mlsanityData to 7 Oct 2026

Poisoning Attacks and Defenses on Artificial Intelligence: A Survey

arXiv 2202.10276 ↗First posted 21 Feb 2022cs.CR cs.AIcited by 15

On the map: LLM safety and security → Backdoor and data poisoning attacks

Abstract (arXiv)

Machine learning models have been widely adopted in several fields. However, most recent studies have shown several vulnerabilities from attacks with a potential to jeopardize the integrity of the model, presenting a new window of research opportunity in terms of cyber-security. This survey is conducted with a main intention of highlighting the most relevant information related to security vulnerabilities in the context of machine learning (ML) classifiers; more specifically, directed towards training procedures against data poisoning attacks, representing a type of attack that consists of tampering the data samples fed to the model during the training phase, leading to a degradation in the models accuracy during the inference phase. This work compiles the most relevant insights and findings found in the latest existing literatures addressing this type of attacks. Moreover, this paper also covers several defense techniques that promise feasible detection and mitigation mechanisms, capable of conferring a certain level of robustness to a target model against an attacker. A thorough assessment is performed on the reviewed works, comparing the effects of data poisoning on a wide range of ML models in real-world conditions, performing quantitative and qualitative analyses. This paper analyzes the main characteristics for each approach including performance success metrics, required hyperparameters, and deployment complexity. Moreover, this paper emphasizes the underlying assumptions and limitations considered by both attackers and defenders along with their intrinsic properties such as: availability, reliability, privacy, accountability, interpretability, etc. Finally, this paper concludes by making references of some of main existing research trends that provide pathways towards future research directions in the field of cyber-security.

Key facts. Cited by 15 papers in the map (data through 7 Oct 2026). Placed in Backdoor and data poisoning attacks, one of 12 directions in LLM safety and security. Builds on 54 of its 105 references that are in the map. First posted on arXiv 21 Feb 2022.

Builds on

54 of 105 references.

