mlsanityData to 7 Oct 2026

MetaPoison: Practical General-purpose Clean-label Data Poisoning

arXiv 2004.00225 ↗First posted 1 Apr 2020cs.LG cs.AI cs.CRcited by 114

Not on the map. Why?

Cited by 45 in LLM safety and security, but placed by its own abstract, which didn’t fit.

Abstract (arXiv)

Data poisoning -- the process by which an attacker takes control of a model by making imperceptible changes to a subset of the training data -- is an emerging threat in the context of neural networks. Existing attacks for data poisoning neural networks have relied on hand-crafted heuristics, because solving the poisoning problem directly via bilevel optimization is generally thought of as intractable for deep models. We propose MetaPoison, a first-order method that approximates the bilevel problem via meta-learning and crafts poisons that fool neural networks. MetaPoison is effective: it outperforms previous clean-label poisoning methods by a large margin. MetaPoison is robust: poisoned data made for one model transfer to a variety of victim models with unknown training settings and architectures. MetaPoison is general-purpose, it works not only in fine-tuning scenarios, but also for end-to-end training from scratch, which till now hasn't been feasible for clean-label attacks with deep nets. MetaPoison can achieve arbitrary adversary goals -- like using poisons of one class to make a target image don the label of another arbitrarily chosen class. Finally, MetaPoison works in the real-world. We demonstrate for the first time successful data poisoning of models trained on the black-box Google Cloud AutoML API. Code and premade poisons are provided at https://github.com/wronnyhuang/metapoison

Key facts. Cited by 114 papers in the map (data through 7 Oct 2026). First posted on arXiv 1 Apr 2020.

Builds on

No reference list yet.

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2021: 17; 2022: 22; 2023: 24; 2024: 29; 2025: 12; 2026: 10.

114 papers.

Sort:

By area:

  1. 2023Poisoning Web-Scale Training Datasets is Practicalcited by 276
  2. 2023Poisoning Language Models During Instruction Tuningcited by 254
  3. 2021Adversarial Examples Make Strong Poisonscited by 115
  4. 2023On the Exploitability of Instruction Tuningcited by 110
  5. 2021Sleeper Agent: Scalable Hidden Trigger Backdoors for Neural Networks Trained from Scratchcited by 98
  6. 2022Wild Patterns Reloaded: A Survey of Machine Learning Security against Training Data Poisoningcited by 93
  7. 2021Revisiting and Advancing Fast Adversarial Training Through The Lens of Bi-Level Optimizationcited by 75
  8. 2021Better Safe Than Sorry: Preventing Delusive Adversaries with Adversarial Trainingcited by 58
  9. 2022Advancing Model Pruning via Bi-level Optimizationcited by 55
  10. 2023Unveiling Security, Privacy, and Ethical Concerns of ChatGPTcited by 53
  11. 2021Hard to Forget: Poisoning Attacks on Certified Machine Unlearningcited by 47
  12. 2023TrojanPuzzle: Covertly Poisoning Code-Suggestion Modelscited by 47
38 more
  1. 2023MetaCloak: Preventing Unauthorized Subject-driven Text-to-image Diffusion-based Synthesis via Meta-learningcited by 42
  2. 2023Image Shortcut Squeezing: Countering Perturbative Availability Poisons with Compressioncited by 39
  3. 2023An Introduction to Bi-level Optimization: Foundations and Applications in Signal Processing and Machine Learningcited by 39
  4. 2021Poison Forensics: Traceback of Data Poisoning Attacks in Neural Networkscited by 37
  5. 2022Hidden Poison: Machine Unlearning Enables Camouflaged Poisoning Attackscited by 37
  6. 2021Preventing Unauthorized Use of Proprietary Data: Poisoning for Secure Dataset Releasecited by 35
  7. 2022Unlearnable Clusters: Towards Label-agnostic Unlearnable Examplescited by 35
  8. 2024Machine Unlearning Fails to Remove Data Poisoning Attackscited by 35
  9. 2021DP-InstaHide: Provably Defusing Poisoning and Backdoor Attacks with Differentially Private Data Augmentationscited by 33
  10. 2022Identifying a Training-Set Attack's Target Using Renormalized Influence Estimationcited by 32
  11. 2022Marksman Backdoor: Backdoor Attacks with Arbitrary Target Classcited by 32
  12. 2021Defending Against Backdoor Attacks in Natural Language Generationcited by 30
  13. 2022LoMar: A Local Defense Against Poisoning Attack on Federated Learningcited by 29
  14. 2022One-Pixel Shortcut: on the Learning Preference of Deep Neural Networkscited by 29
  15. 2022Not All Poisons are Created Equal: Robust Training against Data Poisoningcited by 29
  16. 2022Amplifying Membership Exposure via Data Poisoningcited by 29
  17. 2024Corrective Machine Unlearningcited by 26
  18. 2024Scaling Trends for Data Poisoning in LLMscited by 26
  19. 2022One-shot Neural Backdoor Erasing via Adversarial Weight Maskingcited by 25
  20. 2022Indiscriminate Data Poisoning Attacks on Neural Networkscited by 24
  21. 2021What Doesn't Kill You Makes You Robust(er): How to Adversarially Train against Data Poisoningcited by 22
  22. 2024Adversarial Attacks of Vision Tasks in the Past 10 Years: A Surveycited by 22
  23. 2022Friendly Noise against Adversarial Noise: A Powerful Defense against Data Poisoning Attackscited by 20
  24. 2024Noisy Neighbors: Efficient membership inference attacks against LLMscited by 20
  25. 2025Data Poisoning in Deep Learning: A Surveycited by 20
  26. 2022Self-Ensemble Protection: Training Checkpoints Are Good Data Protectorscited by 19
  27. 2024AI Risk Management Should Incorporate Both Safety and Securitycited by 17
  28. 2024Poison-splat: Computation Cost Attack on 3D Gaussian Splattingcited by 17
  29. 2022An Equivalence Between Data Poisoning and Byzantine Gradient Attackscited by 16
  30. 2022Few-shot Backdoor Attacks via Neural Tangent Kernelscited by 15
  31. 2024Preference Poisoning Attacks on Reward Model Learningcited by 14
  32. 2023Detection and Defense of Unlearnable Examplescited by 13
  33. 2021Understanding the Limits of Unsupervised Domain Adaptation via Data Poisoningcited by 11
  34. 2022RoCourseNet: Distributionally Robust Training of a Prediction Aware Recourse Modelcited by 11
  35. 2024Memory-Efficient Gradient Unrolling for Large-Scale Bi-level Optimizationcited by 11
  36. 2021Accumulative Poisoning Attacks on Real-time Datacited by 10
  37. 2021Going Grayscale: The Road to Understanding and Improving Unlearnable Examplescited by 10
  38. 2024Towards Modeling Uncertainties of Self-explaining Neural Networks via Conformal Predictioncited by 10

50 most cited of 114 All 114 (JSON)