mlsanityData to 14 Oct 2026

Adversarial Examples Make Strong Poisons

arXiv 2106.10807 ↗First posted 21 Jun 2021cs.LG cs.CRcited by 119

Not on the map. Why?

Cited by 28 in LLM safety and security, but placed by its own abstract, which didn’t fit.

Abstract (arXiv)

The adversarial machine learning literature is largely partitioned into evasion attacks on testing data and poisoning attacks on training data. In this work, we show that adversarial examples, originally intended for attacking pre-trained models, are even more effective for data poisoning than recent methods designed specifically for poisoning. Our findings indicate that adversarial examples, when assigned the original label of their natural base image, cannot be used to train a classifier for natural images. Furthermore, when adversarial examples are assigned their adversarial class label, they are useful for training. This suggests that adversarial examples contain useful semantic content, just with the ``wrong'' labels (according to a network, but not a human). Our method, adversarial poisoning, is substantially more effective than existing poisoning methods for secure dataset release, and we release a poisoned version of ImageNet, ImageNet-P, to encourage research into the strength of this form of data obfuscation.

Key facts. Cited by 119 papers in the map (data through 14 Oct 2026). Builds on 43 of its 56 references that are in the map. First posted on arXiv 21 Jun 2021.

Builds on

43 of 56 references.

References · 43

  1. 2015Deep Residual Learning for Image Recognitioncited by 52,096
  2. 2020Language Models are Few-Shot Learnerscited by 32,419
  3. 2014Very Deep Convolutional Networks for Large-Scale Image Recognitioncited by 15,364
  4. 2014ImageNet Large Scale Visual Recognition Challengecited by 8,498
  5. 2014Explaining and Harnessing Adversarial Examplescited by 7,364
  6. 2016Densely Connected Convolutional Networkscited by 6,720
  7. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,415
  8. 2017mixup: Beyond Empirical Risk Minimizationcited by 5,183
  9. 2013Intriguing properties of neural networkscited by 5,155
  10. 2018MobileNetV2: Inverted Residuals and Linear Bottleneckscited by 4,795
  11. 2014Going Deeper with Convolutionscited by 4,241
  12. 2016Towards Evaluating the Robustness of Neural Networkscited by 2,998
31 more
  1. 2019CutMix: Regularization Strategy to Train Strong Classifiers with Localizable Featurescited by 2,884
  2. 2016Deep Learning with Differential Privacycited by 2,728
  3. 2017Understanding Black-box Predictions via Influence Functionscited by 1,741
  4. 2017Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoningcited by 1,055
  5. 2019Adversarial Examples Are Not Bugs, They Are Featurescited by 953
  6. 2019Towards Federated Learning at Scale: System Designcited by 832
  7. 2018How To Backdoor Federated Learningcited by 765
  8. 2018AutoAugment: Learning Augmentation Policies from Datacited by 730
  9. 2014Learning Face Representation from Scratchcited by 453
  10. 2016Learning from Simulated and Unsupervised Images through Adversarial Trainingcited by 288
  11. 2020Influence Functions in Deep Learning Are Fragilecited by 252
  12. 2017Towards Poisoning of Deep Learning Algorithms with Back-gradient Optimizationcited by 197
  13. 2021Unlearnable Examples: Making Personal Data Unexploitablecited by 193
  14. 2017Generating Natural Adversarial Examplescited by 183
  15. 2020Dataset Security for Machine Learning: Data Poisoning, Backdoor Attacks, and Defensescited by 180
  16. 2018Disentangling Adversarial Robustness and Generalizationcited by 172
  17. 2020Witches' Brew: Industrial Scale Data Poisoning via Gradient Matchingcited by 163
  18. 2018Stronger Data Poisoning Attacks Break Data Sanitization Defensescited by 135
  19. 2019Adversarially Robust Distillationcited by 125
  20. 2019Zero-Shot Knowledge Distillation in Deep Networkscited by 121
  21. 2020MetaPoison: Practical General-purpose Clean-label Data Poisoningcited by 120
  22. 2021Sleeper Agent: Scalable Hidden Trigger Backdoors for Neural Networks Trained from Scratchcited by 102
  23. 2021LowKey: Leveraging Adversarial Attacks to Protect Social Media Users from Facial Recognitioncited by 94
  24. 2018Is feature selection secure against training data poisoning?cited by 93
  25. 2020On the Effectiveness of Mitigating Data Poisoning Attacks with Gradient Shapingcited by 83
  26. 2019Learning to Confuse: Generating Training Time Adversarial Data with Auto-Encodercited by 70
  27. 2020Influence Function based Data Poisoning Attacks to Top-N Recommender Systemscited by 63
  28. 2019An Alternative Surrogate Loss for PGD-based Adversarial Testingcited by 45
  29. 2018On the Geometry of Adversarial Examplescited by 43
  30. 2021Preventing Unauthorized Use of Proprietary Data: Poisoning for Secure Dataset Releasecited by 35
  31. 2021DP-InstaHide: Provably Defusing Poisoning and Backdoor Attacks with Differentially Private Data Augmentationscited by 34

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2021: 4; 2022: 20; 2023: 26; 2024: 39; 2025: 15; 2026: 15.

119 papers.

