Witches' Brew: Industrial Scale Data Poisoning via Gradient Matching
  Data Poisoning attacks modify training data to maliciously control a model
trained on such data. In this work, we focus on targeted poisoning attacks
which cause a reclassification of an unmodified test image and as such breach
model integrity. We consider a particularly malicious poisoning attack that is
both "from scratch" and "clean label", meaning we analyze an attack that
successfully works against new, randomly initialized models, and is nearly
imperceptible to humans, all while perturbing only a small fraction of the
training data. Previous poisoning attacks against deep neural networks in this
setting have been limited in scope and success, working only in simplified
settings or being prohibitively expensive for large datasets. The central
mechanism of the new attack is matching the gradient direction of malicious
examples. We analyze why this works, supplement with practical considerations.
and show its threat to real-world practitioners, finding that it is the first
poisoning method to cause targeted misclassification in modern deep networks
trained from scratch on a full-sized, poisoned ImageNet dataset. Finally we
demonstrate the limitations of existing defensive strategies against such an
attack, concluding that data poisoning is a credible threat, even for
large-scale deep learning systems.
