mlsanityData to 7 Oct 2026

Data Poisoning against Differentially-Private Learners: Attacks and Defenses

arXiv 1903.09860 ↗First posted 23 Mar 2019cs.LG cs.CRcited by 75

Not on the map. Why?

Cited by 23 in LLM safety and security, but placed by its own abstract, which didn’t fit.

Abstract (arXiv)

Data poisoning attacks aim to manipulate the model produced by a learning algorithm by adversarially modifying the training set. We consider differential privacy as a defensive measure against this type of attack. We show that such learners are resistant to data poisoning attacks when the adversary is only able to poison a small number of items. However, this protection degrades as the adversary poisons more data. To illustrate, we design attack algorithms targeting objective and output perturbation learners, two standard approaches to differentially-private machine learning. Experiments show that our methods are effective when the attacker is allowed to poison sufficiently many training items.

Key facts. Cited by 75 papers in the map (data through 7 Oct 2026). First posted on arXiv 23 Mar 2019.

Builds on

No reference list yet.

Built on by

Cited by year

Citing papers per year: 2021: 18; 2022: 17; 2023: 16; 2024: 14; 2025: 10.

75 papers.

Sort:

By area:

  1. 2021Adversarial Neuron Pruning Purifies Backdoored Deep Modelscited by 230
  2. 2022Wild Patterns Reloaded: A Survey of Machine Learning Security against Training Data Poisoningcited by 93
  3. 2021Large Scale Private Learning via Low-rank Reparametrizationcited by 87
  4. 2021Do Not Let Privacy Overbill Utility: Gradient Embedding Perturbation for Private Learningcited by 86
  5. 2021Better Safe Than Sorry: Preventing Delusive Adversaries with Adversarial Trainingcited by 58
  6. 2021Privacy-Preserving Machine Learning: Methods, Challenges and Directionscited by 58
  7. 2022Mixed Differential Privacy in Computer Visioncited by 53
  8. 2022Improved Certified Defenses against Data Poisoning with (Deterministic) Finite Aggregationcited by 50
  9. 2021Data Poisoning Attacks to Deep Learning Based Recommender Systemscited by 41
  10. 2021Preventing Unauthorized Use of Proprietary Data: Poisoning for Secure Dataset Releasecited by 35
  11. 2021DP-InstaHide: Provably Defusing Poisoning and Backdoor Attacks with Differentially Private Data Augmentationscited by 33
  12. 2022PoisonedEncoder: Poisoning the Unlabeled Pre-training Data in Contrastive Learningcited by 33
38 more
  1. 2022SNAP: Efficient Extraction of Private Properties with Poisoningcited by 29
  2. 2022Not All Poisons are Created Equal: Robust Training against Data Poisoningcited by 29
  3. 2022A General Framework for Auditing Differentially Private Machine Learningcited by 25
  4. 2024Decentralized Federated Learning: A Survey on Security and Privacycited by 25
  5. 2021What Doesn't Kill You Makes You Robust(er): How to Adversarially Train against Data Poisoningcited by 22
  6. 2021Curse or Redemption? How Data Heterogeneity Affects the Robustness of Federated Learningcited by 21
  7. 2022Understanding the Limits of Poisoning Attacks in Episodic Reinforcement Learningcited by 21
  8. 2022BagFlip: A Certified Defense against Data Poisoningcited by 18
  9. 2022Backdoor Cleansing with Unlabeled Datacited by 17
  10. 2021Robust learning under clean-label attackcited by 15
  11. 2021Poisoning Attack against Estimating from Pairwise Comparisonscited by 14
  12. 2023Detection and Defense of Unlearnable Examplescited by 13
  13. 2022Lethal Dose Conjecture on Data Poisoningcited by 12
  14. 2022Unraveling the Connections between Privacy and Certified Robustness in Federated Learning Against Poisoning Attackscited by 12
  15. 2023PrivImage: Differentially Private Synthetic Image Generation using Diffusion Models with Semantic-Aware Pretrainingcited by 12
  16. 2024Trustworthy Distributed AI Systems: Robustness, Privacy, and Governancecited by 12
  17. 2023Temporal Robustness against Data Poisoningcited by 10
  18. 2024Game-Theoretic Defenses for Robust Conformal Prediction Against Adversarial Attacks in Medical Imagingcited by 10
  19. 2021SoK: Machine Learning Governancecited by 9
  20. 2023A Survey on Vulnerability of Federated Learning: A Learning Algorithm Perspectivecited by 9
  21. 2021Meta Federated Learningcited by 8
  22. 2022A Survey on AI Sustainability: Emerging Trends on Learning Algorithms and Research Challengescited by 7
  23. 2023Adversarial Attacks on Adversarial Banditscited by 6
  24. 2023Enhancing the Antidote: Improved Pointwise Certifications against Poisoning Attackscited by 6
  25. 2023SoK: Unintended Interactions among Machine Learning Defenses and Riskscited by 6
  26. 2025Trustworthy Machine Learning via Memorization and the Granular Long-Tail: A Survey on Interactions, Tradeoffs, and Beyondcited by 6
  27. 2025StealthAttack: Robust 3D Gaussian Splatting Poisoning via Density-Guided Illusionscited by 6
  28. 202110 Security and Privacy Problems in Large Foundation Modelscited by 5
  29. 2023PECAN: A Deterministic Certified Defense Against Backdoor Attackscited by 5
  30. 2024Provable Robustness of (Graph) Neural Networks Against Data Poisoning and Backdoor Attackscited by 5
  31. 2024Exact Certification of (Graph) Neural Networks Against Label Poisoningcited by 5
  32. 2022Federated and Transfer Learning: A Survey on Adversaries and Defense Mechanismscited by 4
  33. 2022Renyi Differential Privacy of Propose-Test-Release and Applications to Private and Robust Machine Learningcited by 4
  34. 2023Recursive Euclidean Distance Based Robust Aggregation Technique For Federated Learningcited by 4
  35. 2025Crowding Out The Noise: Algorithmic Collective Action Under Differential Privacycited by 4
  36. 2021Combining Differential Privacy and Byzantine Resilience in Distributed SGDcited by 3
  37. 2024PureGen: Universal Data Purification for Train-Time Poison Defense via Generative Model Dynamicscited by 3
  38. 2024The poison of dimensionalitycited by 3

50 most cited of 75 All 75 (JSON)