BadGD: A unified data-centric framework to identify gradient descent vulnerabilities

TL;DR

BadGD presents a unified theoretical framework to reveal gradient descent vulnerabilities via backdoor data poisoning. It defines three backdoor constructs—Max RiskWarp Trigger, Max GradWarp Trigger, and Max GradDistWarp Trigger—to distort empirical risk, deterministic gradients, and stochastic gradients, respectively, and links these effects to Gaussian differential privacy and privacy auditing. The authors derive constructive triggers in the square-loss setting for supervised learning, showing how triggering points can magnify training distortions and even inflate the required privacy budget in DP-SGD-like procedures. The work highlights serious data-centric threats to ML systems and motivates the development of robust defenses to preserve model integrity and privacy guarantees.

Abstract

We present BadGD, a unified theoretical framework that exposes the vulnerabilities of gradient descent algorithms through strategic backdoor attacks. Backdoor attacks involve embedding malicious triggers into a training dataset to disrupt the model's learning process. Our framework introduces three novel constructs: Max RiskWarp Trigger, Max GradWarp Trigger, and Max GradDistWarp Trigger, each designed to exploit specific aspects of gradient descent by distorting empirical risk, deterministic gradients, and stochastic gradients respectively. We rigorously define clean and backdoored datasets and provide mathematical formulations for assessing the distortions caused by these malicious backdoor triggers. By measuring the impact of these triggers on the model training procedure, our framework bridges existing empirical findings with theoretical insights, demonstrating how a malicious party can exploit gradient descent hyperparameters to maximize attack effectiveness. In particular, we show that these exploitations can significantly alter the loss landscape and gradient calculations, leading to compromised model integrity and performance. This research underscores the severe threats posed by such data-centric attacks and highlights the urgent need for robust defenses in machine learning. BadGD sets a new standard for understanding and mitigating adversarial manipulations, ensuring the reliability and security of AI systems.

Figures (1)

• Figure 1: BadGD attack model: the malicious user crafts a backdoor trigger and adds into clean dataset to construct a bad dataset. The aim of the malicious user is to maximize the distortion of attack objectives. Section \ref{['sec:BadGD_attack_model']} devotes to use bad dataset to distort empirical risk and both deterministic and stochastic gradients. Section \ref{['sec:attack_supervised_learning']} applies the BadGD attack model to identify the vulnerabilities of gradient descent when training supervised learning models with square loss.

Theorems & Definitions (12)

• proof
• proof
• proof
• proof
• proof
• proof
• proof
• proof
• proof
• proof