{"id":168,"date":"2024-12-21T16:42:36","date_gmt":"2024-12-21T08:42:36","guid":{"rendered":"http:\/\/jieyekang.com\/?p=168"},"modified":"2024-12-21T17:31:09","modified_gmt":"2024-12-21T09:31:09","slug":"%e5%9f%ba%e4%ba%8emetapoison%e7%ae%97%e6%b3%95%e7%9a%84%e6%95%b0%e6%8d%ae%e6%8a%95%e6%af%92%e5%ae%9e%e6%88%98","status":"publish","type":"post","link":"http:\/\/jieyekang.com\/index.php\/2024\/12\/21\/%e5%9f%ba%e4%ba%8emetapoison%e7%ae%97%e6%b3%95%e7%9a%84%e6%95%b0%e6%8d%ae%e6%8a%95%e6%af%92%e5%ae%9e%e6%88%98\/","title":{"rendered":"\u57fa\u4e8eMetapoison\u7b97\u6cd5\u7684\u6570\u636e\u6295\u6bd2\u5b9e\u6218"},"content":{"rendered":"\n

\u7814\u7a76\u80cc\u666f<\/h1>\n\n\n\n

\u6570\u636e\u6295\u6bd2\u653b\u51fb\u53ef\u4ee5\u88ab\u5b9a\u4e49\u4e3a\u4e00\u4e2a\u53cc\u5c42\u4f18\u5316\u7684\u95ee\u9898\uff0c\u5982\u4e0b\u516c\u5f0f1<\/p>\n\n\n\n

$$L_{\\text{adv}}(D_{\\text{adv}}; \\arg \\min_{\\theta} L_{\\text{train}}(D_{\\text{clean}}\\cup D_{\\text{poison}}; {\\theta}))$$<\/p>\n\n\n\n

\u8bf4\u4eba\u8bdd\u5c31\u662f\u57fa\u4e8e\u539f\u59cb\u5e72\u51c0\u7684\u6570\u636e\u96c6$D_{claen}$\u548c\u6295\u6bd2\u6570\u636e\u96c6$D_{poison}$\uff0c\u5728\u7ed9\u5b9a\u7684\u635f\u5931\u51fd\u6570$L_{train}$\u4e0b\u8fdb\u884c\u4f18\u5316\u83b7\u5f97\u6a21\u578b\u66f4\u65b0\u540e\u7684\u53c2\u6570$\\theta$\u3002$D_{adv}$\u662f\u4e00\u4e2a\u6d4b\u8bd5\u5bf9\u6297\u6837\u672c\u96c6\u5408\uff0c$L_{adv}$\u662f\u548c\u6295\u6bd2\u76ee\u6807\u76f8\u5173\u7684\u635f\u5931\u51fd\u6570\uff0c\u653b\u51fb\u8005\u5e0c\u671b\u901a\u8fc7\u6570\u636e\u6295\u6bd2\u5728\u8bad\u7ec3\u597d\u7684\u53c2\u6570$\\theta$\u548c\u5bf9\u6297\u6837\u672c\u96c6\u5408$D_{adv}$\u4e0a\u83b7\u5f97\u7684\u635f\u5931$L_{adv}$\u6700\u5c0f\u3002<\/p>\n\n\n\n

\u4e0b\u9762\u662f\u76f8\u5173\u4f2a\u4ee3\u7801<\/p>\n\n\n\n

class Model:\n    def __init__(self):\n        # \u521d\u59cb\u5316\u6a21\u578b\n        ...\n\n    def forward(self, x):\n        # \u524d\u5411\u4f20\u64ad\n        ...\n\ndef train(model, D_clean, D_poison, optimizer):\n    # \u8bad\u7ec3\u6a21\u578b\n    data = D_clean + D_poison  # \u5408\u5e76\u5e72\u51c0\u6570\u636e\u96c6\u548c\u6295\u6bd2\u6570\u636e\u96c6\n    L_train = ...  # \u5b9a\u4e49\u8bad\u7ec3\u635f\u5931\u51fd\u6570\n    optimizer.zero_grad()  # \u6e05\u7a7a\u68af\u5ea6\n    L_train.backward()  # \u53cd\u5411\u4f20\u64ad\n    optimizer.step()  # \u66f4\u65b0\u6a21\u578b\u53c2\u6570\n    # \u4fdd\u5b58\u6a21\u578b\n    save_model(model)\n\ndef poison(model, D_adv, optimizer):\n    # \u52a0\u8f7d\u5df2\u8bad\u7ec3\u7684\u6a21\u578b\n    # D_adv \u662f\u5bf9\u6297\u6837\u672c\u96c6\u5408\n    L_adv = ...  # \u5b9a\u4e49\u4e0e\u6295\u6bd2\u76ee\u6807\u76f8\u5173\u7684\u635f\u5931\u51fd\u6570\n    optimizer.zero_grad()  # \u6e05\u7a7a\u68af\u5ea6\n    L_adv.backward()  # \u53cd\u5411\u4f20\u64ad\n    optimizer.step()  # \u66f4\u65b0\u6a21\u578b\u53c2\u6570\n    # \u4fdd\u5b58\u653b\u51fb\u540e\u7684\u6a21\u578b\n    save_model(model)\n\n# \u5047\u8bbe D_clean, D_poison, D_adv \u662f\u6570\u636e\u96c6\uff0coptimizer \u662f\u4f18\u5316\u5668\nmodel = Model()\noptimizer = torch.optim.Adam(model.parameters(), lr=0.001)\n\n# \u8bad\u7ec3\u9636\u6bb5\ntrain(model, D_clean, D_poison, optimizer)\n\n# \u6295\u6bd2\u9636\u6bb5\npoison(model, D_adv, optimizer)<\/code><\/pre>\n\n\n\n
\u4e3a\u4e86\u89e3\u51b3\u53cc\u5c42\u4f18\u5316\u95ee\u9898\uff0c\u524d\u4eba\u63d0\u51fa\u4e86\u5f88\u591a\u4f18\u5316\u7b97\u6cd5\uff0c\u5728\u6b64\u6211\u4eec\u53ea\u4ecb\u7ecd\u8fde\u7eed\u7a7a\u95f4\u6295\u6bd2\u6837\u672c\u4f18\u5316\u7684Metapoison\u7b97\u6cd5<\/p>\n\n\n\n
Metapoison\u7b97\u6cd5<\/h1>\n\n\n\n
\u5bf9\u4e8e\u516c\u5f0f1\uff0c\u6211\u4eec\u53ef\u4ee5\u5c06\u5185\u5c42\u4f18\u5316\u95ee\u9898\u4f5c\u4e3a\u7ea6\u675f\u6761\u4ef6\u5f97\u5230\u516c\u5f0f2\u3002<\/p>\n\n\n\n
$$arg \\min_{D_{poison}\\in D} L_{adv}(D_{adv};{\\theta})$$ $$\\qquad s.t. \\quad {\\theta} = \\arg \\min_{\\theta} L_{\\text{train}}(D_{\\text{clean}}\\cup D_{\\text{poison}}; {\\theta}))$$<\/p>\n\n\n\n
\u57fa\u4e8e\u516c\u5f0f2\uff0cMetapoison\u5f97\u5230\u4e86\u516c\u5f0f3\u3002<\/p>\n\n\n\n
$$arg \\min_{D_{poison}\\in D} L_{adv}(D_{adv};{\\theta_2})\\\\$$ $$ s.t. \\quad {\\theta}_1 = {\\theta}_0 - {\\alpha}\\nabla_{D_{poison}} L_{train}(D_{\\text{clean}}\\cup D_{\\text{poison}}; {\\theta_0})$$ $$ {\\theta}_2 = {\\theta}_1 - {\\alpha}\\nabla_{D_{poison}} L_{train}(D_{\\text{clean}}\\cup D_{\\text{poison}}; {\\theta_1})$$<\/p>\n\n\n\n
PS\uff1a$\\nabla$\u8868\u793a\u68af\u5ea6<\/p>\n\n\n\n
\u6211\u4eec\u53d1\u73b0\u8fd9\u4e2a\u516c\u5f0f3\u548c\u6211\u4eec\u673a\u5668\u5b66\u4e60\u7684\u68af\u5ea6\u4e0b\u964d\u7b97\u6cd5(\u516c\u5f0f4)\u6bd4\u8f83\u50cf<\/p>\n\n\n\n
$$\\theta_k = \\theta_{k-1} - \\eta \\nabla_{\\theta} J(\\theta_{k-1})$$<\/p>\n\n\n\n
\u68af\u5ea6\u4e0b\u964d\u7684\u4f2a\u4ee3\u7801<\/p>\n\n\n\n