Sort:

By area:

  1. 2022Training Data Influence Analysis and Estimation: A Surveycited by 135
  2. 2023On the Exploitability of Instruction Tuningcited by 116
  3. 2022Truth Serum: Poisoning Machine Learning Models to Reveal Their Secretscited by 101
  4. 2022Wild Patterns Reloaded: A Survey of Machine Learning Security against Training Data Poisoningcited by 94
  5. 2022Towards Adversarial Evaluations for Inexact Machine Unlearningcited by 84
  6. 2021Availability Attacks Create Shortcutscited by 62
  7. 2022Autoregressive Perturbations for Data Poisoningcited by 46
  8. 2022Transferable Unlearnable Examplescited by 43
  9. 2023Image Shortcut Squeezing: Countering Perturbative Availability Poisons with Compressioncited by 39
  10. 2023Unlearnable Examples for Diffusion Models: Protect Data from Unauthorized Exploitationcited by 37
  11. 2022Unlearnable Clusters: Towards Label-agnostic Unlearnable Examplescited by 36
  12. 2022Robust Unlearnable Examples: Protecting Data Against Adversarial Learningcited by 35
38 more
  1. 2022Indiscriminate Poisoning Attacks on Unsupervised Contrastive Learningcited by 34
  2. 2022Identifying a Training-Set Attack's Target Using Renormalized Influence Estimationcited by 32
  3. 2024Teach LLMs to Phish: Stealing Private Information from Language Modelscited by 32
  4. 2022One-Pixel Shortcut: on the Learning Preference of Deep Neural Networkscited by 29
  5. 2023CUDA: Convolution-based Unlearnable Datasetscited by 26
  6. 2022Indiscriminate Data Poisoning Attacks on Neural Networkscited by 25
  7. 2023Exploring the Limits of Model-Targeted Indiscriminate Data Poisoning Attackscited by 23
  8. 2023Backdoor Attacks Against Dataset Distillationcited by 21
  9. 2023What Can We Learn from Unlearnable Datasets?cited by 21
  10. 2024Data Poisoning for In-context Learningcited by 21
  11. 2022Self-Ensemble Protection: Training Checkpoints Are Good Data Protectorscited by 19
  12. 2023The Devil's Advocate: Shattering the Illusion of Unexploitable Data using Diffusion Modelscited by 19
  13. 2023Towards Benchmarking and Assessing Visual Naturalness of Physical World Adversarial Attackscited by 18
  14. 2023Balance, Imbalance, and Rebalance: Understanding Robust Overfitting from a Minimax Game Perspectivecited by 18
  15. 2024Purify Unlearnable Examples via Rate-Constrained Variational Autoencoderscited by 18
  16. 2024Provably Unlearnable Data Examplescited by 18
  17. 2024Poison-splat: Computation Cost Attack on 3D Gaussian Splattingcited by 18
  18. 2023Unlearnable Examples Give a False Sense of Security: Piercing through Unexploitable Data with Learnable Examplescited by 17
  19. 2024Unlearnable 3D Point Clouds: Class-wise Transformation Is All You Needcited by 16
  20. 2022Poisons that are learned faster are more effectivecited by 14
  21. 2023Large Language Models Are Better Adversaries: Exploring Generative Clean-Label Backdoor Attacks Against Text Classifierscited by 14
  22. 2024UnSeg: One Universal Unlearnable Example Generator is Enough against All Image Segmentationcited by 14
  23. 2021Fooling Adversarial Training with Inducing Noisecited by 13
  24. 2023Detection and Defense of Unlearnable Examplescited by 13
  25. 2024Semantic Deep Hiding for Robust Unlearnable Examplescited by 13
  26. 2022Can Adversarial Training Be Manipulated By Non-Robust Features?cited by 12
  27. 2023A Security Risk Taxonomy for Prompt-Based Interaction With Large Language Modelscited by 12
  28. 2024Game-Theoretic Unlearnable Example Generatorcited by 12
  29. 2024Efficient Availability Attacks against Supervised and Contrastive Learning Simultaneouslycited by 12
  30. 2025MTL-UE: Learning to Learn Nothing for Multi-Task Learningcited by 11
  31. 2021Going Grayscale: The Road to Understanding and Improving Unlearnable Examplescited by 10
  32. 2023Sharpness-Aware Data Poisoning Attackcited by 10
  33. 2024Disguised Copyright Infringement of Latent Diffusion Modelscited by 10
  34. 2024Ungeneralizable Examplescited by 9
  35. 2024ECLIPSE: Expunging Clean-label Indiscriminate Poisons via Sparse Diffusion Purificationcited by 9
  36. 2024Unlearnable Examples Detection via Iterative Filteringcited by 9
  37. 2025Temporal Unlearnable Examples: Preventing Personal Video Data from Unauthorized Exploitation by Object Trackingcited by 9
  38. 2024Indiscriminate Data Poisoning Attacks on Pre-trained Feature Extractorscited by 8

50 most cited of 119 All 119 (JSON)

Similar, not cited

Close in wording, no citation either way

  1. 2024Have You Poisoned My Data? Defending Neural Networks against Data Poisoning
  2. 2021ML Attack Models: Adversarial Attacks and Data Poisoning Attacks
  3. 2021Active Learning Under Malicious Mislabeling and Poisoning Attacks
  4. 2021Excess Capacity and Backdoor Poisoning
  5. 2025On the Feasibility of Poisoning Text-to-Image AI Models via Adversarial Mislabeling
  6. 2022Friendly Noise against Adversarial Noise: A Powerful Defense against Data Poisoning Attacks
  7. 2021What Doesn't Kill You Makes You Robust(er): How to Adversarially Train against Data Poisoning
  8. 2022Not All Poisons are Created Equal: Robust Training against Data Poisoning