ECLIPSE: Expunging Clean-label Indiscriminate Poisons via Sparse Diffusion Purification

TL;DR

This research investigates the impact of Gaussian noise on the poisons and theoretically proves that any kind of poison will be largely assimilated when imposing sufficient random noise, and proposes a lightweight corruption compensation module to effectively eliminate residual poisons, providing a more universal defense approach.

Abstract

Clean-label indiscriminate poisoning attacks add invisible perturbations to correctly labeled training images, thus dramatically reducing the generalization capability of the victim models. Recently, some defense mechanisms have been proposed such as adversarial training, image transformation techniques, and image purification. However, these schemes are either susceptible to adaptive attacks, built on unrealistic assumptions, or only effective against specific poison types, limiting their universal applicability. In this research, we propose a more universally effective, practical, and robust defense scheme called ECLIPSE. We first investigate the impact of Gaussian noise on the poisons and theoretically prove that any kind of poison will be largely assimilated when imposing sufficient random noise. In light of this, we assume the victim has access to an extremely limited number of clean images (a more practical scene) and subsequently enlarge this sparse set for training a denoising probabilistic model (a universal denoising tool). We then begin by introducing Gaussian noise to absorb the poisons and then apply the model for denoising, resulting in a roughly purified dataset. Finally, to address the trade-off of the inconsistency in the assimilation sensitivity of different poisons by Gaussian noise, we propose a lightweight corruption compensation module to effectively eliminate residual poisons, providing a more universal defense approach. Extensive experiments demonstrate that our defense approach outperforms 10 state-of-the-art defenses. We also propose an adaptive attack against ECLIPSE and verify the robustness of our defense scheme. Our code is available at https://github.com/CGCL-codes/ECLIPSE.

Figures (6)

• Figure 1: We present eight popular clean-label indiscriminate poisoning attacks along with clean samples. The upward and downward arrows represent high-frequency and low-frequency poison perturbations, respectively. It can be observed that it is difficult for the naked eyes to distinguish between clean samples and poisoned samples.
• Figure 2: (a) We present eight types of poison perturbations and add Gaussian noise that is subject to normal distribution $\mathcal{N}(0, 0.01^2)$ from one to fifty rounds gradually. We observe that the assimilation of Gaussian noise to low-frequency perturbations is slow, while the assimilation to high-frequency perturbations is faster; (b) The high-level overview of our proposed defense scheme ECLIPSE.
• Figure 3: The defense performance of ECLIPSE using diverse data augmentation techniques and our scheme against three CLBPAs, SEP chen2022self, AR sandoval2022autoregressive, and LSP syn using ResNet18 on the CIFAR-10 dataset
• Figure 4: Visual presentations of five types of CLBPAs, including clean, poisoned, noised, and purified images.
• Figure 5: The test accuracy (%) results of ECLIPSE on three poisoned CIFAR-10 dataset using ResNet18 with varying hyper-parameters.