# \u8ba1\u7b97\u504f\u5bfc\u4e5f\u5c31\u662f\u68af\u5ea6\ntheta = ...\nfor i in range(n):\n    d_theta = compute_gradient(theta)\n    theta = theta - eta * d_theta\n    ...<\/code><\/pre>\n\n\n\n
\u6240\u4ee5Metapoison\u7684\u4f2a\u4ee3\u7801\u4e5f\u5dee\u4e0d\u591a\u7c7b\u4f3c<\/p>\n\n\n\n
# \u8ba1\u7b97\u504f\u5bfc\u4e5f\u5c31\u662f\u68af\u5ea6\ntheta = ...\nfor i in range(n):\n    d_theta = compute_gradient(theta)\n    theta_1 = theta_0 - alpha * L_train\n    theta_2 = theta_1 - alpha * L_train\n    ...\n# \u5f97\u5230theta_2\u540e\uff0c\u5c31\u53ef\u4ee5\u8fdb\u884c\u6700\u5916\u5c42\u5bf9theta_2\u7684\u4f18\u5316\u4e86<\/code><\/pre>\n\n\n\n
Metapoison\u7684\u5b8c\u6574\u6846\u67b6<\/h1>\n\n\n\n
\u7b97\u6cd5\uff1a\u57fa\u4e8eMetapoison\u9488\u5bf9\u4e8e\u76ee\u6807\u7f51\u7edc\u751f\u6210\u6295\u6bd2\u6570\u636e<\/p>\n\n\n\n
\u8f93\u5165\uff1a$(X, Y), x_t, y_{adv}, n<<N,T,M$<\/p>\n\n\n\n
\u8f93\u51fa\uff1a$X_p$<\/p>\n\n\n\n
\u8bad\u7ec3$M$\u4e2a\u6a21\u578b\uff0c\u5176\u4e2d\u7b2c$m$\u4e2a\u6a21\u578b\u8bad\u7ec3\u5230\u7b2c$mT\/M$\u8f6e\uff0c\u83b7\u5f97\u53c2\u6570$\\theta_m$\uff0c\u4ece\u8bad\u7ec3\u96c6\u4e2d\u9009\u62e9$n$\u5e45\u56fe\u50cf\u4f5c\u4e3a\u4fee\u6539\u7684\u6295\u6bd2\u6837\u672c\u5e76\u7528$X_p$\u8868\u793a\uff0c\u5269\u4f59\u7684\u5e72\u51c0\u6837\u672c\u7528$X_c$\u8868\u793a\u3002<\/p>\n\n\n\n
$$For \\quad i=1,...,C\\quad (\u8fed\u4ee3\u6b21\u6570) $$ $$ \\quad For \\quad m=1,...,M\\quad (\u6a21\u578b\u4e2a\u6570)$$ $$ \\qquad \\hat{\\theta} \\gets {\\theta}_m $$ $$ \\qquad For \\quad k=1,...,K\\quad (\u5c55\u5f00\u6b65\u6570) $$ $$ \\qquad \\quad \\hat{\\theta}=\\hat{\\theta} - {\\alpha}\\nabla_{\\hat{\\theta}} L_{train}(X_{c}\\cup X_{p},Y; \\hat{\\theta}) $$ $$ \\qquad \u5bf9\u6297\u635f\u5931\uff1aL_m = L_{adv}(x_i,y_{adv};\\theta_m) $$ $$\\qquad \u8bad\u7ec3\u5f53\u524d\u6a21\u578b\uff1a\\theta_m = \\theta_m-{\\alpha}\\nabla_{{\\theta}_m} L_{train}(X_,Y; \\theta_m)$$ $$ \\qquad\u5982\u679c\u5f53\u524d\u6a21\u578b\u8bad\u7ec3\u5230\u7b2cT+1\u8f6e\uff0c\u5219\u5c06\u5176\u91cd\u65b0\u521d\u59cb\u5316$$ $$ \\quad \u5c06\u6240\u6709\u5bf9\u6297\u635f\u5931\u53d6\u5e73\u5747\u503c\uff1aL_{adv}=\\sum_{m=1}^ML_m\/M$$ $$ \\quad \u57fa\u4e8eL_{adv}\u8ba1\u7b97\u68af\u5ea6\u5e76\u66f4\u65b0X_p $$ $$ \u8fd4\u56de\u83b7\u5f97\u7684\u6295\u6bd2\u6570\u636e\u96c6X_p$$<\/p>\n\n\n\n
\u7b97\u6cd5\u6574\u4f53\u5206\u4e3a\u4e24\u4e2a\u9636\u6bb5<\/p>\n\n\n\n
