Modern machine learning pipelines leverage large amounts of public data,
making it infeasible to guarantee data quality and leaving models open to
poisoning and backdoor attacks. However, provably bounding model behavior under
such attacks remains an open problem. In this work, we address this challenge
and develop the first framework providing provable guarantees on the behavior
of models trained with potentially manipulated data. In particular, our
framework certifies robustness against untargeted and targeted poisoning as
well as backdoor attacks for both input and label manipulations. Our method
leverages convex relaxations to over-approximate the set of all possible
parameter updates for a given poisoning threat model, allowing us to bound the
set of all reachable parameters for any gradient-based learning algorithm.
Given this set of parameters, we provide bounds on worst-case behavior,
including model performance and backdoor success rate. We demonstrate our
approach on multiple real-world datasets from applications including energy
consumption, medical imaging, and autonomous driving.

现代机器学习流程利用大量公开数据，导致无法保证数据质量，使得模型容易遭受中毒和后门攻击。本论文提出了一个框架，首次提供了有关使用潜在操纵数据进行训练的模型行为的可证明保证。该框架通过使用凸松弛来近似计算可能的参数更新集合，限制了任何梯度下降学习算法的所有可达参数集合，并提供模型性能和后门成功率的最坏情况行为的界限。该方法在能源消耗、医学成像和自动驾驶等应用的多个真实世界数据集上进行了演示。