Leveraging Imperfect Restoration for Data Availability Attack

Like CUDA, most DAA papers define an “attacker” that applies a DAA on a labeled dataset that they want to protect yet publish. The attacker assumes no knowledge of any downstream DNN training process. It is therefore crucial to demonstrate that DAAs are effective across multiple training methods, including SL, SSL, and AT. The attacker generates class-based perturbations to their image set in order to inject poison features. The attacker publishes their poisoned images, optionally with captions or labels. Model trainers collect these poisoned images into datasets and may further alter or label the images.

For clarity, we define a set of notations. $f$ represents a Convolution Neural Network (CNN), including its training loss function but excluding the first layer convolution 2D filter $W\in\mathbb{R}^{d_{1}\times d_{2}}$. $X\in\mathbb{R}^{m_{1}\times m_{2}}$ denotes an input image and $X_{c}$ represents an image belonging to class $c\in[1,...,\mathbb{C}]$, where $\mathbb{C}$ is total number of the classes. Given that cross-correlation is predominantly used in place of convolutions in practice, the first layer operation is denoted as $X\star W$, where $\star$ signifies cross-correlation. Note that $W$ is a part of the CNN and $f(X\star W)$ is the loss value of $X$. To retain readability, we focus on gradient analysis of the first layer filter, $W$. CUDA employs class-specific convolutional filters for data poisoning, and we provide a brief overview of its operation. Let $R_{c}\in\mathbb{R}^{\kappa\times\kappa}$ be a CUDA filter for class $c$ images. According to [27], the generation procedure for $R_{c}$ involves setting one random parameter among the $\kappa^{2}$ parameters to 1 within each $R_{c}$. Concurrently, the remaining parameters are initialized randomly, drawn from a uniform distribution with support $[0,p_{u}]$. An image $X_{c}$ belonging to class $c$ is poisoned by cross-correlation with the corresponding CUDA filter $R_{c}$, denoted as $X_{c}\star R_{c}$.

To understand how CUDA lowers the accuracy of clean data, we analyze the gradient of $f$ for both clean and CUDA-poisoned data. Without loss of generality, the training set consists of $\mathbb{C}$ clean images, each belonging to a different class, with corresponding poisoned images denoted as $X_{i}\star R_{i}$, $i\in[1,...,\mathbb{C}]$. The gradient of the clean training data is

where $u_{i}$ is an intermediate variable equal to $X_{i}\star W$. The gradient of the poisoned training data is

where the subscript $p$ indicates that the intermediate variable is from poisoned data. Using these gradients to update $W$, we obtain

where $\lambda$ is learning rate. Inputting all clean training images, $X_{1},\cdots,X_{C}$ to $f(\cdot\star W_{t+1})$ and $f(\cdot\star W_{p,t+1})$, we obtain clean and poison loss values $\sum_{i=1}^{\mathbb{C}}f\left(X_{i}\star W_{t+1}\right)$ and $\sum_{i=1}^{\mathbb{C}}f\left(X_{i}\star W_{p,t+1}\right)$, respectively. Given that $\sum_{i=1}^{\mathbb{C}}X_{i}\star\frac{\partial f(o_{i})}{\partial i}$ in Eq. 1 is the optimal gradient descent direction for the clean data, any deviation from this direction will result in increased loss when $\lambda$ is small. Thus, $\sum_{i=1}^{\mathbb{C}}f\left(X_{i}\star W_{p,t+1}\right)>\sum_{i=1}^{\mathbb{C}}f\left(X_{i}\star W_{t+1}\right)$ for clean data. In other words, CUDA employs a non-optimal gradient to disrupt training, rendering clean data unrecognizable.

