Commoditization and broad adoption of machine learning (ML) technologies expose users of these technologies to new security risks. Many models today are based on neural networks. Training and deploying these models for real-world applications involves complex hardware and software pipelines applied to training data from many sources. Models trained on untrusted data are vulnerable to poisoning attacks that introduce "backdoor" functionality. Compromising a fraction of the training data requires few resources from the attacker, but defending against these attacks is a challenge. Although there have been dozens of defenses proposed in the research literature, most of them are expensive to integrate or incompatible with the existing training pipelines. In this paper, we take a pragmatic, developer-centric view and show how practitioners can answer two actionable questions: (1) how robust is my model to backdoor poisoning attacks?, and (2) how can I make it more robust without changing the training pipeline? We focus on the size of the compromised subset of the training data as a universal metric. We propose an easy-to-learn primitive sub-task to estimate this metric, thus providing a baseline on backdoor poisoning. Next, we show how to leverage hyperparameter search - a tool that ML developers already extensively use - to balance the model's accuracy and robustness to poisoning, without changes to the training pipeline. We demonstrate how to use our metric to estimate the robustness of models to backdoor attacks. We then design, implement, and evaluate a multi-stage hyperparameter search method we call Mithridates that strengthens robustness by 3-5x with only a slight impact on the model's accuracy. We show that the hyperparameters found by our method increase robustness against multiple types of backdoor attacks and extend our method to AutoML and federated learning.

翻译：机器学习技术的商品化和广泛采用使这些技术的用户面临新的安全风险。如今许多模型基于神经网络。为实际应用训练和部署这些模型涉及复杂的硬件和软件流水线，这些流水线应用于来自多个来源的训练数据。在不可信数据上训练的模型容易受到引入“后门”功能的投毒攻击。攻击者只需少量资源即可破坏部分训练数据，但防御这些攻击是一项挑战。尽管研究文献中已提出了数十种防御方法，但大多数方法要么集成成本高昂，要么与现有训练流水线不兼容。本文采取务实、以开发者为中心的视角，展示从业人员如何回答两个可操作的问题：（1）我的模型对后门投毒攻击的鲁棒性如何？（2）如何在不改变训练流水线的情况下提高其鲁棒性？我们专注于训练数据中被破坏子集的大小作为通用度量。我们提出一个易于学习的原始子任务来估计此度量，从而为后门投毒提供基线。接下来，我们展示如何利用超参数搜索——机器学习开发者已广泛使用的工具——在不改变训练流水线的情况下平衡模型的准确性和对投毒的鲁棒性。我们演示如何使用我们的度量来估计模型对后门攻击的鲁棒性。然后，我们设计、实现并评估一种多阶段超参数搜索方法，称为Mithridates，该方法将鲁棒性提升3-5倍，同时仅对模型准确性产生轻微影响。我们表明，我们的方法找到的超参数能增强对多种类型后门攻击的鲁棒性，并将我们的方法扩展到自动机器学习和联邦学习。