- Data Poisoning Attacks on Multimodal Encoders (arXiv)
Author : Ziqing Yang, Xinlei He, Zheng Li, Michael Backes, Mathias Humbert, Pascal Berrang, Yang Zhang
Abstract: Recently, emerging multimodal models that leverage both visual and verbal modalities to train powerful encoders have received increasing attention. However, learning from large unlabeled datasets exposes the model to potential poisoning attacks. With this, the attacker aims to perturb the training data of the model to induce malicious behavior within the model. In contrast to previous studies that poisoned only visual modalities, this study takes the first step to study poisoning attacks on multimodal models in both visual and verbal modalities. In particular, we will focus on answering two questions: (1) Are language modalities also vulnerable to poisoning attacks? (2) Which modalities are the most vulnerable? We propose three types of poisoning attacks against multimodal models. Extensive evaluations on different datasets and model architectures show that all three attacks can achieve significant attack performance while maintaining model utility in both visual and verbal modalities. Furthermore, addiction effects were observed to differ between different modalities. We suggest both pre- and post-training defenses to mitigate attacks. We empirically show that both defenses can significantly degrade attack performance while preserving model utility.
2. Protect against data poisoning attacks on voice authentication (arXiv)
Author : Ke Li, Cameron Baird, Dan Lin
Abstract : Speaker recognition has achieved extremely high accuracy due to advances in deep learning, and it is becoming popular as a type of biometric authentication in various scenes of daily life, especially in the ever-growing web service market. Compared to traditional passwords, “voice passwords” are much more convenient because you don’t have to remember different passwords. But new machine learning attacks are putting these voice authentication systems at risk. Without strong security guarantees, an attacker could trick Deep Her Neural Network (DNN)-based speech recognition models into accessing her web accounts of legitimate users. This paper demonstrates an easy-to-implement data poisoning attack against voice authentication systems that is difficult to catch with existing defense mechanisms. Therefore, we propose a more robust defense method called Guardian, a convolutional neural network-based discriminator. The Guardian Discriminator integrates a suite of new techniques such as bias reduction, input augmentation, and ensemble learning. Our approach can distinguish approximately 95% of compromised accounts from normal accounts. This is much more effective than existing approaches that are only 60% accurate.
