Data poisoning considers an adversary that distorts the training set of
machine learning algorithms for malicious purposes. In this work, we bring to
light one conjecture regarding the fundamentals of data poisoning, which we
call the Lethal Dose Conjecture. The conjecture states: If $n$ clean training
samples are needed for accurate predictions, then in a size-$N$ training set,
only $\Theta(N/n)$ poisoned samples can be tolerated while ensuring accuracy.
Theoretically, we verify this conjecture in multiple cases. We also offer a
more general perspective of this conjecture through distribution
discrimination. Deep Partition Aggregation (DPA) and its extension, Finite
Aggregation (FA) are recent approaches for provable defenses against data
poisoning, where they predict through the majority vote of many base models
trained from different subsets of training set using a given learner. The
conjecture implies that both DPA and FA are (asymptotically) optimal -- if we
have the most data-efficient learner, they can turn it into one of the most
robust defenses against data poisoning. This outlines a practical approach to
developing stronger defenses against poisoning via finding data-efficient
learners. Empirically, as a proof of concept, we show that by simply using
different data augmentations for base learners, we can respectively double and
triple the certified robustness of DPA on CIFAR-10 and GTSRB without
sacrificing accuracy.

此论文提出了数据污染及其危害的基本概念，阐述了所谓的致命剂量猜想，为开发更强大的数据污染防御策略提供了实用方法，并通过数据扩充来验证 DPA 的有效性。

关于数据投毒的致死剂量猜想

Lethal Dose Conjecture on Data Poisoning

Data poisoning attacks aim at manipulating model behaviors through distorting
training data. Previously, an aggregation-based certified defense, Deep
Partition Aggregation (DPA), was proposed to mitigate this threat. DPA predicts
through an aggregation of base classifiers trained on disjoint subsets of data,
thus restricting its sensitivity to dataset distortions. In this work, we
propose an improved certified defense against general poisoning attacks, namely
Finite Aggregation. In contrast to DPA, which directly splits the training set
into disjoint subsets, our method first splits the training set into smaller
disjoint subsets and then combines duplicates of them to build larger (but not
disjoint) subsets for training base classifiers. This reduces the worst-case
impacts of poison samples and thus improves certified robustness bounds. In
addition, we offer an alternative view of our method, bridging the designs of
deterministic and stochastic aggregation-based certified defenses. Empirically,
our proposed Finite Aggregation consistently improves certificates on MNIST,
CIFAR-10, and GTSRB, boosting certified fractions by up to 3.05%, 3.87% and
4.77%, respectively, while keeping the same clean accuracies as DPA's,
effectively establishing a new state of the art in (pointwise) certified
robustness against data poisoning.

我们提出了一种改进的认证防御技术，称为有限聚合，通过将训练集分成较小的互斥子集，然后将其重复组合，以构建较大的（但不相离）子集来训练基础分类器，从而提高 MNIST，CIFAR-10 和 GTSRB 上的（点对点）认证稳健性，并在保持与 DPA 相同的准确性的同时，将已认证部分提高了 3.05％，3.87％和 4.77％，有效地建立了一种新的数据中毒（点对点）认证鲁棒性的技术。

使用确定性有限聚合增强的数据毒化的认证防御

Improved Certified Defenses against Data Poisoning with (Deterministic)  Finite Aggregation

Adversarial poisoning attacks distort training data in order to corrupt the
test-time behavior of a classifier. A provable defense provides a certificate
for each test sample, which is a lower bound on the magnitude of any
adversarial distortion of the training set that can corrupt the test sample's
classification. We propose two novel provable defenses against poisoning
attacks: (i) Deep Partition Aggregation (DPA), a certified defense against a
general poisoning threat model, defined as the insertion or deletion of a
bounded number of samples to the training set -- by implication, this threat
model also includes arbitrary distortions to a bounded number of images and/or
labels; and (ii) Semi-Supervised DPA (SS-DPA), a certified defense against
label-flipping poisoning attacks. DPA is an ensemble method where base models
are trained on partitions of the training set determined by a hash function.
DPA is related to both subset aggregation, a well-studied ensemble method in
classical machine learning, as well as to randomized smoothing, a popular
provable defense against evasion attacks. Our defense against label-flipping
attacks, SS-DPA, uses a semi-supervised learning algorithm as its base
classifier model: each base classifier is trained using the entire unlabeled
training set in addition to the labels for a partition. SS-DPA significantly
outperforms the existing certified defense for label-flipping attacks on both
MNIST and CIFAR-10: provably tolerating, for at least half of test images, over
600 label flips (vs. < 200 label flips) on MNIST and over 300 label flips (vs.
175 label flips) on CIFAR-10. Against general poisoning attacks, where no prior
certified defenses exists, DPA can certify >= 50% of test images against over
500 poison image insertions on MNIST, and nine insertions on CIFAR-10. These
results establish new state-of-the-art provable defenses against poisoning
attacks.

该研究提供了两种新的有证明的防御机制，分别是 Deep Partition Aggregation (DPA) 与 Semi-Supervised DPA (SS-DPA)，针对插入或删除少量样本的威胁模型（即有害污染攻击）提供了证书，并在 MNIST 和 CIFAR-10 数据集上表现优异。