ECLIPSE: Expunging Clean-Label Indiscriminate Poisons via Sparse Diffusion Purification

No Thumbnail Available
File version
Author(s)
Wang, Xianlong
Hu, Shengshan
Zhang, Yechao
Zhou, Ziqi
Zhang, Leo Yu
Xu, Peng
Wan, Wei
Jin, Hai
Griffith University Author(s)
Primary Supervisor
Other Supervisors
Editor(s)

Garcia-Alfaro, Joaquin

Kozik, Rafał

Choraś, Michał

Katsikas, Sokratis

Date
2024
Size
File type(s)
Location

Bydgoszcz, Poland

License
Abstract

Clean-label indiscriminate poisoning attacks add invisible perturbations to correctly labeled training images, thus dramatically reducing the generalization capability of the victim models. Recently, defense mechanisms such as adversarial training, image transformation techniques, and image purification have been proposed. However, these schemes are either susceptible to adaptive attacks, built on unrealistic assumptions, or only effective against specific poison types, limiting their universal applicability. In this research, we propose a more universally effective, practical, and robust defense scheme called ECLIPSE. We first investigate the impact of Gaussian noise on the poisons and theoretically prove that any kind of poison will be largely assimilated when imposing sufficient random noise. In light of this, we assume the victim has access to an extremely limited number of clean images (a more practical scene) and subsequently enlarge this sparse set for training a denoising probabilistic model (a universal denoising tool). We then introduce Gaussian noise to absorb the poisons and apply the model for denoising, resulting in a roughly purified dataset. Finally, to address the trade-off of the inconsistency in the assimilation sensitivity of different poisons by Gaussian noise, we propose a lightweight corruption compensation module to effectively eliminate residual poisons, providing a more universal defense approach. Extensive experiments demonstrate that our defense approach outperforms 10 state-of-the-art defenses. We also propose an adaptive attack against ECLIPSE and verify the robustness of our defense scheme. Our code is available at https://github.com/CGCL-codes/ECLIPSE.

Journal Title
Conference Title

Computer Security – ESORICS 2024: 29th European Symposium on Research in Computer Security, Bydgoszcz, Poland, September 16–20, 2024, Proceedings, Part I

Book Title
Edition
Volume

14982

Issue
Thesis Type
Degree Program
School
Publisher link
Patent number
Funder(s)
Grant identifier(s)
Rights Statement
Rights Statement
Item Access Status
Note
Access the data
Related item(s)
Subject
Persistent link to this record
Citation

Wang, X; Hu, S; Zhang, Y; Zhou, Z; Zhang, LY; Xu, P; Wan, W; Jin, H, ECLIPSE: Expunging Clean-Label Indiscriminate Poisons via Sparse Diffusion Purification, Computer Security – ESORICS 2024: 29th European Symposium on Research in Computer Security, Bydgoszcz, Poland, September 16–20, 2024, Proceedings, Part I, 2024, 14982, pp. 146-166