Though the previous subsection uncovers how CUDA filters increase training loss, it does not indicate how these filters poison the network. To further investigate its mechanism, we input $X_{c}\star R_{c}$ to $f(\cdot\star W_{p,t+1})$, whose first layer output is

Assuming $W_{t}$ is not poisoned by CUDA filters, we ignore the term $(X_{c}\star R_{c})\star W_{t}$. Since cross-correlation is equivalent to a rotated convolution (i.e., $X_{c}\star R_{c}=X_{c}\ast R_{c\pi}$, where $\ast$ represents convolution and $R_{c\pi}$ represents rotating the 2D filter $R_{c}$ by $\pi$), the second term of Eq. 4 can be rewritten as

Eq. 5 shows that the output of the first layer is influenced by $R_{c\pi}*R_{i}$. Since $R_{c\pi}*R_{i}=R_{c\pi}\star R_{i\pi}$, we analyze $R_{c\pi}\star R_{i\pi}$. Theorem 1 describes the statistical probabilities of $R_{c\pi}\star R_{i\pi}$ and $R_{c\pi}\star R_{c\pi}$. The proof is provided in Appendix 0.A.1.

Figure 3 presents two CUDA filters along with the corresponding $R_{c\pi}\star R_{c\pi}$ and $R_{c\pi}\star R_{i\pi}$ to illustrate these statistical properties. In practice, CUDA utilizes $p_{u}=0.06$ and $\kappa=9$ for ImageNet, which fulfills $1>(\kappa^{2}-2)p_{u}^{2}+2p_{u}$. Similar properties also apply on CIFAR-10 (see Appendix 0.A.3). These properties indicate that $R_{c\pi}*R_{c}$ in Eq. 5 retains more information in $X_{c\pi}*\frac{\partial f(u_{p,c})}{\partial u_{p,c}}$ but $R_{c\pi}*R_{i}$ shifts the information in $X_{i\pi}*\frac{\partial f(u_{p,i})}{\partial u_{p,i}}$ to a different position with a probability of $(\kappa^{2}-1)/\kappa^{2}$. For $\kappa=9$, the probability is $0.988$. Consequently, the upper layers receive class $c$ information in the correct position, but information from other classes is shifted to incorrect positions. For $p_{u}=0.06$, we note the peak value of $R_{c\pi}\star R_{i\pi}$ is smaller than the sum of its non-peak values (estimated mean ratio of 0.099). This means that non-peak values also play an important role in degrading other class information. This blurring effect also affect the $c$-class, though to a lesser extent. More clearly, the estimated mean ratio of the peak value of $R_{c\pi}\star R_{c\pi}$ over the sum of its non-peak values is 0.106. Combining these two effects, CUDA filters utilize peak shifts and unique blur patterns to introduce class-wise bias in the poisoned class.

The previous analysis shows that CUDA filters create class-wise bias, and that $R_{c\pi}\star R_{c\pi}$ retains the training information of class $c$. When $X_{c}\star R_{c}$ is closer to $X_{c}$, it is expected to preserve the class $c$ information better and enhance the image quality. However, if $X_{c}\star R_{c}=X_{c}$, then there is no poisoning effect. Thus, we propose the Imperfect Restoration Poison (IRP). Let $X_{ci}$ be one of the class $c$ images, where $i\in{1,\cdots,n}$. IRP first applies CUDA filter $R_{c}$ on all class $c$ training images and obtains $X_{ci}\star R_{c}$. Then, the filtered images are cropped into patches with the size same as the CUDA filter i.e., $\kappa\times\kappa$, denoted as $(X_{ci}\star R_{c})_{j}$. The pixel value of $X_{ci}$ corresponding to the center of the patch is denoted $y_{cij}$, and the patch is reshaped into a column vector denoted as $\eta_{cij}$. Finally, a class-wise linear model $\alpha_{c}\in\mathbb{R}^{\kappa^{2}\times 1}$ and the mean square loss are used to estimate the value of $y_{cij}$. More precisely, the class-wise model $\widehat{\alpha_{c}}$ is obtained by minimizing

Once $\widehat{\alpha_{c}}$ is obtained, it is reshaped back to a $\kappa\times\kappa$ filter, denoted as $A_{c}$. Finally, IRP uses $X_{ci}\star P_{c}$ to perform poisoning, where $P_{c}=R_{c}\star A_{c}$. Theorem 0.A.2 establishes that IRP is incapable of achieving perfect restoration (proof in Appendix 0.A.2).

