mlsanityData to 7 Oct 2026

Bullseye Polytope: A Scalable Clean-Label Poisoning Attack with Improved Transferability

arXiv 2005.00191 ↗First posted 1 May 2020cs.LG cs.CR stat.MLcited by 65

Not on the map. Why?

Cited by 36 in LLM safety and security, but placed by its own abstract, which didn’t fit.

Abstract (arXiv)

A recent source of concern for the security of neural networks is the emergence of clean-label dataset poisoning attacks, wherein correctly labeled poison samples are injected into the training dataset. While these poison samples look legitimate to the human observer, they contain malicious characteristics that trigger a targeted misclassification during inference. We propose a scalable and transferable clean-label poisoning attack against transfer learning, which creates poison images with their center close to the target image in the feature space. Our attack, Bullseye Polytope, improves the attack success rate of the current state-of-the-art by 26.75% in end-to-end transfer learning, while increasing attack speed by a factor of 12. We further extend Bullseye Polytope to a more practical attack model by including multiple images of the same object (e.g., from different angles) when crafting the poison samples. We demonstrate that this extension improves attack transferability by over 16% to unseen images (of the same object) without using extra poison samples.

Key facts. Cited by 65 papers in the map (data through 7 Oct 2026). First posted on arXiv 1 May 2020.

Builds on

No reference list yet.

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2021: 10; 2022: 13; 2023: 12; 2024: 18; 2025: 10; 2026: 2.

65 papers.

Sort:

By area:

  1. 2024What is in Your Safe Data? Identifying Benign Data that Breaks Safetycited by 114
  2. 2022Wild Patterns Reloaded: A Survey of Machine Learning Security against Training Data Poisoningcited by 93
  3. 2023Nightshade: Prompt-Specific Poisoning Attacks on Text-to-Image Generative Modelscited by 72
  4. 2021Better Safe Than Sorry: Preventing Delusive Adversaries with Adversarial Trainingcited by 58
  5. 2022Improved Certified Defenses against Data Poisoning with (Deterministic) Finite Aggregationcited by 50
  6. 2023TrojanPuzzle: Covertly Poisoning Code-Suggestion Modelscited by 47
  7. 2021The Threat of Offensive AI to Organizationscited by 37
  8. 2021Poison Forensics: Traceback of Data Poisoning Attacks in Neural Networkscited by 37
  9. 2022Hidden Poison: Machine Unlearning Enables Camouflaged Poisoning Attackscited by 37
  10. 2024Test-Time Backdoor Attacks on Multimodal Large Language Modelscited by 35
  11. 2024Machine Unlearning Fails to Remove Data Poisoning Attackscited by 35
  12. 2021DP-InstaHide: Provably Defusing Poisoning and Backdoor Attacks with Differentially Private Data Augmentationscited by 33
38 more
  1. 2022Not All Poisons are Created Equal: Robust Training against Data Poisoningcited by 29
  2. 2022Indiscriminate Data Poisoning Attacks on Neural Networkscited by 24
  3. 2021ML Attack Models: Adversarial Attacks and Data Poisoning Attackscited by 23
  4. 2023Exploring the Limits of Model-Targeted Indiscriminate Data Poisoning Attackscited by 23
  5. 2021What Doesn't Kill You Makes You Robust(er): How to Adversarially Train against Data Poisoningcited by 22
  6. 2022Friendly Noise against Adversarial Noise: A Powerful Defense against Data Poisoning Attackscited by 20
  7. 2025Data Poisoning in Deep Learning: A Surveycited by 20
  8. 2022BagFlip: A Certified Defense against Data Poisoningcited by 18
  9. 2024AI Risk Management Should Incorporate Both Safety and Securitycited by 17
  10. 2022An Equivalence Between Data Poisoning and Byzantine Gradient Attackscited by 16
  11. 2022Few-shot Backdoor Attacks via Neural Tangent Kernelscited by 15
  12. 2022Low-Rank Softmax Can Have Unargmaxable Classes in Theory but Rarely in Practicecited by 14
  13. 2022Lethal Dose Conjecture on Data Poisoningcited by 12
  14. 2021Sample Efficient Detection and Classification of Adversarial Attacks via Self-Supervised Embeddingscited by 11
  15. 2023Taming the Sigmoid Bottleneck: Provably Argmaxable Sparse Multi-Label Classificationcited by 11
  16. 2021Accumulative Poisoning Attacks on Real-time Datacited by 10
  17. 2023Temporal Robustness against Data Poisoningcited by 10
  18. 2024Disguised Copyright Infringement of Latent Diffusion Modelscited by 10
  19. 2024Indiscriminate Data Poisoning Attacks on Pre-trained Feature Extractorscited by 8
  20. 2021Disrupting Model Training with Adversarial Shortcutscited by 7
  21. 2022The MeVer DeepFake Detection Service: Lessons Learnt from Developing and Deploying in the Wildcited by 6
  22. 2023PECAN: A Deterministic Certified Defense Against Backdoor Attackscited by 5
  23. 2023Transferable Availability Poisoning Attackscited by 5
  24. 2024A Backdoor Approach with Inverted Labels Using Dirty Label-Flipping Attackscited by 4
  25. 2024Clean-Label Physical Backdoor Attacks with Data Distillationcited by 4
  26. 2026Infusion: Shaping Model Behavior by Editing Training Data via Influence Functionscited by 4
  27. 2024PureGen: Universal Data Purification for Train-Time Poison Defense via Generative Model Dynamicscited by 3
  28. 2024UTrace: Poisoning Forensics for Private Collaborative Learningcited by 3
  29. 2024BridgePure: Limited Protection Leakage Can Break Black-Box Data Protectioncited by 3
  30. 2025Circumventing Safety Alignment in Large Language Models Through Embedding Space Toxicity Attenuationcited by 2
  31. 2025Provable Watermarking for Data Poisoning Attackscited by 2
  32. 2021CatchBackdoor: Backdoor Detection via Critical Trojan Neural Path Fuzzingcited by 1
  33. 2023Pick your Poison: Undetectability versus Robustness in Data Poisoning Attackscited by 1
  34. 2023On Practical Aspects of Aggregation Defenses against Data Poisoning Attackscited by 1
  35. 2023A reading survey on adversarial machine learning: Adversarial attacks and their understandingcited by 1
  36. 2023HINT: Healthy Influential-Noise based Training to Defend against Data Poisoning Attackscited by 1
  37. 2024Certified Robustness to Clean-Label Poisoning Using Diffusion Denoisingcited by 1
  38. 2024Have You Poisoned My Data? Defending Neural Networks against Data Poisoningcited by 1

50 most cited of 65 All 65 (JSON)