
Witches' Brew 32
Clean Label Backdoor 0
Hidden Trigger Backdoor 0
For more information on each attack consult our paper and the original sources listed there.

Getting Started:

Requirements

To install requirements:

pip install -r requirements.txt

Then download the TinyImageNet Dataset. (Additionally available on our drive). In learning_module.py, change the line

TINYIMAGENET_ROOT = "/fs/cml-datasets/tiny_imagenet"

accordingly, to point to the unzipped TinyImageNet directory. (It is left in this repo to match our filesystem, and will likely not work with yours.)

Pre-trained Models

Pre-trained checkpoints used in this benchmark can be downloaded from here. They should be copied into the pretrained_models folder (which is empty until downloaded models are added).


Testing

To test a model, run:

python test_model.py --model <model> --model_path <path_to_model_file> 

See the code for additional optional arguments.

Crafting Poisons With Our Setups

See How To for full details and sample code.

Evaluating A Single Batch of Poison Examples

We have left one sample folder of poisons in poison_examples.

python poison_test.py --model <model> --model_path <model_path> --poisons_path <path_to_poisons_dir>

This allows users to test their poisons in a variety of settings, not only the benchmark setups. See the file poison_test.py for a comprehensive list of arguments.

Benchmarking A Backdoor or Triggerless Attack

To compute benchmark scores, craft 100 batches of poisons using the setup pickles (for transfer learning: poison_setups_transfer_learning.pickle, for from-scratch training: poison_setups_from_scratch.pickle), and run the following.

Important Note: In order to be on the leaderboard, new submissions must host their poisoned datasets online for public access, so results can be corroborated without producing new poisons. Consider a Dropbox or GoogleDrive folder with all 100 batches of poisons.

For one trial of transfer learning poisons:

python benchmark_test.py --poisons_path <path_to_poison_directory>  --dataset <dataset>

For one trial of from-scratch training poisons:

python benchmark_test.py --poisons_path <path_to_poison_directory> --dataset <dataset> --from_scratch

To benchmark 100 batches of poisons, run

bash benchmark_all.sh <path_to_directory_with_100_batches> 

or

bash benchmark_all.sh <path_to_directory_with_100_batches> from_scratch

About

A unified benchmark problem for data poisoning attacks

Resources

License

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published

Contributors 4

  •  
  •  
  •  
  •