The unprecedented availability of training data fueled the rapid development
of powerful neural networks in recent years. However, the need for such large
amounts of data leads to potential threats such as poisoning attacks:
adversarial manipulations of the training data aimed at compromising the
learned model to achieve a given adversarial goal.
This paper investigates defenses against clean-label poisoning attacks and
proposes a novel approach to detect and filter poisoned datapoints in the
transfer learning setting. We define a new characteristic vector representation
of datapoints and show that it effectively captures the intrinsic properties of
the data distribution. Through experimental analysis, we demonstrate that
effective poisons can be successfully differentiated from clean points in the
characteristic vector space. We thoroughly evaluate our proposed approach and
compare it to existing state-of-the-art defenses using multiple architectures,
datasets, and poison budgets. Our evaluation shows that our proposal
outperforms existing approaches in defense rate and final trained model
performance across all experimental settings.

本研究探讨了对洁净标签下的中毒攻击的防御方法，并提出了一种在迁移学习环境中检测和过滤被中毒数据点的新方法，通过实验分析表明，我们的方法能够在特征向量空间中有效区分有效的中毒点和干净点，并通过多个架构、数据集和中毒预算的比较，充分评估了我们的方法，结果显示我们的方案在所有实验设置中均优于现有方法的防御率和最终训练模型性能。