mlsanityData to 14 Oct 2026

Poison Frogs! Targeted Clean-Label Poisoning Attacks on Neural Networks

arXiv 1804.00792 ↗First posted 3 Apr 2018cs.LG cs.CR cs.CVcited by 519

Not on the map. Why?

Cited by 153 in LLM safety and security, but placed by its own abstract, which didn’t fit.

Abstract (arXiv)

Data poisoning is an attack on machine learning models wherein the attacker adds examples to the training set to manipulate the behavior of the model at test time. This paper explores poisoning attacks on neural nets. The proposed attacks use "clean-labels"; they don't require the attacker to have any control over the labeling of training data. They are also targeted; they control the behavior of the classifier on a textitspecific test instance without degrading overall classifier performance. For example, an attacker could add a seemingly innocuous image (that is properly labeled) to a training set for a face recognition engine, and control the identity of a chosen person at test time. Because the attacker does not need to control the labeling function, poisons could be entered into the training set simply by leaving them on the web and waiting for them to be scraped by a data collection bot. We present an optimization-based method for crafting poisons, and show that just one single poison image can control classifier behavior when transfer learning is used. For full end-to-end training, we present a "watermarking" strategy that makes poisoning reliable using multiple (≈50) poisoned training instances. We demonstrate our method by generating poisoned frog images from the CIFAR dataset and using them to manipulate image classifiers.

Key facts. Cited by 519 papers in the map (data through 14 Oct 2026). First posted on arXiv 3 Apr 2018.

Builds on

No reference list yet.

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2021: 78; 2022: 113; 2023: 109; 2024: 106; 2025: 66; 2026: 47.

519 papers.

Sort:

By area:

  1. 2021Neural Attention Distillation: Erasing Backdoor Triggers from Deep Neural Networkscited by 324
  2. 2021Unsolved Problems in ML Safetycited by 292
  3. 2023Poisoning Web-Scale Training Datasets is Practicalcited by 290
  4. 2024PoisonedRAG: Knowledge Corruption Attacks to Retrieval-Augmented Generation of Large Language Modelscited by 267
  5. 2021Anti-Backdoor Learning: Training Clean Models on Poisoned Datacited by 263
  6. 2021Adversarial Neuron Pruning Purifies Backdoored Deep Modelscited by 235
  7. 2023Data-centric Artificial Intelligence: A Surveycited by 203
  8. 2021Unlearnable Examples: Making Personal Data Unexploitablecited by 193
  9. 2021Poisoning and Backdooring Contrastive Learningcited by 151
  10. 2022Training Data Influence Analysis and Estimation: A Surveycited by 135
  11. 2022BackdoorBench: A Comprehensive Benchmark of Backdoor Learningcited by 128
  12. 2021BadEncoder: Backdoor Attacks to Pre-trained Encoders in Self-Supervised Learningcited by 123
38 more
  1. 2021Back to the Drawing Board: A Critical Evaluation of Poisoning Attacks on Production Federated Learningcited by 118
  2. 2021Data Collection and Quality Challenges in Deep Learning: A Data-Centric AI Perspectivecited by 116
  3. 2023On the Exploitability of Instruction Tuningcited by 116
  4. 2021Backdoor Attacks on Pre-trained Models by Layerwise Weight Poisoningcited by 113
  5. 2021Sleeper Agent: Scalable Hidden Trigger Backdoors for Neural Networks Trained from Scratchcited by 102
  6. 2022Truth Serum: Poisoning Machine Learning Models to Reveal Their Secretscited by 101
  7. 2021Backdoor Scanning for Deep Neural Networks through K-Arm Optimizationcited by 98
  8. 2025Subliminal Learning: Language models transmit behavioral traits via hidden signals in datacited by 95
  9. 2022Wild Patterns Reloaded: A Survey of Machine Learning Security against Training Data Poisoningcited by 94
  10. 2021Trustworthy AI: A Computational Perspectivecited by 93
  11. 2021Backdoor Attacks on Self-Supervised Learningcited by 90
  12. 2022Untargeted Backdoor Watermark: Towards Harmless and Stealthy Dataset Copyright Protectioncited by 86
  13. 2023Nightshade: Prompt-Specific Poisoning Attacks on Text-to-Image Generative Modelscited by 75
  14. 2021Manipulating SGD with Data Ordering Attackscited by 74
  15. 2023LAVA: Data Valuation without Pre-Specified Learning Algorithmscited by 69
  16. 2022Physical Adversarial Attack meets Computer Vision: A Decade Surveycited by 67
  17. 2021Triggerless Backdoor Attack for NLP Tasks with Clean Labelscited by 66
  18. 2023Enhancing Fine-Tuning Based Backdoor Defense with Sharpness-Aware Minimizationcited by 64
  19. 2022The "Beatrix'' Resurrections: Robust Backdoor Detection via Gram Matricescited by 63
  20. 2021Availability Attacks Create Shortcutscited by 62
  21. 2021Property Inference From Poisoningcited by 60
  22. 2023TrojanPuzzle: Covertly Poisoning Code-Suggestion Modelscited by 60
  23. 2021Better Safe Than Sorry: Preventing Delusive Adversaries with Adversarial Trainingcited by 59
  24. 2022Rickrolling the Artist: Injecting Backdoors into Text Encoders for Text-to-Image Synthesiscited by 59
  25. 2023Reconstructive Neuron Pruning for Backdoor Defensecited by 59
  26. 2021Privacy-Preserving Machine Learning: Methods, Challenges and Directionscited by 58
  27. 2021Exploring Counterfactual Explanations Through the Lens of Adversarial Examples: A Theoretical and Empirical Analysiscited by 52
  28. 2021Hard to Forget: Poisoning Attacks on Certified Machine Unlearningcited by 52
  29. 2022Improved Certified Defenses against Data Poisoning with (Deterministic) Finite Aggregationcited by 52
  30. 2021Poison Ink: Robust and Invisible Backdoor Attackcited by 50
  31. 2022Measuring the Effect of Training Data on Deep Learning Predictions via Randomized Experimentscited by 50
  32. 2024Shadowcast: Stealthy Data Poisoning Attacks Against Vision-Language Modelscited by 50
  33. 2024Phantom: General Backdoor Attacks on Retrieval Augmented Language Generationcited by 49
  34. 2021CoProtector: Protect Open-Source Code against Unauthorized Training Usage with Data Poisoningcited by 47
  35. 2022Autoregressive Perturbations for Data Poisoningcited by 46
  36. 2021Poisoning the Unlabeled Dataset of Semi-Supervised Learningcited by 44
  37. 2022Hidden Poison: Machine Unlearning Enables Camouflaged Poisoning Attackscited by 43
  38. 2023Backdoor Defense via Adaptively Splitting Poisoned Datasetcited by 43

50 most cited of 519 All 519 (JSON)