Data poisoning and backdoor attacks manipulate training data to induce security breaches in a victim model. These attacks can be provably deflected using differentially private (DP) training methods, although this comes with a sharp decrease in model performance. The InstaHide method has recently been proposed as an alternative to DP training that leverages supposed privacy properties of the mixup augmentation, although without rigorous guarantees. In this work, we show that strong data augmentations, such as mixup and random additive noise, nullify poison attacks while enduring only a small accuracy trade-off. To explain these finding, we propose a training method, DP-InstaHide, which combines the mixup regularizer with additive noise. A rigorous analysis of DP-InstaHide shows that mixup does indeed have privacy advantages, and that training with k-way mixup provably yields at least k times stronger DP guarantees than a naive DP mechanism. Because mixup (as opposed to noise) is beneficial to model performance, DP-InstaHide provides a mechanism for achieving stronger empirical performance against poisoning attacks than other known DP methods.

通过强大的数据增强技术，如mixup和随机加性噪声，我们提出了一种新的训练方法DP-InstaHide，该方法将mixup调整器与加性噪声相结合，并且通过严密的分析表明，使用k-way mixup的训练方法，可证实至少比单纯的DP机制强出k倍，这提供了一种针对数据污染攻击的更有效的DP方法。

DP-InstaHide：使用差分隐私数据增强可证明地缓解毒化和后门攻击