论文标题
数据中毒攻击针对持续学习的脆弱性
Data Poisoning Attack Aiming the Vulnerability of Continual Learning
论文作者
论文摘要
通常，基于正则化的连续学习模型限制了对先前任务数据的访问，以模仿与内存和隐私相关的现实限制。但是，这在这些模型中引入了问题，无法跟踪每个任务的性能。本质上，当前的持续学习方法容易受到先前任务的攻击。我们通过提出一个简单的特定任务数据中毒攻击来证明基于正则化的持续学习方法的脆弱性，该攻击可用于新任务的学习过程。拟议攻击产生的训练数据会导致攻击者针对的特定任务的性能退化。我们尝试对两种代表性正规化的持续学习方法的攻击，即弹性重量巩固（EWC）和突触智能（SI），该方法对MNIST数据集的变体进行了训练。该实验结果证明了本文提出的脆弱性合理，并证明了开发对对抗性攻击稳健的持续学习模型的重要性。
Generally, regularization-based continual learning models limit access to the previous task data to imitate the real-world constraints related to memory and privacy. However, this introduces a problem in these models by not being able to track the performance on each task. In essence, current continual learning methods are susceptible to attacks on previous tasks. We demonstrate the vulnerability of regularization-based continual learning methods by presenting a simple task-specific data poisoning attack that can be used in the learning process of a new task. Training data generated by the proposed attack causes performance degradation on a specific task targeted by the attacker. We experiment with the attack on the two representative regularization-based continual learning methods, Elastic Weight Consolidation (EWC) and Synaptic Intelligence (SI), trained with variants of MNIST dataset. The experiment results justify the vulnerability proposed in this paper and demonstrate the importance of developing continual learning models that are robust to adversarial attacks.
