MetaPoison: Learning to craft adversarial poisoning examples via meta-learning
We consider a new class of emph{data poisoning} attacks on neural networks, in which the attacker takes control of a model by making small perturbations to a subset of its training data. We formulate the task of finding poisons as a bi-level optimization problem, which can be solved using methods borrowed from the meta-learning community. Unlike previous poisoning strategies, the meta-poisoning can poison networks that are trained from scratch using an initialization unknown to the attacker and transfer across hyperparameters. Further we show that our attacks are more versatile: they can cause misclassification of the target image into an arbitrarily chosen class. Our results show above 50% attack success rate when poisoning just 3-10% of the training dataset.
This paper introduces a novel class of clean-label attacks of deep model training procedures (from scratch) using a meta-learning inspired approach. Pros: 1) Transferability across different training strategies is a particularly important novelty of this work, I think. 2) I find it particularly impressive that a clean-label attack is shown to work when training from scratch, which reduces the amount of knowledge about the model needed by the attacker. 3) The meta-learning formulation presented here may prove to be the starting point of many future investigations. 4) Multi-targeted attacks and third-party attacks appear to be novel contributions of this paper, but there is too little context given to judge that from the text alone. Cons: 1) The figures are not too informative. Could you please provide more examples in an appendix? 2) The writing could be much improved, especially for making the paper more accessible to a wider audience. 3) Details of the meta-learning procedure and related works are almost non-existent. While the authors provide a discussion of what*s possible and challenging for current adversarial attack methods, many details and citations are missing. This makes the many comments and explanations in the text obscure, although they may be correct and insightful. Could you please work on the writing and assume that I know nothing of the SOTA in adversarial attacks? I am willing to read the paper again. 4) There is far too little detail about experimental procedures. Please provide a detailed discussion with references to established procedure or previous works! - What are the meta-training/meta-validation and meta-testing sets? - What is a reasonable baseline you could compare against? If nothing else, please argue for that in the paper and perhaps provide an ablation of your method as a baseline. As far as I can tell, the paper may be introducing an approach with potential, but many clarifications are required. The paper is not self-contained enough to even attempt to guess how important or novel the presented results are. Hence, all I can do is judge the little I have managed to understand from the paper. While this may be enough for a workshop, I cannot at this point recommend acceptance, primarily because of the writing.
You are a member of the scientific community tasked with peer review. Review the following paper title and abstract.
### Title + Abstract
MetaPoison: Learning to craft adversarial poisoning examples via meta-learning
We consider a new class of emph{data poisoning} attacks on neural networks, in which the attacker takes control of a model by making small perturbations to a subset of its training data. We formulate the task of finding poisons as a bi-level optimization problem, which can be solved using methods borrowed from the meta-learning community. Unlike previous poisoning strategies, the meta-poisoning can poison networks that are trained from scratch using an initialization unknown to the attacker and transfer across hyperparameters. Further we show that our attacks are more versatile: they can cause misclassification of the target image into an arbitrarily chosen class. Our results show above 50% attack success rate when poisoning just 3-10% of the training dataset.
user
<think>Okay, to do a decent peer review, I should start with summarizing what the work is about. This includes novelty, contributions, clarity, and impact. I might include suggestions to issues that I find critical to the usefulness of the work. Starting with novelty, there are different types of novelty. The first aspect of novelty is scope and scale. Is the work covering a broader perspective than previous works? The second aspect is methodology. Is the proposed methodology novel compared to previous methods? Do they provide any significant advantage over previous methodologies? The third aspect is results. Are the results different compared previous work? Does this lead to any novel theories or an extension of current theories? Next is clarity, I will be reading the work in depth and analyze if any sentences can be potentially ambiguous or misleading. If any sentences are ambiguous, I will state them and give a suggestion on how to rephrase such sentence or how to make more clear to the audience. Lastly, impact is important. I will attempt to predict how such work will impact the scientific community. This might include the applications of such work and how the work might transform the way we study a certain topic. Finally, I will might only mention issues that are critical. This is to keep the review as concise and helpful as possible.</think>



This paper introduces a novel class of clean-label attacks of deep model training procedures (from scratch) using a meta-learning inspired approach. Pros: 1) Transferability across different training strategies is a particularly important novelty of this work, I think. 2) I find it particularly impressive that a clean-label attack is shown to work when training from scratch, which reduces the amount of knowledge about the model needed by the attacker. 3) The meta-learning formulation presented here may prove to be the starting point of many future investigations. 4) Multi-targeted attacks and third-party attacks appear to be novel contributions of this paper, but there is too little context given to judge that from the text alone. Cons: 1) The figures are not too informative. Could you please provide more examples in an appendix? 2) The writing could be much improved, especially for making the paper more accessible to a wider audience. 3) Details of the meta-learning procedure and related works are almost non-existent. While the authors provide a discussion of what*s possible and challenging for current adversarial attack methods, many details and citations are missing. This makes the many comments and explanations in the text obscure, although they may be correct and insightful. Could you please work on the writing and assume that I know nothing of the SOTA in adversarial attacks? I am willing to read the paper again. 4) There is far too little detail about experimental procedures. Please provide a detailed discussion with references to established procedure or previous works! - What are the meta-training/meta-validation and meta-testing sets? - What is a reasonable baseline you could compare against? If nothing else, please argue for that in the paper and perhaps provide an ablation of your method as a baseline. As far as I can tell, the paper may be introducing an approach with potential, but many clarifications are required. The paper is not self-contained enough to even attempt to guess how important or novel the presented results are. Hence, all I can do is judge the little I have managed to understand from the paper. While this may be enough for a workshop, I cannot at this point recommend acceptance, primarily because of the writing.
assistant
This paper introduces a novel class of clean-label attacks of deep model training procedures (from scratch) using a meta-learning inspired approach. Pros: 1) Transferability across different training strategies is a particularly important novelty of this work, I think. 2) I find it particularly impressive that a clean-label attack is shown to work when training from scratch, which reduces the amount of knowledge about the model needed by the attacker. 3) The meta-learning formulation presented here may prove to be the starting point of many future investigations. 4) Multi-targeted attacks and third-party attacks appear to be novel contributions of this paper, but there is too little context given to judge that from the text alone. Cons: 1) The figures are not too informative. Could you please provide more examples in an appendix? 2) The writing could be much improved, especially for making the paper more accessible to a wider audience. 3) Details of the meta-learning procedure and related works are almost non-existent. While the authors provide a discussion of what*s possible and challenging for current adversarial attack methods, many details and citations are missing. This makes the many comments and explanations in the text obscure, although they may be correct and insightful. Could you please work on the writing and assume that I know nothing of the SOTA in adversarial attacks? I am willing to read the paper again. 4) There is far too little detail about experimental procedures. Please provide a detailed discussion with references to established procedure or previous works! - What are the meta-training/meta-validation and meta-testing sets? - What is a reasonable baseline you could compare against? If nothing else, please argue for that in the paper and perhaps provide an ablation of your method as a baseline. As far as I can tell, the paper may be introducing an approach with potential, but many clarifications are required. The paper is not self-contained enough to even attempt to guess how important or novel the presented results are. Hence, all I can do is judge the little I have managed to understand from the paper. While this may be enough for a workshop, I cannot at this point recommend acceptance, primarily because of the writing.