mlsanityData to 7 Oct 2026

Poisoning the Unlabeled Dataset of Semi-Supervised Learning

arXiv 2105.01622 ↗First posted 4 May 2021cs.LG cs.CR cs.CVcited by 44

Not on the map. Why?

Abstract (arXiv)

Semi-supervised machine learning models learn from a (small) set of labeled training examples, and a (large) set of unlabeled training examples. State-of-the-art models can reach within a few percentage points of fully-supervised training, while requiring 100x less labeled data. We study a new class of vulnerabilities: poisoning attacks that modify the unlabeled dataset. In order to be useful, unlabeled datasets are given strictly less review than labeled datasets, and adversaries can therefore poison them easily. By inserting maliciously-crafted unlabeled examples totaling just 0.1% of the dataset size, we can manipulate a model trained on this poisoned dataset to misclassify arbitrary examples at test time (as any desired label). Our attacks are highly effective across datasets and semi-supervised learning methods. We find that more accurate methods (thus more likely to be used) are significantly more vulnerable to poisoning attacks, and as such better training methods are unlikely to prevent this attack. To counter this we explore the space of defenses, and propose two methods that mitigate our attack.

Key facts. Cited by 44 papers in the map (data through 7 Oct 2026). Builds on 42 of its 72 references that are in the map. First posted on arXiv 4 May 2021.

Builds on

42 of 72 references.

References · 42

  1. 2015Deep Residual Learning for Image Recognitioncited by 51,809
  2. 2014Adam: A Method for Stochastic Optimizationcited by 36,960
  3. 2014ImageNet Large Scale Visual Recognition Challengecited by 8,441
  4. 2017mixup: Beyond Empirical Risk Minimizationcited by 5,155
  5. 2013Intriguing properties of neural networkscited by 5,114
  6. 2016Deep Learning with Differential Privacycited by 2,682
  7. 2016Membership Inference Attacks against Machine Learning Modelscited by 2,221
  8. 2020FixMatch: Simplifying Semi-Supervised Learning with Consistency and Confidencecited by 2,080
  9. 2015Unsupervised Representation Learning with Deep Convolutional Generative Adversarial Networkscited by 2,048
  10. 2020Shortcut Learning in Deep Neural Networkscited by 1,928
  11. 2017Understanding Black-box Predictions via Influence Functionscited by 1,714
  12. 2016Understanding deep learning requires rethinking generalizationcited by 1,657
30 more
  1. 2017Improved Regularization of Convolutional Neural Networks with Cutoutcited by 1,623
  2. 2019Do ImageNet Classifiers Generalize to ImageNet?cited by 1,507
  3. 2019MixMatch: A Holistic Approach to Semi-Supervised Learningcited by 1,390
  4. 2016On Large-Batch Training for Deep Learning: Generalization Gap and Sharp Minimacited by 1,337
  5. 2019Self-training with Noisy Student improves ImageNet classificationcited by 1,304
  6. 2019Unsupervised Data Augmentation for Consistency Trainingcited by 1,057
  7. 2016Temporal Ensembling for Semi-Supervised Learningcited by 1,054
  8. 2017BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chaincited by 1,052
  9. 2017Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoningcited by 1,012
  10. 2019Adversarial Examples Are Not Bugs, They Are Featurescited by 950
  11. 2017Virtual Adversarial Training: A Regularization Method for Supervised and Semi-Supervised Learningcited by 918
  12. 2018The Secret Sharer: Evaluating and Testing Unintended Memorization in Neural Networkscited by 847
  13. 2017Evasion Attacks against Machine Learning at Test Timecited by 686
  14. 2018Exploring the Limits of Weakly Supervised Pretrainingcited by 604
  15. 2018Fine-Pruning: Defending Against Backdooring Attacks on Deep Neural Networkscited by 550
  16. 2018Poison Frogs! Targeted Clean-Label Poisoning Attacks on Neural Networkscited by 500
  17. 2020Measuring Robustness to Natural Distribution Shifts in Image Classificationcited by 452
  18. 2020Reflection Backdoor: A Natural Backdoor Attack on Deep Neural Networkscited by 341
  19. 2017Certified Defenses for Data Poisoning Attackscited by 288
  20. 2019Label-Consistent Backdoor Attackscited by 285
  21. 2019Adversarial Examples Improve Image Recognitioncited by 283
  22. 2020A Simple Semi-Supervised Learning Framework for Object Detectioncited by 282
  23. 2018Manipulating Machine Learning: Poisoning Attacks and Countermeasures for Regression Learningcited by 219
  24. 2020Improved Noisy Student Training for Automatic Speech Recognitioncited by 139
  25. 2019Transferable Clean-Label Poisoning Attacks on Deep Neural Netscited by 129
  26. 2020You Autocomplete Me: Poisoning Vulnerabilities in Neural Code Completioncited by 112
  27. 2020On the Effectiveness of Mitigating Data Poisoning Attacks with Gradient Shapingcited by 82
  28. 2019A Unified Framework for Data Poisoning Attack to Graph-based Semi-supervised Learningcited by 30
  29. 2018Is Data Clustering in Adversarial Settings Secure?cited by 16
  30. 2018Poisoning Behavioral Malware Clusteringcited by 14

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2021: 3; 2022: 9; 2023: 17; 2024: 9; 2025: 3; 2026: 3.

