mlsanityData to 7 Oct 2026

Witches' Brew: Industrial Scale Data Poisoning via Gradient Matching

arXiv 2009.02276 ↗First posted 4 Sep 2020cs.CV cs.LGcited by 156

Not on the map. Why?

Cited by 65 in LLM safety and security, but placed by its own abstract, which didn’t fit.

Abstract (arXiv)

Data Poisoning attacks modify training data to maliciously control a model trained on such data. In this work, we focus on targeted poisoning attacks which cause a reclassification of an unmodified test image and as such breach model integrity. We consider a particularly malicious poisoning attack that is both "from scratch" and "clean label", meaning we analyze an attack that successfully works against new, randomly initialized models, and is nearly imperceptible to humans, all while perturbing only a small fraction of the training data. Previous poisoning attacks against deep neural networks in this setting have been limited in scope and success, working only in simplified settings or being prohibitively expensive for large datasets. The central mechanism of the new attack is matching the gradient direction of malicious examples. We analyze why this works, supplement with practical considerations. and show its threat to real-world practitioners, finding that it is the first poisoning method to cause targeted misclassification in modern deep networks trained from scratch on a full-sized, poisoned ImageNet dataset. Finally we demonstrate the limitations of existing defensive strategies against such an attack, concluding that data poisoning is a credible threat, even for large-scale deep learning systems.

Key facts. Cited by 156 papers in the map (data through 7 Oct 2026). First posted on arXiv 4 Sep 2020.

Builds on

No reference list yet.

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2021: 16; 2022: 34; 2023: 34; 2024: 34; 2025: 23; 2026: 15.

156 papers.

Sort:

By area:

  1. 2023Poisoning Web-Scale Training Datasets is Practicalcited by 276
  2. 2021Adversarial Examples Make Strong Poisonscited by 115
  3. 2024What is in Your Safe Data? Identifying Benign Data that Breaks Safetycited by 114
  4. 2023On the Exploitability of Instruction Tuningcited by 110
  5. 2021Sleeper Agent: Scalable Hidden Trigger Backdoors for Neural Networks Trained from Scratchcited by 98
  6. 2022Truth Serum: Poisoning Machine Learning Models to Reveal Their Secretscited by 94
  7. 2022Wild Patterns Reloaded: A Survey of Machine Learning Security against Training Data Poisoningcited by 93
  8. 2022Cramming: Training a Language Model on a Single GPU in One Daycited by 81
  9. 2022Untargeted Backdoor Watermark: Towards Harmless and Stealthy Dataset Copyright Protectioncited by 80
  10. 2023AntifakePrompt: Prompt-Tuned Vision-Language Models are Fake Image Detectorscited by 64
  11. 2021Availability Attacks Create Shortcutscited by 60
  12. 2021Better Safe Than Sorry: Preventing Delusive Adversaries with Adversarial Trainingcited by 58
38 more
  1. 2023Domain Watermark: Effective and Harmless Dataset Copyright Protection is Closed at Handcited by 52
  2. 2022Improved Certified Defenses against Data Poisoning with (Deterministic) Finite Aggregationcited by 50
  3. 2024Shadowcast: Stealthy Data Poisoning Attacks Against Vision-Language Modelscited by 48
  4. 2023TrojanPuzzle: Covertly Poisoning Code-Suggestion Modelscited by 47
  5. 2024Phantom: General Backdoor Attacks on Retrieval Augmented Language Generationcited by 46
  6. 2022Autoregressive Perturbations for Data Poisoningcited by 45
  7. 2021Defending against Model Stealing via Verifying Embedded External Featurescited by 44
  8. 2021Poison Forensics: Traceback of Data Poisoning Attacks in Neural Networkscited by 37
  9. 2022Hidden Poison: Machine Unlearning Enables Camouflaged Poisoning Attackscited by 37
  10. 2021Preventing Unauthorized Use of Proprietary Data: Poisoning for Secure Dataset Releasecited by 35
  11. 2024Machine Unlearning Fails to Remove Data Poisoning Attackscited by 35
  12. 2022Robust Unlearnable Examples: Protecting Data Against Adversarial Learningcited by 34
  13. 2024Threats, Attacks, and Defenses in Machine Unlearning: A Surveycited by 34
  14. 2021DP-InstaHide: Provably Defusing Poisoning and Backdoor Attacks with Differentially Private Data Augmentationscited by 33
  15. 2022PoisonedEncoder: Poisoning the Unlabeled Pre-training Data in Contrastive Learningcited by 33
  16. 2022Identifying a Training-Set Attack's Target Using Renormalized Influence Estimationcited by 32
  17. 2023Robust Contrastive Language-Image Pre-training against Data Poisoning and Backdoor Attackscited by 31
  18. 2021Defending Against Backdoor Attacks in Natural Language Generationcited by 30
  19. 2023Algorithmic Collective Action in Machine Learningcited by 30
  20. 2022Energy-Latency Attacks via Sponge Poisoningcited by 29
  21. 2022One-Pixel Shortcut: on the Learning Preference of Deep Neural Networkscited by 29
  22. 2022SNAP: Efficient Extraction of Private Properties with Poisoningcited by 29
  23. 2022Not All Poisons are Created Equal: Robust Training against Data Poisoningcited by 29
  24. 2024Teach LLMs to Phish: Stealing Private Information from Language Modelscited by 29
  25. 2023Label Poisoning is All You Needcited by 27
  26. 2024Scaling Trends for Data Poisoning in LLMscited by 26
  27. 2022Indiscriminate Data Poisoning Attacks on Neural Networkscited by 24
  28. 2023Stable Unlearnable Example: Enhancing the Robustness of Unlearnable Examples via Stable Error-Minimizing Noisecited by 23
  29. 2021What Doesn't Kill You Makes You Robust(er): How to Adversarially Train against Data Poisoningcited by 22
  30. 2022MOVE: Effective and Harmless Ownership Verification via Embedded External Featurescited by 20
  31. 2022Friendly Noise against Adversarial Noise: A Powerful Defense against Data Poisoning Attackscited by 20
  32. 2025Data Poisoning in Deep Learning: A Surveycited by 20
  33. 2022Robustly-reliable learners under poisoning attackscited by 19
  34. 2022Self-Ensemble Protection: Training Checkpoints Are Good Data Protectorscited by 19
  35. 2022BagFlip: A Certified Defense against Data Poisoningcited by 18
  36. 2023Towards more Practical Threat Models in Artificial Intelligence Securitycited by 17
  37. 2022An Equivalence Between Data Poisoning and Byzantine Gradient Attackscited by 16
  38. 2022On the Effectiveness of Adversarial Training against Backdoor Attackscited by 15

50 most cited of 156 All 156 (JSON)