mlsanityData to 14 Oct 2026

Transferable Clean-Label Poisoning Attacks on Deep Neural Nets

arXiv 1905.05897 ↗First posted 15 May 2019stat.ML cs.CR cs.LGcited by 131

Not on the map. Why?

Cited by 57 in LLM safety and security, but placed by its own abstract, which didn’t fit.

Abstract (arXiv)

Clean-label poisoning attacks inject innocuous looking (and "correctly" labeled) poison images into training data, causing a model to misclassify a targeted image after being trained on this data. We consider transferable poisoning attacks that succeed without access to the victim network's outputs, architecture, or (in some cases) training data. To achieve this, we propose a new "polytope attack" in which poison images are designed to surround the targeted image in feature space. We also demonstrate that using Dropout during poison creation helps to enhance transferability of this attack. We achieve transferable attack success rates of over 50% while poisoning only 1% of the training set.

Key facts. Cited by 131 papers in the map (data through 14 Oct 2026). First posted on arXiv 15 May 2019.

Builds on

No reference list yet.

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2021: 33; 2022: 33; 2023: 26; 2024: 24; 2025: 10; 2026: 5.

131 papers.

Sort:

By area:

  1. 2021Anti-Backdoor Learning: Training Clean Models on Poisoned Datacited by 263
  2. 2024What is in Your Safe Data? Identifying Benign Data that Breaks Safetycited by 118
  3. 2021Data Collection and Quality Challenges in Deep Learning: A Data-Centric AI Perspectivecited by 116
  4. 2023On the Exploitability of Instruction Tuningcited by 116
  5. 2021Sleeper Agent: Scalable Hidden Trigger Backdoors for Neural Networks Trained from Scratchcited by 102
  6. 2022Truth Serum: Poisoning Machine Learning Models to Reveal Their Secretscited by 101
  7. 2021Backdoor Scanning for Deep Neural Networks through K-Arm Optimizationcited by 98
  8. 2022Wild Patterns Reloaded: A Survey of Machine Learning Security against Training Data Poisoningcited by 94
  9. 2021Backdoor Pre-trained Models Can Transfer to Allcited by 86
  10. 2023Nightshade: Prompt-Specific Poisoning Attacks on Text-to-Image Generative Modelscited by 75
  11. 2023TrojanPuzzle: Covertly Poisoning Code-Suggestion Modelscited by 60
  12. 2021Better Safe Than Sorry: Preventing Delusive Adversaries with Adversarial Trainingcited by 59
38 more
  1. 2021Hard to Forget: Poisoning Attacks on Certified Machine Unlearningcited by 52
  2. 2022Improved Certified Defenses against Data Poisoning with (Deterministic) Finite Aggregationcited by 52
  3. 2024Shadowcast: Stealthy Data Poisoning Attacks Against Vision-Language Modelscited by 50
  4. 2022Autoregressive Perturbations for Data Poisoningcited by 46
  5. 2021Poisoning the Unlabeled Dataset of Semi-Supervised Learningcited by 44
  6. 2021An Overview of Backdoor Attacks Against Deep Neural Networks and Possible Defencescited by 42
  7. 2022Data Poisoning Attacks Against Multimodal Encoderscited by 41
  8. 2021Poison Forensics: Traceback of Data Poisoning Attacks in Neural Networkscited by 40
  9. 2024Test-Time Backdoor Attacks on Multimodal Large Language Modelscited by 40
  10. 2023Backdoor Defense via Deconfounded Representation Learningcited by 38
  11. 2022Unlearnable Clusters: Towards Label-agnostic Unlearnable Examplescited by 36
  12. 2021Preventing Unauthorized Use of Proprietary Data: Poisoning for Secure Dataset Releasecited by 35
  13. 2021DP-InstaHide: Provably Defusing Poisoning and Backdoor Attacks with Differentially Private Data Augmentationscited by 34
  14. 2022Amplifying Membership Exposure via Data Poisoningcited by 34
  15. 2021De-Pois: An Attack-Agnostic Defense against Data Poisoning Attackscited by 33
  16. 2022Identifying a Training-Set Attack's Target Using Renormalized Influence Estimationcited by 32
  17. 2022Not All Poisons are Created Equal: Robust Training against Data Poisoningcited by 30
  18. 2022Indiscriminate Data Poisoning Attacks on Neural Networkscited by 25
  19. 2021IdentityDP: Differential Private Identification Protection for Face Imagescited by 24
  20. 2021ML Attack Models: Adversarial Attacks and Data Poisoning Attackscited by 24
  21. 2023Exploring the Limits of Model-Targeted Indiscriminate Data Poisoning Attackscited by 23
  22. 2021What Doesn't Kill You Makes You Robust(er): How to Adversarially Train against Data Poisoningcited by 22
  23. 2022Friendly Noise against Adversarial Noise: A Powerful Defense against Data Poisoning Attackscited by 21
  24. 2023Backdoor Attacks Against Dataset Distillationcited by 21
  25. 2023Automated Cyber Defence: A Reviewcited by 21
  26. 2024Data Poisoning for In-context Learningcited by 21
  27. 2025Data Poisoning in Deep Learning: A Surveycited by 20
  28. 2022BagFlip: A Certified Defense against Data Poisoningcited by 19
  29. 2024Certified Robustness to Data Poisoning in Gradient-Based Trainingcited by 18
  30. 2021SoK: Anti-Facial Recognition Technologycited by 16
  31. 2022An Equivalence Between Data Poisoning and Byzantine Gradient Attackscited by 16
  32. 2022Low-Rank Softmax Can Have Unargmaxable Classes in Theory but Rarely in Practicecited by 15
  33. 2022Quarantine: Sparsity Can Uncover the Trojan Attack Trigger for Freecited by 15
  34. 2022Bugs in Machine Learning-based Systems: A Faultload Benchmarkcited by 15
  35. 2022Jigsaw Puzzle: Selective Backdoor Attack to Subvert Malware Classifierscited by 14
  36. 2022Poisons that are learned faster are more effectivecited by 14
  37. 2022My Face My Choice: Privacy Enhancing Deepfakes for Social Media Anonymizationcited by 14
  38. 2024Trustworthy Distributed AI Systems: Robustness, Privacy, and Governancecited by 14

50 most cited of 131 All 131 (JSON)