Fig. 4 shows two IRP filters with the corresponding self-correlation and cross-correlation. Similar to CUDA, we observe that $P_{c\pi}\star P_{c\pi}$ exhibits a peak at the center, while $P_{c\pi}\star P_{i\pi}$ has a peak in a different position. However, they have more complex patterns around the peaks. Therefore, like CUDA, IRP exploits peak shifts to create class-wise bias. However, IRP filters have turbulent patterns around the peaks, creating unique high-frequency attack patterns that are more complex than the low-frequency patterns from CUDA. Due to their dependence on the training data, it would be challenging to theoretically analyze IRP filters, as was done for CUDA, without proper assumptions on the data distribution. We refrain from imposing unrealistic assumptions on the data distribution (e.g., Gaussian) as this could lead to misleading analytic results.

Fig. 5 displays some images generated by IRP and CUDA. IRP images are visually clearer and maintain higher quality. Notably, the man’s face is sharper and the spots of the salamander and stingray are easily distinguishable under IRP protection. The backgrounds of all three images are sharper under IRP.

Datasets: We examine poisoning on CIFAR-10 [23], CIFAR-100 [23], STL-10 [7], and ImageNet-100, a subset of ImageNet [8] consisting of 100 classes. By default, we use 50,000 images for training and 10,000 images for testing on CIFAR-10 and CIFAR-100. For STL-10, we use their default 5000 training images and 8000 test images for training and testing, respectively. For ImageNet-100, we train on the images from the first 100 classes of the official training set and test on all corresponding images from the official validation set.

Models: Unless stated otherwise, we employ ResNet-18 [18] as the surrogate for model-reliant methods and as the target models for all the testing methods in both SL and SSL scenarios. Various SSL algorithms are employed, including SimCLR [4], SimSiam[5], MoCoV3[6] and BYOL[16]. Linear probing accuracy, consistent with CP [17], is utilized to evaluate the effectiveness of DAAs in SSL. To assess transferability, we evaluate IRP on target models with various architectures, including ResNet-18, ResNet-34 [18], VGG-19 [32], DenseNet-121 [19], MobileNet-V2 [28], and ViT [11]. Training details are deferred to Appendix 0.B.1.

Effectiveness on SL and SSL: We first evaluate IRP and the other DAAs on standard SL and SSL training scenarios on CIFAR-10 and ImageNet-100. SimCLR is utilized for model pretraining in the SSL evaluation. Columns 2-3 of Tables 1 and 2 show that IRP achieves state-of-the-art poisoning, enforcing the lowest clean test accuracies in both SL and SSL and for both CIFAR-10 and ImageNet-100.

We begin by analyzing results for CIFAR-10 in Table 1. For SL with CIFAR-10, AR and IRP demonstrate a similar level of poisoning effect under SL, reducing the test accuracy to around 10%. However, AR underperforms on SSL, permitting a significantly higher accuracy of 86.86% compared to that of IRP at 43.24%. CUDA is the second-best DAA for SSL with an accuracy of 66.58%, which is still drastically higher than that of IRP.

For ImageNet-100 results in Table 2, we begin by nothing the drop in effectiveness of OPS relative to CIFAR-10. This is attributed to the RandomResizeCrop augmentation utilized for training models on ImageNet-100. We chose to use this augmentation on ImageNet-100 as it is commonly used for SL and SSL on ImageNet-100 in literature and it enhances the effectiveness of all the defense methods. For SL with ImageNet-100, CUDA, EM, AP, and LSP demonstrate strong poisoning capabilities, reducing the clean test accuracy to below 10%. Even so, IRP outperforms all others with a test accuracy of 1.98%. For SSL with ImageNet-100, the test accuracies of most DAAs remain high, except for CUDA at 21.89% and CP at 18.76%. IRP outperforms both CUDA and CP, achieving a clean test accuracy of 9.30%. These results establish IRP as the most effective DAA under both SL and SSL scenarios.

