  A powerful category of (invisible) data poisoning attacks modify a subset of
training examples by small adversarial perturbations to change the prediction
of certain test-time data. Existing defense mechanisms are not desirable to
deploy in practice, as they often either drastically harm the generalization
performance, or are attack-specific, and prohibitively slow to apply. Here, we
propose a simple but highly effective approach that unlike existing methods
breaks various types of invisible poisoning attacks with the slightest drop in
the generalization performance. We make the key observation that attacks
introduce local sharp regions of high training loss, which when minimized,
results in learning the adversarial perturbations and makes the attack
successful. To break poisoning attacks, our key idea is to alleviate the sharp
loss regions introduced by poisons. To do so, our approach comprises two
components: an optimized friendly noise that is generated to maximally perturb
examples without degrading the performance, and a randomly varying noise
component. The combination of both components builds a very light-weight but
extremely effective defense against the most powerful triggerless targeted and
hidden-trigger backdoor poisoning attacks, including Gradient Matching,
Bulls-eye Polytope, and Sleeper Agent. We show that our friendly noise is
transferable to other architectures, and adaptive attacks cannot break our
defense due to its random noise component. Our code is available at:
https://github.com/tianyu139/friendly-noise