44 papers.

Sort:

By area:

  1. 2023Trustworthy LLMs: a Survey and Guideline for Evaluating Large Language Models' Alignmentcited by 394
  2. 2023Poisoning Web-Scale Training Datasets is Practicalcited by 276
  3. 2023Poisoning Language Models During Instruction Tuningcited by 254
  4. 2024PoisonedRAG: Knowledge Corruption Attacks to Retrieval-Augmented Generation of Large Language Modelscited by 251
  5. 2021Poisoning and Backdooring Contrastive Learningcited by 149
  6. 2022"Real Attackers Don't Compute Gradients": Bridging the Gap Between Adversarial ML Research and Practicecited by 55
  7. 2023Privacy Side Channels in Machine Learning Systemscited by 38
  8. 2021Poison Forensics: Traceback of Data Poisoning Attacks in Neural Networkscited by 37
  9. 2022PoisonedEncoder: Poisoning the Unlabeled Pre-training Data in Contrastive Learningcited by 33
  10. 2024ConfusedPilot: Confused Deputy Risks in RAG-based LLMscited by 22
  11. 2023Backdoor Attacks Against Dataset Distillationcited by 20
  12. 2023Better Safe than Sorry: Pre-training CLIP against Targeted Data Poisoning and Backdoor Attackscited by 19
32 more
  1. 2023Towards more Practical Threat Models in Artificial Intelligence Securitycited by 17
  2. 2022SoK: The Impact of Unlabelled Data in Cyberthreat Detectioncited by 15
  3. 2024Preference Poisoning Attacks on Reward Model Learningcited by 14
  4. 2022Trap and Replace: Defending Backdoor Attacks by Trapping Them into an Easy-to-Replace Subnetworkcited by 12
  5. 2023Uncovering Adversarial Risks of Test-Time Adaptationcited by 12
  6. 2023Temporal Robustness against Data Poisoningcited by 10
  7. 2021SoK: Machine Learning Governancecited by 9
  8. 2024Robust Semi-Supervised Learning in Open Environmentscited by 8
  9. 2022Multi-SpacePhish: Extending the Evasion-space of Adversarial Attacks against Phishing Website Detectors using Machine Learningcited by 7
  10. 2022Semi-WTC: A Practical Semi-supervised Framework for Attack Categorization through Weight-Task Consistencycited by 6
  11. 2023Self-Deception: Reverse Penetrating the Semantic Firewall of Large Language Modelscited by 6
  12. 2022Wild Networks: Exposure of 5G Network Infrastructures to Adversarial Examplescited by 5
  13. 2023Ensemble Active Learning by Contextual Bandits for AI Incubation in Manufacturingcited by 5
  14. 2024Not All Prompts Are Secure: A Switchable Backdoor Attack Against Pre-trained Vision Transformerscited by 5
  15. 2022Pre-trained Encoders in Self-Supervised Learning Improve Secure and Privacy-preserving Supervised Learningcited by 4
  16. 2023Prompt Backdoors in Visual Prompt Learningcited by 4
  17. 2024SiNC+: Adaptive Camera-Based Vitals with Unsupervised Learning of Periodic Signalscited by 2
  18. 2023Mithridates: Auditing and Boosting Backdoor Resistance of Machine Learning Pipelinescited by 1
  19. 2023Pruning the Unlabeled Data to Improve Semi-Supervised Learningcited by 1
  20. 2024Private Knowledge Sharing in Distributed Learning: A Surveycited by 1
  21. 2024Certified Robustness to Clean-Label Poisoning Using Diffusion Denoisingcited by 1
  22. 2025Securing AI Systems: A Guide to Known Attacks and Impactscited by 1
  23. 2025How to Securely Shuffle? A survey about Secure Shufflers for privacy-preserving computationscited by 1
  24. 2022Rethinking Backdoor Data Poisoning Attacks in the Context of Semi-Supervised Learningcited by 0
  25. 2023Geometric Algorithms for k-NN Poisoningcited by 0
  26. 2023Trustworthy Large Models in Vision: A Surveycited by 0
  27. 2023Eroding Trust In Aerial Imagery: Comprehensive Analysis and Evaluation Of Adversarial Attacks In Geospatial Systemscited by 0
  28. 2024Defending Against Repetitive Backdoor Attacks on Semi-supervised Learning through Lens of Rate-Distortion-Perception Trade-offcited by 0
  29. 2025Char-mander Use mBackdoor! A Study of Cross-lingual Backdoor Attacks in Multilingual LLMscited by 0
  30. 2026Anti-Backdoor Coreset Selection via Cumulative Entropycited by 0
  31. 2026When the World Lies: Backdoor Attacks on Latent World Models for Downstream Controlcited by 0
  32. 2026Region-Level Black-Box Defense Against Stealthy Embedding-Space Backdoors in CLIPcited by 0