mlsanityData to 7 Oct 2026

What Doesn't Kill You Makes You Robust(er): How to Adversarially Train against Data Poisoning

arXiv 2102.13624 ↗First posted 26 Feb 2021cs.LG cs.CR cs.CVcited by 22

On the map: LLM safety and security → Backdoor and data poisoning attacks

Abstract (arXiv)

Data poisoning is a threat model in which a malicious actor tampers with training data to manipulate outcomes at inference time. A variety of defenses against this threat model have been proposed, but each suffers from at least one of the following flaws: they are easily overcome by adaptive attacks, they severely reduce testing performance, or they cannot generalize to diverse data poisoning threat models. Adversarial training, and its variants, are currently considered the only empirically strong defense against (inference-time) adversarial attacks. In this work, we extend the adversarial training framework to defend against (training-time) data poisoning, including targeted and backdoor attacks. Our method desensitizes networks to the effects of such attacks by creating poisons during training and injecting them into training batches. We show that this defense withstands adaptive attacks, generalizes to diverse threat models, and incurs a better performance trade-off than previous defenses such as DP-SGD or (evasion) adversarial training.

Key facts. Cited by 22 papers in the map (data through 7 Oct 2026). Placed in Backdoor and data poisoning attacks, one of 12 directions in LLM safety and security. Builds on 39 of its 50 references that are in the map. First posted on arXiv 26 Feb 2021.

Builds on

39 of 50 references.

References · 39

  1. 2015Deep Residual Learning for Image Recognitioncited by 51,809
  2. 2020Language Models are Few-Shot Learnerscited by 32,199
  3. 2014ImageNet Large Scale Visual Recognition Challengecited by 8,441
  4. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  5. 2017mixup: Beyond Empirical Risk Minimizationcited by 5,155
  6. 2019CutMix: Regularization Strategy to Train Strong Classifiers with Localizable Featurescited by 2,875
  7. 2016Deep Learning with Differential Privacycited by 2,682
  8. 2017Improved Regularization of Convolutional Neural Networks with Cutoutcited by 1,623
  9. 2015Spatial Transformer Networkscited by 1,423
  10. 2018Fine-Pruning: Defending Against Backdooring Attacks on Deep Neural Networkscited by 550
  11. 2020On Adaptive Attacks to Adversarial Example Defensescited by 547
  12. 2018Poison Frogs! Targeted Clean-Label Poisoning Attacks on Neural Networkscited by 500
27 more
  1. 2018Spectral Signatures in Backdoor Attackscited by 457
  2. 2019On Evaluating Adversarial Robustnesscited by 442
  3. 2019STRIP: A Defence Against Trojan Attacks on Deep Neural Networkscited by 437
  4. 2018Detecting Backdoor Attacks on Deep Neural Networks by Activation Clusteringcited by 429
  5. 2019Hidden Trigger Backdoor Attackscited by 359
  6. 2017Certifying Some Distributional Robustness with Principled Adversarial Trainingcited by 333
  7. 2019Detecting AI Trojans Using Meta Neural Analysiscited by 192
  8. 2020Dataset Security for Machine Learning: Data Poisoning, Backdoor Attacks, and Defensescited by 171
  9. 2020Witches' Brew: Industrial Scale Data Poisoning via Gradient Matchingcited by 156
  10. 2019Transferable Clean-Label Poisoning Attacks on Deep Neural Netscited by 129
  11. 2018Stronger Data Poisoning Attacks Break Data Sanitization Defensescited by 125
  12. 2020Adversarial Machine Learning -- Industry Perspectivescited by 121
  13. 2020RAB: Provable Robustness Against Backdoor Attackscited by 115
  14. 2020MetaPoison: Practical General-purpose Clean-label Data Poisoningcited by 114
  15. 2020Deep Partition Aggregation: Provable Defense against General Poisoning Attackscited by 112
  16. 2020Just How Toxic is Data Poisoning? A Unified Benchmark for Backdoor and Data Poisoning Attackscited by 109
  17. 2020Strong Data Augmentation Sanitizes Poisoning and Backdoor Attacks Without an Accuracy Tradeoffcited by 86
  18. 2020On the Effectiveness of Mitigating Data Poisoning Attacks with Gradient Shapingcited by 82
  19. 2019Data Poisoning against Differentially-Private Learners: Attacks and Defensescited by 75
  20. 2019Bypassing Backdoor Detection Algorithms in Deep Learningcited by 69
  21. 2020Bullseye Polytope: A Scalable Clean-Label Poisoning Attack with Improved Transferabilitycited by 65
  22. 2021Better Safe Than Sorry: Preventing Delusive Adversaries with Adversarial Trainingcited by 58
  23. 2020Adversarial Training against Location-Optimized Adversarial Patchescited by 50
  24. 2018Detection of Adversarial Training Examples in Poisoning Attacks through Anomaly Detectioncited by 43
  25. 2019REFIT: A Unified Watermark Removal Framework For Deep Learning Systems With Limited Datacited by 40
  26. 2020MaxUp: A Simple Way to Improve Generalization of Neural Network Trainingcited by 27
  27. 2020On Evaluating Neural Network Backdoor Defensescited by 4

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2021: 1; 2022: 1; 2023: 5; 2024: 9; 2025: 4; 2026: 2.

22 papers.

Sort:

By area:

  1. 2021Poison Ink: Robust and Invisible Backdoor Attackcited by 50
  2. 2024Shadowcast: Stealthy Data Poisoning Attacks Against Vision-Language Modelscited by 48
  3. 2024Immunization against harmful fine-tuning attackscited by 33
  4. 2023Better Safe than Sorry: Pre-training CLIP against Targeted Data Poisoning and Backdoor Attackscited by 19
  5. 2022On the Effectiveness of Adversarial Training against Backdoor Attackscited by 15
  6. 2024Towards Unified Robustness Against Both Backdoor and Adversarial Attackscited by 9
  7. 2025Adversarial Training for Defense Against Label Poisoning Attackscited by 5
  8. 2025Backdoor Collapse: Eliminating Unknown Threats via Known Backdoor Aggregation in Language Modelscited by 5
  9. 2024SEEP: Training Dynamics Grounds Latent Representation Search for Mitigating Backdoor Poisoning Attackscited by 3
  10. 2025Neuroplasticity and Corruption in Model Mechanisms: A Case Study Of Indirect Object Identificationcited by 3
  11. 2025Towards Unveiling Predictive Uncertainty Vulnerabilities in the Context of the Right to Be Forgottencited by 3
  12. 2024Clean Label Attacks against SLU Systemscited by 2
10 more
  1. 2023Mithridates: Auditing and Boosting Backdoor Resistance of Machine Learning Pipelinescited by 1
  2. 2023Pick your Poison: Undetectability versus Robustness in Data Poisoning Attackscited by 1
  3. 2023HINT: Healthy Influential-Noise based Training to Defend against Data Poisoning Attackscited by 1
  4. 2024Transparency Attacks: How Imperceptible Image Layers Can Fool AI Perceptioncited by 1
  5. 2024Certified Robustness to Clean-Label Poisoning Using Diffusion Denoisingcited by 1
  6. 2024Have You Poisoned My Data? Defending Neural Networks against Data Poisoningcited by 1
  7. 2026Safety-Efficacy Trade Off: Robustness against Data-Poisoningcited by 1
  8. 2023Projected Subnetworks Scale Adaptationcited by 0
  9. 2024Exploiting Alpha Transparency In Language And Vision-Based AI Systemscited by 0
  10. 2026SoK: A Comprehensive Analysis of the Current Status of Neural Tangent Generalization Attacks with Research Directionscited by 0