\uff08\u4e00\uff09\u6a21\u578b\u9884\u8bad\u7ec3\u9636\u6bb5<\/p>\n\n\n\n
\u8bad\u7ec3$M$\u4e2a\u4ee3\u66ff\u6a21\u578b\uff0c\u5c06\u7b2c$m$\u4e2a\u4ee3\u66ff\u6a21\u578b\u8bad\u7ec3$mT\/M$\u8f6e\uff0c\u8fd9\u91cc\u8bad\u7ec3\u591a\u4e2a\u6a21\u578b\u662f\u4e3a\u4e86\u589e\u52a0\u6a21\u578b\u7684\u591a\u6837\u6027\uff0c\u4ee5\u6b64\u5c3d\u53ef\u80fd\u63d0\u5347\u751f\u6210\u7684\u6295\u6bd2\u6570\u636e\u7684\u8fc1\u79fb\u80fd\u529b\u3002<\/p>\n\n\n\n
\uff08\u4e8c\uff09\u6784\u5efa\u6295\u6bd2\u6570\u636e\u9636\u6bb5<\/p>\n\n\n\n
\u4f7f\u7528\u9884\u8bad\u7ec3\u597d\u7684$M$\u4e2a\u4ee3\u66ff\u6a21\u578b\u8fdb\u884c\u653b\u51fb\uff0c\u5e76\u83b7\u5f97\u6295\u6bd2\u6570\u636e\u96c6\u3002\u5bf9\u4e8e\u6bcf\u4e00\u4e2a\u66ff\u4ee3\u6a21\u578b\uff0c\u9996\u5148\uff0c\u6309\u7167\u968f\u673a\u68af\u5ea6\u4e0b\u964d\u5c55\u5f00$K$\u6b65\uff0c\u7136\u540e\u57fa\u4e8e\u66f4\u65b0\u540e\u7684\u6a21\u578b\u53c2\u6570\u8ba1\u7b97\uff0c\u5916\u5c42\u5bf9\u6297\u6837\u672c\u653b\u51fb\u635f\u5931\uff0c\u5e76\u5c06\u5f53\u524d\u66ff\u4ee3\u6a21\u578b\u66f4\u65b0\u4e00\u8f6e\uff0c\u6700\u540e\uff0c\u5728\u6240\u6709\u66ff\u4ee3\u6a21\u578b\u66f4\u65b0\u5b8c\u6210\u540e\uff0c\u83b7\u5f97\u6240\u6709\u5bf9\u6297\u635f\u5931\u7684\u5e73\u5747\u503c\uff0c\u5bf9\u6295\u6bd2\u6570\u636e\u96c6\u8fdb\u884c\u4f18\u5316\u3002<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\u653b\u51fb\u6548\u679c\u5206\u6790<\/h1>\n\n\n\n
<\/td>\u6295\u6bd2\u6837\u672c\u4e2a\u6570\uff08\u6bd4\u4f8b\uff09<\/td>\u5206\u7c7b\u51c6\u786e\u7387<\/td>\u653b\u51fb\u6210\u529f\u7387<\/td><\/tr>
ConNetBN<\/td>1\uff080.002%\uff09<\/td>0.7322<\/td>0.00<\/td><\/tr>
10\uff080.02%\uff09<\/td>0.7271<\/td>0.03<\/td><\/tr>
100\uff080.2%\uff09<\/td>0.7197<\/td>0.31<\/td><\/tr>
500\uff081.0%\uff09<\/td>0.7132<\/td>0.76<\/td><\/tr>
5000\uff0810%\uff09<\/td>0.7023<\/td>0.85<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
<\/td>\u6295\u6bd2\u6837\u672c\u4e2a\u6570\uff08\u6bd4\u4f8b\uff09<\/td>\u5206\u7c7b\u51c6\u786e\u7387<\/td>\u653b\u51fb\u6210\u529f\u7387<\/td><\/tr>
VGG<\/td>1\uff080.002%\uff09<\/td>0.7122<\/td>0.00<\/td><\/tr>
10\uff080.02%\uff09<\/td>0.7071<\/td>0.06<\/td><\/tr>
100\uff080.2%\uff09<\/td>0.7097<\/td>0.45<\/td><\/tr>
500\uff081.0%\uff09<\/td>0.6982<\/td>0.44<\/td><\/tr>
5000\uff0810%\uff09<\/td>0.6935<\/td>0.72<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