Closest ancestors · 1

Same direction, newest first

  1. 2021De-Pois: An Attack-Agnostic Defense against Data Poisoning Attacks8 May

Other references · 53

  1. 2017Improved Training of Wasserstein GANscited by 2,223
  2. 2016Membership Inference Attacks against Machine Learning Modelscited by 2,221
  3. 2014Conditional Generative Adversarial Netscited by 2,152
  4. 2017BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chaincited by 1,052
  5. 2017Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoningcited by 1,012
  6. 2015The Limitations of Deep Learning in Adversarial Settingscited by 784
  7. 2016Universal adversarial perturbationscited by 774
  8. 2017Evasion Attacks against Machine Learning at Test Timecited by 686
  9. 2016Stealing Machine Learning Models via Prediction APIscited by 602
  10. 2017One pixel attack for fooling deep neural networkscited by 579
  11. 2017Adversarial Examples Are Not Easily Detected: Bypassing Ten Detection Methodscited by 542
  12. 2018Exploiting Unintended Feature Leakage in Collaborative Learningcited by 509
38 more
  1. 2018Poison Frogs! Targeted Clean-Label Poisoning Attacks on Neural Networkscited by 500
  2. 2018ML-Leaks: Model and Data Independent Membership Inference Attacks and Defenses on Machine Learning Modelscited by 475
  3. 2017Wild Patterns: Ten Years After the Rise of Adversarial Machine Learningcited by 411
  4. 2019Hidden Trigger Backdoor Attackscited by 359
  5. 2018Analyzing Federated Learning through an Adversarial Lenscited by 346
  6. 2017Deep Models Under the GAN: Information Leakage from Collaborative Deep Learningcited by 326
  7. 2018The Hidden Vulnerability of Distributed Learning in Byzantiumcited by 324
  8. 2017Certified Defenses for Data Poisoning Attackscited by 288
  9. 2018Characterizing Adversarial Subspaces Using Local Intrinsic Dimensionalitycited by 280
  10. 2017MagNet: a Two-Pronged Defense against Adversarial Examplescited by 268
  11. 2018Manipulating Machine Learning: Poisoning Attacks and Countermeasures for Regression Learningcited by 219
  12. 2017Towards Poisoning of Deep Learning Algorithms with Back-gradient Optimizationcited by 188
  13. 2018PRADA: Protecting against DNN Model Stealing Attackscited by 159
  14. 2018Stronger Data Poisoning Attacks Break Data Sanitization Defensescited by 125
  15. 2018Sever: A Robust Meta-Algorithm for Stochastic Optimizationcited by 123
  16. 2018Stealing Hyperparameters in Machine Learningcited by 115
  17. 2019Robust Anomaly Detection and Backdoor Attack Detection Via Differential Privacycited by 93
  18. 2018Understanding Membership Inferences on Well-Generalized Learning Modelscited by 83
  19. 2018Label Sanitization against Label Flipping Poisoning Attackscited by 68
  20. 2018Algorithms that Remember: Model Inversion Attacks and Data Protection Lawcited by 52
  21. 2017Yes, Machine Learning Can Be More Secure! A Case Study on Android Malware Detectioncited by 51
  22. 2017Generative Poisoning Attack Method Against Neural Networkscited by 49
  23. 2019Learning Data Manipulation for Augmentation and Weightingcited by 44
  24. 2018Detection of Adversarial Training Examples in Poisoning Attacks through Anomaly Detectioncited by 43
  25. 2019Fault Sneaking Attack: a Stealthy Framework for Misleading Deep Neural Networkscited by 25
  26. 2019Shielding Collaborative Learning: Mitigating Poisoning Attacks through Client-Side Detectioncited by 25
  27. 2018Training Set Debugging Using Trusted Itemscited by 24
  28. 2019Explaining Vulnerabilities to Adversarial Machine Learning through Visual Analyticscited by 23
  29. 2020Machine Learning for Reliability Engineering and Safety Applications: Review of Current Status and Future Opportunitiescited by 22
  30. 2019Poisoning Attacks with Generative Adversarial Netscited by 21
  31. 2017Automated Poisoning Attacks and Defenses in Malware Detection Systems: An Adversarial Machine Learning Approachcited by 18
  32. 2018Is Data Clustering in Adversarial Settings Secure?cited by 16
  33. 2018Poisoning Behavioral Malware Clusteringcited by 14
  34. 2016Debugging Machine Learning Taskscited by 9
  35. 2020With Great Dispersion Comes Greater Resilience: Efficient Poisoning Attacks and Defenses for Linear Regression Modelscited by 9
  36. 2017Evading Classifiers by Morphing in the Darkcited by 8
  37. 2021DeepPoison: Feature Transfer Based Stealthy Poisoning Attackcited by 8
  38. 2017Adversarial Learning: A Critical Review and Active Learning Studycited by 6

50 most cited of 53 All 53 (JSON)

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2023: 5; 2024: 4; 2025: 4; 2026: 2.

15 papers.

Sort:

By area:

  1. 2025textitAgents Under Siege: Breaking Pragmatic Multi-Agent LLM Systems with Optimized Prompt Attackscited by 31
  2. 2025Data Poisoning in Deep Learning: A Surveycited by 20
  3. 2023Unlearnable Examples Give a False Sense of Security: Piercing through Unexploitable Data with Learnable Examplescited by 17
  4. 2024Poser: Unmasking Alignment Faking LLMs by Manipulating Their Internalscited by 13
  5. 2023Beyond Boundaries: A Comprehensive Survey of Transferable Attacks on AI Systemscited by 6
  6. 2024Deep Learning Model Security: Threats and Defensescited by 4
  7. 2023A Red Teaming Framework for Securing AI in Maritime Autonomous Systemscited by 3
  8. 2025SyntheticPop: Attacking Speaker Verification Systems With Synthetic VoicePopscited by 2
  9. 2023Hiding Backdoors within Event Sequence Data via Poisoning Attackscited by 1
  10. 2024Deep Privacy Funnel Model: From a Discriminative to a Generative Approach with an Application to Face Recognitioncited by 1
  11. 2024GreenMachine: Automatic Design of Zero-Cost Proxies for Energy-Efficient NAScited by 1
  12. 2025GreenFactory: Ensembling Zero-Cost Proxies to Estimate Performance of Neural Networkscited by 1
3 more
  1. 2026AI Security in the Foundation Model Era: A Comprehensive Survey from a Unified Perspectivecited by 1
  2. 2023Mole Recruitment: Poisoning of Image Classifiers via Selective Batch Samplingcited by 0
  3. 2026The Role of Rigor in Artificial Intelligencecited by 0