Incompatibility Clustering as a Defense Against Backdoor Poisoning Attacks

Abstract (excerpt)

We propose a novel clustering mechanism based on an incompatibility property between subsets of data that emerges during model training. This mechanism partitions the dataset into subsets that generalize only to themselves, i.e., training on one subset does not improve performance on the other subsets. Leveraging the interaction between the dataset and the training process, our clustering mechanism partitions datasets into clusters that are defined by--and therefore meaningful to--the objective of the training process. We apply our clustering mechanism to defend against data poisoning attacks,

Excerpt shown for reference under fair use — read the full paper at the publisher.

Related failures