DAA results on CIFAR-10 in Table 1 vary across defenses. For instance, OPS shows high effectiveness on AT but is susceptible to ISS and CutMix, while AP performs well against CutMix and Cutout but is less effective against AT and ISS. Only CUDA and IRP demonstrate effectiveness across all countermeasures. However, CUDA permits maximum clean accuracies of 48.58% across all countermeasures and 66.58% across all testing cases, which are 16.37% and 23.24% higher, respectively, than the 43.24% maximum accuracy allowed by IRP.

Similarly, CUDA and IRP emerge as the two most effective methods across all defenses on ImageNet-100 in Table 2. However, CUDA permits a maximum clean accuracy of 36.34%, significantly higher than that of IRP at 22.10%. The results demonstrate that IRP is the most effective DAA in all testing scenarios.

Different Poison Percentages: In this section, we first evaluate IRP on a more challenging and realistic learning scenario, where only a portion of the data is shielded by IRP. We randomly select a portion of the training data from the entire training dataset of CIFAR-10 and apply IRP to the selected subset. The poisoned data is denoted as $D_{p}$ and the clean data in the training dataset that has not been used for generating poison data is denoted as $D_{c}$. Then, we conduct standard supervised training with ResNet-18 on the mixed data ($D_{p+c}$) consisting of the $D_{p}$ and $D_{c}$, as well as on the clean data subset $D_{c}$. The results in Table 4 show that the effectiveness drops quickly when the data are not 100% poisoned. This phenomenon applies for all other DAAs as well. Models trained only on $D_{c}$ demonstrate a similar level of performance as the models trained with $D_{p+c}$. This suggests that the high performance for <100% poisoning is not due to a failure of the DAAs. Finally, works on DAAs for artwork protection [30, 31] have noted similar trends but find that individuals can still protect their own data via DAA even if the majority of artworks are unprotected. That is, it’s still possible to make subsets of the training data unlearnable.

We compare the quality of ImageNet-100 images poisoned by IRP and CUDA. We quantify image quality with three common full-reference quality indices, including LPIPS [45], SSIM [37], and MS-SSIM [38], and two no-reference quality indices, including CLIP-IQA [35] and BRISQUE [25]. The original image is used as the reference for LPIPS, SSIM, and MS-SSIM. Table 6 presents the evaluation results of all quality indices. Both Table 6 and Fig. 5 demonstrate that IRP generates poisoned images with better image quality than CUDA.

The IRP filter $P_{c}=R_{c}\star A_{c}$ is a kernel with a larger size of $(2\kappa+1)\times(2\kappa+1)$, where $R_{c}$ and $A_{c}$ are both filters of size $\kappa\times\kappa$. To verify that the high effectiveness of IRP is not caused by the bigger kernel size, we generate filters of the same size as the IRP under two different filter settings. For ‘Random Sharpness’, we generate a random sharpness filter $A_{c1}$ of size $\kappa\times\kappa$ for each class. Within each $A_{c1}$, one random parameter out of the $\kappa\times\kappa$ parameters is set to 1, while the remaining parameters are randomly initialized from a uniform distribution with support [$-p_{s}$, 0]. After testing several values for $p_{s}$, we find that 0.01 is suitable for generating poisoned images with good visual quality. We then poison class $c$ images by $X_{c}\star R_{c}\star A_{c1}$. For ‘Double Blur’, we generate another random CUDA filter $R_{c1}$ of size $\kappa\times\kappa$ for each class, and then poison class c images by $X_{c}\star R_{c}\star R_{c1}$.

We compare the effectiveness of the two additional filter settings with CUDA and IRP on SL, SSL, and AT for ImageNet-100. The results in Fig. 6 show that Random Sharpness and Double Blur exhibit slightly better performance than CUDA in SSL. However, the effectiveness of Random Sharpness and Double Blur cannot match that of IRP. Additionally, we provide examples of images generated by Double Blur and Random Sharpness in Appendix 0.C.1. These samples highlight their inferior quality compared to those generated by IRP.