mlsanityData to 7 Oct 2026

Strong Data Augmentation Sanitizes Poisoning and Backdoor Attacks Without an Accuracy Tradeoff

arXiv 2011.09527 ↗First posted 18 Nov 2020cs.CR cs.LGcited by 86

Not on the map. Why?

Cited by 28 in LLM safety and security, but placed by its own abstract, which didn’t fit.

Abstract (arXiv)

Data poisoning and backdoor attacks manipulate victim models by maliciously modifying training data. In light of this growing threat, a recent survey of industry professionals revealed heightened fear in the private sector regarding data poisoning. Many previous defenses against poisoning either fail in the face of increasingly strong attacks, or they significantly degrade performance. However, we find that strong data augmentations, such as mixup and CutMix, can significantly diminish the threat of poisoning and backdoor attacks without trading off performance. We further verify the effectiveness of this simple defense against adaptive poisoning methods, and we compare to baselines including the popular differentially private SGD (DP-SGD) defense. In the context of backdoors, CutMix greatly mitigates the attack while simultaneously increasing validation accuracy by 9%.

Key facts. Cited by 86 papers in the map (data through 7 Oct 2026). First posted on arXiv 18 Nov 2020.

Builds on

No reference list yet.

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2021: 15; 2022: 20; 2023: 21; 2024: 25; 2025: 3; 2026: 2.

86 papers.

Sort:

By area:

  1. 2021Adversarial Neuron Pruning Purifies Backdoored Deep Modelscited by 230
  2. 2021Adversarial Unlearning of Backdoors via Implicit Hypergradientcited by 160
  3. 2021Rethinking the Backdoor Attacks' Triggers: A Frequency Perspectivecited by 155
  4. 2022Backdoor Defense via Decoupling the Training Processcited by 149
  5. 2022Wild Patterns Reloaded: A Survey of Machine Learning Security against Training Data Poisoningcited by 93
  6. 2022Data-free Backdoor Removal based on Channel Lipschitznesscited by 77
  7. 2023CleanCLIP: Mitigating Data Poisoning Attacks in Multimodal Contrastive Learningcited by 62
  8. 2021Better Safe Than Sorry: Preventing Delusive Adversaries with Adversarial Trainingcited by 58
  9. 2023Detecting Backdoors in Pre-trained Encoderscited by 53
  10. 2021Poison Ink: Robust and Invisible Backdoor Attackcited by 50
  11. 2023Backdoor Defense via Adaptively Splitting Poisoned Datasetcited by 43
  12. 2021Poison Forensics: Traceback of Data Poisoning Attacks in Neural Networkscited by 37
38 more
  1. 2021DP-InstaHide: Provably Defusing Poisoning and Backdoor Attacks with Differentially Private Data Augmentationscited by 33
  2. 2024Immunization against harmful fine-tuning attackscited by 33
  3. 2023Robust Contrastive Language-Image Pre-training against Data Poisoning and Backdoor Attackscited by 31
  4. 2023Elijah: Eliminating Backdoors Injected in Diffusion Models via Distribution Shiftcited by 31
  5. 2022Not All Poisons are Created Equal: Robust Training against Data Poisoningcited by 29
  6. 2021Survey: Image Mixing and Deleting for Data Augmentationcited by 25
  7. 2022Imperceptible and Robust Backdoor Attack in 3D Point Cloudcited by 25
  8. 2023BackdoorBox: A Python Toolbox for Backdoor Learningcited by 25
  9. 2021Excess Capacity and Backdoor Poisoningcited by 24
  10. 2021What Doesn't Kill You Makes You Robust(er): How to Adversarially Train against Data Poisoningcited by 22
  11. 2022Friendly Noise against Adversarial Noise: A Powerful Defense against Data Poisoning Attackscited by 20
  12. 2023Distilling Cognitive Backdoor Patterns within an Imagecited by 20
  13. 2022Just Rotate it: Deploying Backdoor Attacks via Rotation Transformationcited by 19
  14. 2023Defending Against Patch-based Backdoor Attacks on Self-Supervised Learningcited by 19
  15. 2022Backdoor Cleansing with Unlabeled Datacited by 17
  16. 2023Run-Off Election: Improved Provable Defense against Data Poisoning Attackscited by 16
  17. 2022On the Effectiveness of Adversarial Training against Backdoor Attackscited by 15
  18. 2023BEAGLE: Forensics of Deep Learning Backdoor Attack for Better Defensecited by 15
  19. 2024Backdoor Secrets Unveiled: Identifying Backdoor Data with Optimized Scaled Prediction Consistencycited by 13
  20. 2024LOTUS: Evasive and Resilient Backdoor Attacks through Sub-Partitioningcited by 13
  21. 2022Can Adversarial Training Be Manipulated By Non-Robust Features?cited by 12
  22. 2022Trap and Replace: Defending Backdoor Attacks by Trapping Them into an Easy-to-Replace Subnetworkcited by 12
  23. 2022Backdoor Attack and Defense in Federated Generative Adversarial Network-based Medical Image Synthesiscited by 12
  24. 2024Trustworthy Distributed AI Systems: Robustness, Privacy, and Governancecited by 12
  25. 2024Generalization Bound and New Algorithm for Clean-Label Backdoor Attackcited by 11
  26. 2024ECLIPSE: Expunging Clean-label Indiscriminate Poisons via Sparse Diffusion Purificationcited by 9
  27. 2022FocusedCleaner: Sanitizing Poisoned Graphs for Robust GNN-based Node Classificationcited by 7
  28. 2023SoK: Unintended Interactions among Machine Learning Defenses and Riskscited by 6
  29. 2024Trustworthy Text-to-Image Diffusion Models: A Timely and Focused Surveycited by 6
  30. 2021EX-RAY: Distinguishing Injected Backdoor from Natural Features in Neural Networks by Examining Differential Feature Symmetrycited by 5
  31. 2021Backdoor Learning Curves: Explaining Backdoor Poisoning Beyond Influence Functionscited by 5
  32. 2022Augmentation Backdoorscited by 5
  33. 2024PSBD: Prediction Shift Uncertainty Unlocks Backdoor Detectioncited by 5
  34. 2025Fox in the Henhouse: Supply-Chain Backdoor Attacks Against Reinforcement Learningcited by 5
  35. 2021MISA: Online Defense of Trojaned Models using Misattributionscited by 4
  36. 2022Backdoors Stuck At The Frontdoor: Multi-Agent Backdoor Attacks That Backfirecited by 4
  37. 2022Low-Loss Subspace Compression for Clean Gains against Multi-Agent Backdoor Attackscited by 4
  38. 2023Towards Understanding How Self-training Tolerates Data Backdoor Poisoningcited by 4

50 most cited of 86 All 86 (JSON)