<\/td>\u6295\u6bd2\u6837\u672c\u4e2a\u6570\uff08\u6bd4\u4f8b\uff09<\/td>\u5206\u7c7b\u51c6\u786e\u7387<\/td>\u653b\u51fb\u6210\u529f\u7387<\/td><\/tr>
ResNet<\/td>1\uff080.002%\uff09<\/td>0.7722<\/td>0.02<\/td><\/tr>
10\uff080.02%\uff09<\/td>0.7671<\/td>0.05<\/td><\/tr>
100\uff080.2%\uff09<\/td>0.7697<\/td>0.24<\/td><\/tr>
500\uff081.0%\uff09<\/td>0.7532<\/td>0.68<\/td><\/tr>
5000\uff0810%\uff09<\/td>0.7323<\/td>0.76<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
\u53c2\u8003\u8d44\u6599<\/h1>\n\n\n\n
    \n
  1. \u817e\u8baf\u5b89\u5168\u6731\u96c0\u5b9e\u9a8c\u5ba4. (2022). AI<\/em>\u5b89\u5168<\/em>\uff1a\u6280\u672f\u4e0e\u5b9e\u6218. \u7535\u5b50\u5de5\u4e1a\u51fa\u7248\u793e. ISBN: 978-7-121-43926-1.<\/li>\n\n\n\n
  2. MetaPoison: Practical General-purpose Clean-label Data Poisoning<\/a><\/li>\n\n\n\n
  3. https:\/\/github.com\/wronnyhuang\/metapoison?tab=readme-ov-file<\/li>\n<\/ol>\n","protected":false},"excerpt":{"rendered":"
    \u7814\u7a76\u80cc\u666f \u6570\u636e\u6295\u6bd2\u653b\u51fb\u53ef\u4ee5\u88ab\u5b9a\u4e49\u4e3a\u4e00\u4e2a\u53cc\u5c42\u4f18\u5316\u7684\u95ee\u9898\uff0c\u5982\u4e0b\u516c\u5f0f1 $$L_{\\text{adv}}(D_{\\text{adv}}; …<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"emotion":"","emotion_color":"","title_style":"","license":"","footnotes":""},"categories":[6,7],"tags":[4,5],"class_list":["post-168","post","type-post","status-publish","format-standard","hentry","category-ai","category-7","tag-ai","tag-5"],"_links":{"self":[{"href":"http:\/\/jieyekang.com\/index.php\/wp-json\/wp\/v2\/posts\/168","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/jieyekang.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/jieyekang.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/jieyekang.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/jieyekang.com\/index.php\/wp-json\/wp\/v2\/comments?post=168"}],"version-history":[{"count":17,"href":"http:\/\/jieyekang.com\/index.php\/wp-json\/wp\/v2\/posts\/168\/revisions"}],"predecessor-version":[{"id":197,"href":"http:\/\/jieyekang.com\/index.php\/wp-json\/wp\/v2\/posts\/168\/revisions\/197"}],"wp:attachment":[{"href":"http:\/\/jieyekang.com\/index.php\/wp-json\/wp\/v2\/media?parent=168"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/jieyekang.com\/index.php\/wp-json\/wp\/v2\/categories?post=168"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/jieyekang.com\/index.php\/wp-json\/wp\/v2\/tags?post=168"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}