Data to 7 Oct 2026

Intrinsic Certified Robustness of Bagging against Data Poisoning Attacks

arXiv 2008.04495 ↗First posted 11 Aug 2020cs.CR cs.LGcited by 90

Not on the map. Why?

Cited by 28 in LLM safety and security, but placed by its own abstract, which didn’t fit.

Abstract (arXiv)

In a data poisoning attack, an attacker modifies, deletes, and/or inserts some training examples to corrupt the learnt machine learning model. Bootstrap Aggregating (bagging) is a well-known ensemble learning method, which trains multiple base models on random subsamples of a training dataset using a base learning algorithm and uses majority vote to predict labels of testing examples. We prove the intrinsic certified robustness of bagging against data poisoning attacks. Specifically, we show that bagging with an arbitrary base learning algorithm provably predicts the same label for a testing example when the number of modified, deleted, and/or inserted training examples is bounded by a threshold. Moreover, we show that our derived threshold is tight if no assumptions on the base learning algorithm are made. We evaluate our method on MNIST and CIFAR10. For instance, our method achieves a certified accuracy of 91.1% on MNIST when arbitrarily modifying, deleting, and/or inserting 100 training examples. Code is available at: urlhttps://github.com/jjy1994/BaggingCertifyDataPoisoning.

Key facts. Cited by 90 papers in the map (data through 7 Oct 2026). First posted on arXiv 11 Aug 2020.

Builds on

No reference list yet.

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2021: 15; 2022: 18; 2023: 20; 2024: 14; 2025: 17; 2026: 6.

90 papers.

Sort:

By area:

2024PoisonedRAG: Knowledge Corruption Attacks to Retrieval-Augmented Generation of Large Language Modelscited by 251
2021Adversarial Unlearning of Backdoors via Implicit Hypergradientcited by 160
2021Rethinking the Backdoor Attacks' Triggers: A Frequency Perspectivecited by 155
2021BadEncoder: Backdoor Attacks to Pre-trained Encoders in Self-Supervised Learningcited by 120
2021Hidden Backdoors in Human-Centric Language Modelscited by 83
2023Nightshade: Prompt-Specific Poisoning Attacks on Text-to-Image Generative Modelscited by 72
2021Provably Secure Federated Learning against Malicious Clientscited by 60
2022Improved Certified Defenses against Data Poisoning with (Deterministic) Finite Aggregationcited by 50
2021PointGuard: Provably Robust 3D Point Cloud Classificationcited by 49
2021SparseFed: Mitigating Model Poisoning Attacks in Federated Learning with Sparsificationcited by 46
2021Data Poisoning Attacks to Deep Learning Based Recommender Systemscited by 41
2021Poison Forensics: Traceback of Data Poisoning Attacks in Neural Networkscited by 37

38 more

2025Practical Poisoning Attacks against Retrieval-Augmented Generationcited by 35
2022PoisonedEncoder: Poisoning the Unlabeled Pre-training Data in Contrastive Learningcited by 33
2022Identifying a Training-Set Attack's Target Using Renormalized Influence Estimationcited by 32
2022FLCert: Provably Secure Federated Learning against Poisoning Attackscited by 29
2022CorruptEncoder: Data Poisoning based Backdoor Attacks to Contrastive Learningcited by 28
2022A Comprehensive Study of the Robustness for LiDAR-based 3D Object Detectors against Adversarial Attackscited by 22
2021Certifying Robustness to Programmable Data Bias in Decision Treescited by 21
2022BagFlip: A Certified Defense against Data Poisoningcited by 18
2023The Dataset Multiplicity Problem: How Unreliable Data Impacts Predictionscited by 17
2023Run-Off Election: Improved Provable Defense against Data Poisoning Attackscited by 16
2023ERASER: Machine Unlearning in MLaaS via an Inference Serving-Aware Approachcited by 15
2022On Optimal Learning Under Targeted Data Poisoningcited by 14
2023Rethinking Backdoor Attackscited by 14
2023TextGuard: Provable Defense against Backdoor Attacks on Text Classificationcited by 14
2021Learning and Certification under Instance-targeted Poisoningcited by 13
2022Lethal Dose Conjecture on Data Poisoningcited by 12
2022Unraveling the Connections between Privacy and Certified Robustness in Federated Learning Against Poisoning Attackscited by 12
2022XRand: Differentially Private Defense against Explanation-Guided Attackscited by 11
2023Temporal Robustness against Data Poisoningcited by 10
2021Towards a Robust and Trustworthy Machine Learning System Development: An Engineering Perspectivecited by 9
2023PORE: Provably Robust Recommender Systems against Data Poisoning Attackscited by 9
2023Hierarchical Randomized Smoothingcited by 9
2023Node-aware Bi-smoothing: Certified Robustness against Graph Injection Attackscited by 8
2022Reducing Certified Regression to Certified Classification for General Poisoning Attackscited by 7
2021Understanding the Security of Deepfake Detectioncited by 6
2022COLLIDER: A Robust Training Framework for Backdoor Datacited by 6
2023Enhancing the Antidote: Improved Pointwise Certifications against Poisoning Attackscited by 6
202110 Security and Privacy Problems in Large Foundation Modelscited by 5
2022SafeNet: The Unreasonable Effectiveness of Ensembles in Private Collaborative Learningcited by 5
2023PECAN: A Deterministic Certified Defense Against Backdoor Attackscited by 5
2024Provable Robustness of (Graph) Neural Networks Against Data Poisoning and Backdoor Attackscited by 5
2024Oblivious Defense in ML Models: Backdoor Removal without Detectioncited by 5
2025CtrlRAG: Black-box Document Poisoning Attacks for Retrieval-Augmented Generation of Large Language Modelscited by 5
2022Pre-trained Encoders in Self-Supervised Learning Improve Secure and Privacy-preserving Supervised Learningcited by 4
2024Mudjacking: Patching Backdoor Vulnerabilities in Foundation Modelscited by 4
2024MMCert: Provable Defense against Adversarial Attacks to Multi-modal Modelscited by 4
2025Cert-SSBD: Certified Backdoor Defense with Sample-Specific Smoothing Noisescited by 4
2022Certifying Data-Bias Robustness in Linear Regressioncited by 3

50 most cited of 90 All 90 (JSON)