mlsanityData to 14 Oct 2026

Certified Defenses for Data Poisoning Attacks

arXiv 1706.03691 ↗First posted 9 Jun 2017cs.LG cs.CRcited by 303

Not on the map. Why?

Cited by 91 in LLM safety and security, but placed by its own abstract, which didn’t fit.

Abstract (arXiv)

Machine learning systems trained on user-provided data are susceptible to data poisoning attacks, whereby malicious users inject false training data with the aim of corrupting the learned model. While recent work has proposed a number of attacks and defenses, little is understood about the worst-case loss of a defense in the face of a determined attacker. We address this by constructing approximate upper bounds on the loss across a broad family of attacks, for defenders that first perform outlier removal followed by empirical risk minimization. Our approximation relies on two assumptions: (1) that the dataset is large enough for statistical concentration between train and test error to hold, and (2) that outliers within the clean (non-poisoned) data do not have a strong effect on the model. Our bound comes paired with a candidate attack that often nearly matches the upper bound, giving us a powerful tool for quickly assessing defenses on a given dataset. Empirically, we find that even under a simple defense, the MNIST-1-7 and Dogfish datasets are resilient to attack, while in contrast the IMDB sentiment dataset can be driven from 12% to 23% test error by adding only 3% poisoned data.

Key facts. Cited by 303 papers in the map (data through 14 Oct 2026). First posted on arXiv 9 Jun 2017.

Builds on

No reference list yet.

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2021: 55; 2022: 64; 2023: 52; 2024: 60; 2025: 38; 2026: 34.

303 papers.

Sort:

By area:

  1. 2021A Field Guide to Federated Optimizationcited by 315
  2. 2024PoisonedRAG: Knowledge Corruption Attacks to Retrieval-Augmented Generation of Large Language Modelscited by 267
  3. 2021Adversarial Neuron Pruning Purifies Backdoored Deep Modelscited by 235
  4. 2021Hidden Killer: Invisible Textual Backdoor Attacks with Syntactic Triggercited by 222
  5. 2023Survey of Vulnerabilities in Large Language Models Revealed by Adversarial Attackscited by 194
  6. 2022Training Data Influence Analysis and Estimation: A Surveycited by 135
  7. 2021SPECTRE: Defending Against Backdoor Attacks Using Robust Statisticscited by 130
  8. 2021Sleeper Agent: Scalable Hidden Trigger Backdoors for Neural Networks Trained from Scratchcited by 102
  9. 2025Subliminal Learning: Language models transmit behavioral traits via hidden signals in datacited by 95
  10. 2022Wild Patterns Reloaded: A Survey of Machine Learning Security against Training Data Poisoningcited by 94
  11. 2023Machine Unlearning: Solutions and Challengescited by 93
  12. 2024Harmful Fine-tuning Attacks and Defenses for Large Language Models: A Surveycited by 90
38 more
  1. 2021Membership Inference Attack on Graph Neural Networkscited by 81
  2. 2023Unleashing the potential of prompt engineering for large language modelscited by 72
  3. 2021Handcrafted Backdoors in Deep Neural Networkscited by 63
  4. 2021Property Inference From Poisoningcited by 60
  5. 2021Better Safe Than Sorry: Preventing Delusive Adversaries with Adversarial Trainingcited by 59
  6. 2023Identifying and Mitigating Vulnerabilities in LLM-Integrated Applicationscited by 54
  7. 2022Improved Certified Defenses against Data Poisoning with (Deterministic) Finite Aggregationcited by 52
  8. 2021CoProtector: Protect Open-Source Code against Unauthorized Training Usage with Data Poisoningcited by 47
  9. 2021Poisoning the Unlabeled Dataset of Semi-Supervised Learningcited by 44
  10. 2021Data Poisoning Attacks to Deep Learning Based Recommender Systemscited by 43
  11. 2022Hidden Poison: Machine Unlearning Enables Camouflaged Poisoning Attackscited by 43
  12. 2021Robust Machine Learning Systems: Challenges, Current Trends, Perspectives, and the Road Aheadcited by 41
  13. 2021Few-shot Backdoor Defense Using Shapley Estimationcited by 41
  14. 2023Backdoor Attacks Against Deep Image Compression via Adaptive Frequency Triggercited by 40
  15. 2023Honesty Is the Best Policy: Defining and Mitigating AI Deceptioncited by 40
  16. 2021How to Certify Machine Learning Based Safety-critical Systems? A Systematic Literature Reviewcited by 39
  17. 2025BadVLA: Towards Backdoor Attacks on Vision-Language-Action Models via Objective-Decoupled Optimizationcited by 38
  18. 2024Machine Unlearning Fails to Remove Data Poisoning Attackscited by 37
  19. 2025Practical Poisoning Attacks against Retrieval-Augmented Generationcited by 36
  20. 2021Preventing Unauthorized Use of Proprietary Data: Poisoning for Secure Dataset Releasecited by 35
  21. 2022Robust Unlearnable Examples: Protecting Data Against Adversarial Learningcited by 35
  22. 2022PoisonedEncoder: Poisoning the Unlabeled Pre-training Data in Contrastive Learningcited by 34
  23. 2025Ivy-Fake: A Unified Explainable Framework and Benchmark for Image and Video AIGC Detectioncited by 34
  24. 2021De-Pois: An Attack-Agnostic Defense against Data Poisoning Attackscited by 33
  25. 2022Identifying a Training-Set Attack's Target Using Renormalized Influence Estimationcited by 32
  26. 2024Teach LLMs to Phish: Stealing Private Information from Language Modelscited by 32
  27. 2022SNAP: Efficient Extraction of Private Properties with Poisoningcited by 31
  28. 2021Byzantine-robust Federated Learning through Collaborative Malicious Gradient Filteringcited by 30
  29. 2021Interpretable Data-Based Explanations for Fairness Debuggingcited by 30
  30. 2022Byzantine-Robust Federated Learning with Optimal Statistical Rates and Privacy Guaranteescited by 30
  31. 2022FLCert: Provably Secure Federated Learning against Poisoning Attackscited by 30
  32. 2022Not All Poisons are Created Equal: Robust Training against Data Poisoningcited by 30
  33. 2023Label Poisoning is All You Needcited by 29
  34. 2022One-shot Neural Backdoor Erasing via Adversarial Weight Maskingcited by 28
  35. 2025Traceback of Poisoning Attacks to Retrieval-Augmented Generationcited by 28
  36. 2024Towards Scalable Exact Machine Unlearning Using Parameter-Efficient Fine-Tuningcited by 27
  37. 2026BadSkill: Backdoor Attacks on Agent Skills via Model-in-Skill Poisoningcited by 27
  38. 2022COPA: Certifying Robust Policies for Offline Reinforcement Learning against Poisoning Attackscited by 26

50 most cited of 303 All 303 (JSON)