Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Preventing Unauthorized Use of Proprietary Data: Poisoning for Secure Dataset Release

Liam Fowl, Ping-yeh Chiang, Micah Goldblum, Jonas Geiping, Arpit Bansal, Wojtek Czaja, Tom Goldstein

TL;DR

This work tackles the problem of proprietary data being publicly released in a way that enables competitors to replicate model performance. It proposes an indiscriminate data-poisoning method that minimally perturbs released data under an $\ell_\infty$ bound $\epsilon$ and optimizes a gradient-alignment objective using a reverse cross-entropy loss, solved via projected gradient descent. Empirical results on ImageNet, CIFAR-10, and facial-recognition benchmarks show substantial degradation in validation and identification/verification performance, including in black-box settings, and demonstrate online applicability for real-time data release. The study also analyzes robustness to defenses and regularization, and demonstrates that the poisoning remains effective under several training modifications, suggesting practical potential for protecting proprietary datasets in adversarial environments.

Abstract

Large organizations such as social media companies continually release data, for example user images. At the same time, these organizations leverage their massive corpora of released data to train proprietary models that give them an edge over their competitors. These two behaviors can be in conflict as an organization wants to prevent competitors from using their own data to replicate the performance of their proprietary models. We solve this problem by developing a data poisoning method by which publicly released data can be minimally modified to prevent others from train-ing models on it. Moreover, our method can be used in an online fashion so that companies can protect their data in real time as they release it.We demonstrate the success of our approach onImageNet classification and on facial recognition.

Preventing Unauthorized Use of Proprietary Data: Poisoning for Secure Dataset Release

TL;DR

This work tackles the problem of proprietary data being publicly released in a way that enables competitors to replicate model performance. It proposes an indiscriminate data-poisoning method that minimally perturbs released data under an bound and optimizes a gradient-alignment objective using a reverse cross-entropy loss, solved via projected gradient descent. Empirical results on ImageNet, CIFAR-10, and facial-recognition benchmarks show substantial degradation in validation and identification/verification performance, including in black-box settings, and demonstrate online applicability for real-time data release. The study also analyzes robustness to defenses and regularization, and demonstrates that the poisoning remains effective under several training modifications, suggesting practical potential for protecting proprietary datasets in adversarial environments.

Abstract

Large organizations such as social media companies continually release data, for example user images. At the same time, these organizations leverage their massive corpora of released data to train proprietary models that give them an edge over their competitors. These two behaviors can be in conflict as an organization wants to prevent competitors from using their own data to replicate the performance of their proprietary models. We solve this problem by developing a data poisoning method by which publicly released data can be minimally modified to prevent others from train-ing models on it. Moreover, our method can be used in an online fashion so that companies can protect their data in real time as they release it.We demonstrate the success of our approach onImageNet classification and on facial recognition.

Paper Structure

This paper contains 22 sections, 1 theorem, 13 equations, 3 figures, 9 tables, 1 algorithm.

Table of Contents

  1. Introduction
  2. Related Work
  3. Our Method
  4. Problem Setup
  5. Crafting Perturbations
  6. Experimental Results
  7. Setup
  8. ImageNet
  9. Baseline Comparison
  10. Results in the Black-box Setting
  11. Stability
  12. Facial Recognition
  13. Setup
  14. Results
  15. Online Modification
  16. ...and 7 more sections

Key Result

Proposition 1

Fix a pixel position denoted by $*$. If $\exists \varepsilon > 0$ so that $\forall x_j \in \mathcal{S}$, in the $\ell_\infty$-ball about $x_j$ of radius $\varepsilon$, the following inequality holds: i.e. - The derivative w.r.t. $\Delta_j^*$ of the norm of the full crafting gradient is bounded in magnitude by the derivative w.r.t $\Delta_j^*$ of the inner product between the individual crafting g

Figures (3)

  • Figure 1: Randomly selected example perturbations to ImageNet datapoint (class "schooner"). Left: unaltered base image. Middle: $\varepsilon = 8/255$ perturbation. Right: $\varepsilon=16/255$ perturbation.
  • Figure 2: Samples of poisoned CelebA images. Top: unaltered images. Middle: $\varepsilon = 8/255$. Bottom: $\varepsilon=16/255$.
  • Figure 3: Example CIFAR-10 Image crafted with different regularizers. From left to right: clean image, no regularizer, $\ell_2$ regularization, SSIM regularization, TV regularization. All crafted with perturbation bound $\varepsilon = 8/255$.

Theorems & Definitions (3)

  • Proposition 1
  • proof
  • proof