Reproduce “Infusion: Shaping Model Behavior by Editing Training Data via Influence Functions” on OpenResearch
Turn your favorite coding agents into research agents that review literature, develop hypotheses, and run experiments.
Universal app for Apple silicon and Intel. Requires macOS 11 or later.
About this paper
J Rosser, Robert Kirk, Edward Grefenstette, Jakob Foerster, Laura Ruis
The INFUSION framework introduces a method for targeted data poisoning by making subtle, gradient-based modifications to existing training documents. This approach reliably induces targeted misclassification in vision models and shifts probability distributions in language models, demonstrating a new vulnerability where adversarial objectives can be embedded in pretraining data.
Key insights
- Influence functions, typically used for interpretability, can be repurposed to craft subtle, targeted data poisoning attacks by guiding perturbations of existing training data.
- Even small, non-explicit modifications to a tiny fraction of training data (e.g., 0.2%) can reliably induce targeted behavioral shifts, providing a stealthier attack vector compared to explicit data injection.
- The effectiveness of these perturbations can correlate with latent model structures and learned patterns, as observed in Caesar cipher tasks where number-theoretic properties influenced vulnerability.
Summary by alphaXiv.
Tip: change arxiv.org to autoarxiv.org in any arXiv abstract link to open the paper here.