Machine learning (ML) models trained on data from potentially untrusted sources are vulnerable to poisoning. A small, maliciously crafted subset of the training inputs can cause the model to learn a "backdoor" task (e.g., misclassify inputs with a certain feature) in addition to its main task. While backdoor attacks remain largely a hypothetical threat, state-of-the-art defenses require massive changes to the existing ML pipelines and are too complex for practical deployment. In this paper, we take a pragmatic view and investigate natural resistance of ML pipelines to backdoor attacks, i.e., resistance that can be achieved without changes to how models are trained. We design, implement, and evaluate Mithridates, a new method that helps practitioners answer two actionable questions: (1) how well does my model resist backdoor poisoning attacks?, and (2) how can I increase its resistance without changing the training pipeline? Mithridates leverages hyperparameter search $\unicode{x2013}$ a tool that ML developers already extensively use $\unicode{x2013}$ to balance the model's accuracy and resistance to backdoor learning, without disruptive changes to the pipeline. We show that hyperparameters found by Mithridates increase resistance to multiple types of backdoor attacks by 3-5x with only a slight impact on model accuracy. We also discuss extensions to AutoML and federated learning.

翻译：机器学习（ML）模型在基于可能不可信来源的数据进行训练时，易受投毒攻击。训练输入中一小部分经过恶意精心构造的子集，会导致模型在完成主要任务的同时，学习到一种"后门"任务（例如，对具有特定特征的输入进行错误分类）。尽管后门攻击目前主要还是一种理论威胁，但现有最先进的防御方法需要对机器学习现有流水线进行大规模修改，且过于复杂难以实际部署。在本文中，我们采取务实视角，研究机器学习流水线对后门攻击的自然抵抗能力——即无需改变模型训练方式即可实现的抵抗能力。我们设计、实现并评估了Mithridates方法，该方法帮助实践者回答两个可操作问题：（1）我的模型对后门投毒攻击的抵抗能力如何？（2）如何在不改变训练流水线的情况下提升其抵抗能力？Mithridates利用超参数搜索——这一ML开发者已广泛使用的工具——来平衡模型准确率与对后门学习的抵抗能力，且无需对流水线进行破坏性修改。我们证明，由Mithridates找到的超参数可将对多种后门攻击类型的抵抗能力提升3-5倍，而对模型准确率仅产生轻微影响。此外，我们还讨论了该方法向AutoML和联邦学习的扩展。