# Label Sanitization against Label Flipping Poisoning Attacks

arXiv: https://arxiv.org/abs/1803.00992 · HTML: https://mlsanity.com/paper/1803.00992/

## Key facts

- Cited by 73 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 2 Mar 2018.

## Built on by (most cited first, 30 of 73)

- [Trustworthy AI: From Principles to Practices](https://mlsanity.com/paper/2110.01167/) (2021)
- [Wild Patterns Reloaded: A Survey of Machine Learning Security against Training Data Poisoning](https://mlsanity.com/paper/2205.01992/) (2022)
- [Sample Selection for Fair and Robust Training](https://mlsanity.com/paper/2110.14222/) (2021)
- [Hidden Poison: Machine Unlearning Enables Camouflaged Poisoning Attacks](https://mlsanity.com/paper/2212.10717/) (2022)
- [DP-InstaHide: Provably Defusing Poisoning and Backdoor Attacks with Differentially Private Data Augmentations](https://mlsanity.com/paper/2103.02079/) (2021)
- [PoisonedEncoder: Poisoning the Unlabeled Pre-training Data in Contrastive Learning](https://mlsanity.com/paper/2205.06401/) (2022)
- [De-Pois: An Attack-Agnostic Defense against Data Poisoning Attacks](https://mlsanity.com/paper/2105.03592/) (2021)
- [Label Poisoning is All You Need](https://mlsanity.com/paper/2310.18933/) (2023)
- [Certifying Robustness to Programmable Data Bias in Decision Trees](https://mlsanity.com/paper/2110.04363/) (2021)
- [Run-Off Election: Improved Provable Defense against Data Poisoning Attacks](https://mlsanity.com/paper/2302.02300/) (2023)
- [The Dataset Multiplicity Problem: How Unreliable Data Impacts Predictions](https://mlsanity.com/paper/2304.10655/) (2023)
- [Poisoning Attacks and Defenses on Artificial Intelligence: A Survey](https://mlsanity.com/paper/2202.10276/) (2022)
- [BadLabel: A Robust Perspective on Evaluating and Enhancing Label-noise Learning](https://mlsanity.com/paper/2305.18377/) (2023)
- [Preference Poisoning Attacks on Reward Model Learning](https://mlsanity.com/paper/2402.01920/) (2024)
- [Robust Android Malware Detection System against Adversarial Attacks using Q-Learning](https://mlsanity.com/paper/2101.12031/) (2021)
- [Adversarial Clean Label Backdoor Attacks and Defenses on Text Classification Systems](https://mlsanity.com/paper/2305.19607/) (2023)
- [Label Flipping Data Poisoning Attack Against Wearable Human Activity Recognition System](https://mlsanity.com/paper/2208.08433/) (2022)
- [Self-Consuming Generative Models with Adversarially Curated Data](https://mlsanity.com/paper/2505.09768/) (2025)
- [Membership Inference Attacks Against Semantic Segmentation Models](https://mlsanity.com/paper/2212.01082/) (2022)
- [Leveraging Diffusion-Based Image Variations for Robust Training on Poisoned Data](https://mlsanity.com/paper/2310.06372/) (2023)
- [Federated Learning Under Attack: Exposing Vulnerabilities through Data Poisoning Attacks in Computer Networks](https://mlsanity.com/paper/2403.02983/) (2024)
- [RC-Mixup: A Data Augmentation Strategy against Noisy Data for Regression Tasks](https://mlsanity.com/paper/2405.17938/) (2024)
- [Exact Certification of (Graph) Neural Networks Against Label Poisoning](https://mlsanity.com/paper/2412.00537/) (2024)
- [Adversarial Training for Defense Against Label Poisoning Attacks](https://mlsanity.com/paper/2502.17121/) (2025)
- [StealthAttack: Robust 3D Gaussian Splatting Poisoning via Density-Guided Illusions](https://mlsanity.com/paper/2510.02314/) (2025)
- [EX-RAY: Distinguishing Injected Backdoor from Natural Features in Neural Networks by Examining Differential Feature Symmetry](https://mlsanity.com/paper/2103.08820/) (2021)
- [A Survey on Poisoning Attacks Against Supervised Machine Learning](https://mlsanity.com/paper/2202.02510/) (2022)
- [LLM Misalignment via Adversarial RLHF Platforms](https://mlsanity.com/paper/2503.03039/) (2025)
- [Breaking Fair Binary Classification with Optimal Flipping Attacks](https://mlsanity.com/paper/2204.05472/) (2022)
- [Pre-trained Encoders in Self-Supervised Learning Improve Secure and Privacy-preserving Supervised Learning](https://mlsanity.com/paper/2212.03334/) (2022)

## Abstract (arXiv)

Many machine learning systems rely on data collected in the wild from untrusted sources, exposing the learning algorithms to data poisoning. Attackers can inject malicious data in the training dataset to subvert the learning process, compromising the performance of the algorithm producing errors in a targeted or an indiscriminate way. Label flipping attacks are a special case of data poisoning, where the attacker can control the labels assigned to a fraction of the training points. Even if the capabilities of the attacker are constrained, these attacks have been shown to be effective to significantly degrade the performance of the system. In this paper we propose an efficient algorithm to perform optimal label flipping poisoning attacks and a mechanism to detect and relabel suspicious data points, mitigating the effect of such poisoning attacks.