# Poisoning Attacks with Generative Adversarial Nets

arXiv: https://arxiv.org/abs/1906.07773 · HTML: https://mlsanity.com/paper/1906.07773/

## Key facts

- Cited by 23 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 18 Jun 2019.

## Built on by (most cited first, 23 of 23)

- [Back to the Drawing Board: A Critical Evaluation of Poisoning Attacks on Production Federated Learning](https://mlsanity.com/paper/2108.10241/) (2021)
- [De-Pois: An Attack-Agnostic Defense against Data Poisoning Attacks](https://mlsanity.com/paper/2105.03592/) (2021)
- [Indiscriminate Data Poisoning Attacks on Neural Networks](https://mlsanity.com/paper/2204.09092/) (2022)
- [Data Poisoning in Deep Learning: A Survey](https://mlsanity.com/paper/2503.22759/) (2025)
- [Poisoning Attacks on Fair Machine Learning](https://mlsanity.com/paper/2110.08932/) (2021)
- [Transferable Graph Backdoor Attack](https://mlsanity.com/paper/2207.00425/) (2022)
- [Poisoning Attacks and Defenses on Artificial Intelligence: A Survey](https://mlsanity.com/paper/2202.10276/) (2022)
- [Regularization Can Help Mitigate Poisoning Attacks... with the Right Hyperparameters](https://mlsanity.com/paper/2105.10948/) (2021)
- [Disrupting Model Training with Adversarial Shortcuts](https://mlsanity.com/paper/2106.06654/) (2021)
- [Towards Effective and Robust Neural Trojan Defenses via Input Filtering](https://mlsanity.com/paper/2202.12154/) (2022)
- [Exploring Privacy and Fairness Risks in Sharing Diffusion Models: An Adversarial Perspective](https://mlsanity.com/paper/2402.18607/) (2024)
- [Backdoor Learning for NLP: Recent Advances, Challenges, and Future Research Directions](https://mlsanity.com/paper/2302.06801/) (2023)
- [Generative Poisoning Using Random Discriminators](https://mlsanity.com/paper/2211.01086/) (2022)
- [Hyperparameter Learning under Data Poisoning: Analysis of the Influence of Regularization via Multiobjective Bilevel Optimization](https://mlsanity.com/paper/2306.01613/) (2023)
- [FROB: Few-shot ROBust Model for Classification and Out-of-Distribution Detection](https://mlsanity.com/paper/2111.15487/) (2021)
- [New data poison attacks on machine learning classifiers for mobile exfiltration](https://mlsanity.com/paper/2210.11592/) (2022)
- [Inverting Gradient Attacks Makes Powerful Data Poisoning](https://mlsanity.com/paper/2410.21453/) (2024)
- [Mitigating Adversarial Attacks in Deepfake Detection: An Exploration of Perturbation and AI Techniques](https://mlsanity.com/paper/2302.11704/) (2023)
- [Tailoring Adversarial Attacks on Deep Neural Networks for Targeted Class Manipulation Using DeepFool Algorithm](https://mlsanity.com/paper/2310.13019/) (2023)
- [Evaluating Deep Learning Models and Adversarial Attacks on Accelerometer-Based Gesture Authentication](https://mlsanity.com/paper/2110.14597/) (2021)
- [Mole Recruitment: Poisoning of Image Classifiers via Selective Batch Sampling](https://mlsanity.com/paper/2303.17080/) (2023)
- [Manipulating Predictions over Discrete Inputs in Machine Teaching](https://mlsanity.com/paper/2401.17865/) (2024)
- [Stealthy Poisoning Attacks Bypass Defenses in Regression Settings](https://mlsanity.com/paper/2601.22308/) (2026)

## Abstract (arXiv)

Machine learning algorithms are vulnerable to poisoning attacks: An adversary can inject malicious points in the training dataset to influence the learning process and degrade the algorithm's performance. Optimal poisoning attacks have already been proposed to evaluate worst-case scenarios, modelling attacks as a bi-level optimization problem. Solving these problems is computationally demanding and has limited applicability for some models such as deep networks. In this paper we introduce a novel generative model to craft systematic poisoning attacks against machine learning classifiers generating adversarial training examples, i.e. samples that look like genuine data points but that degrade the classifier's accuracy when used for training. We propose a Generative Adversarial Net with three components: generator, discriminator, and the target classifier. This approach allows us to model naturally the detectability constrains that can be expected in realistic attacks and to identify the regions of the underlying data distribution that can be more vulnerable to data poisoning. Our experimental evaluation shows the effectiveness of our attack to compromise machine learning classifiers, including deep networks.