We consider availability data poisoning attacks, where an adversary aims to
degrade the overall test accuracy of a machine learning model by crafting small
perturbations to its training data. Existing poisoning strategies can achieve
the attack goal but assume the victim to employ the same learning method as
what the adversary uses to mount the attack. In this paper, we argue that this
assumption is strong, since the victim may choose any learning algorithm to
train the model as long as it can achieve some targeted performance on clean
data. Empirically, we observe a large decrease in the effectiveness of prior
poisoning attacks if the victim uses a different learning paradigm to train the
model and show marked differences in frequency-level characteristics between
perturbations generated with respect to different learners and attack methods.
To enhance the attack transferability, we propose Transferable Poisoning, which
generates high-frequency poisoning perturbations by alternately leveraging the
gradient information with two specific algorithms selected from supervised and
unsupervised contrastive learning paradigms. Through extensive experiments on
benchmark image datasets, we show that our transferable poisoning attack can
produce poisoned samples with significantly improved transferability, not only
applicable to the two learners used to devise the attack but also for learning
algorithms and even paradigms beyond.

用于训练数据的小扰动攻击机器学习模型的可用性数据中毒攻击有可能泛化到不同的学习算法和范式，并提出了可转移的中毒攻击来生成高频中毒扰动，该攻击具有显著改善的可转移性。