# Indiscriminate Poisoning Attacks on Unsupervised Contrastive Learning

arXiv: https://arxiv.org/abs/2202.11202 · HTML: https://mlsanity.com/paper/2202.11202/

## Key facts

- Cited by 34 papers in the map (data through 14 Oct 2026).
- Placed in Backdoor and data poisoning attacks, one of 12 directions in LLM safety and security.
- Builds on 44 of its 59 references that are in the map.
- First posted on arXiv 22 Feb 2022.

## Placed in

- LLM safety and security / [Backdoor and data poisoning attacks](https://mlsanity.com/safety/backdoor-and-data-poisoning-attacks/)

## Builds on (most cited first, 30 of 44)

- [Deep Residual Learning for Image Recognition](https://mlsanity.com/paper/1512.03385/) (2015)
- [Learning Transferable Visual Models From Natural Language Supervision](https://mlsanity.com/paper/2103.00020/) (2021)
- [Very Deep Convolutional Networks for Large-Scale Image Recognition](https://mlsanity.com/paper/1409.1556/) (2014)
- [A Simple Framework for Contrastive Learning of Visual Representations](https://mlsanity.com/paper/2002.05709/) (2020)
- [ImageNet Large Scale Visual Recognition Challenge](https://mlsanity.com/paper/1409.0575/) (2014)
- [Representation Learning with Contrastive Predictive Coding](https://mlsanity.com/paper/1807.03748/) (2018)
- [Momentum Contrast for Unsupervised Visual Representation Learning](https://mlsanity.com/paper/1911.05722/) (2019)
- [Densely Connected Convolutional Networks](https://mlsanity.com/paper/1608.06993/) (2016)
- [Towards Deep Learning Models Resistant to Adversarial Attacks](https://mlsanity.com/paper/1706.06083/) (2017)
- [mixup: Beyond Empirical Risk Minimization](https://mlsanity.com/paper/1710.09412/) (2017)
- [SGDR: Stochastic Gradient Descent with Warm Restarts](https://mlsanity.com/paper/1608.03983/) (2016)
- [MobileNetV2: Inverted Residuals and Linear Bottlenecks](https://mlsanity.com/paper/1801.04381/) (2018)
- [Bootstrap your own latent: A new approach to self-supervised Learning](https://mlsanity.com/paper/2006.07733/) (2020)
- [CutMix: Regularization Strategy to Train Strong Classifiers with Localizable Features](https://mlsanity.com/paper/1905.04899/) (2019)
- [Improved Baselines with Momentum Contrastive Learning](https://mlsanity.com/paper/2003.04297/) (2020)
- [Extracting Training Data from Large Language Models](https://mlsanity.com/paper/2012.07805/) (2020)
- [Improved Regularization of Convolutional Neural Networks with Cutout](https://mlsanity.com/paper/1708.04552/) (2017)
- [An Empirical Study of Training Self-Supervised Vision Transformers](https://mlsanity.com/paper/2104.02057/) (2021)
- [Theoretically Principled Trade-off between Robustness and Accuracy](https://mlsanity.com/paper/1901.08573/) (2019)
- [Understanding Contrastive Representation Learning through Alignment and Uniformity on the Hypersphere](https://mlsanity.com/paper/2005.10242/) (2020)
- [Big Self-Supervised Models are Strong Semi-Supervised Learners](https://mlsanity.com/paper/2006.10029/) (2020)
- [Understanding intermediate layers using linear classifier probes](https://mlsanity.com/paper/1610.01644/) (2016)
- [A Survey on Contrastive Self-supervised Learning](https://mlsanity.com/paper/2011.00362/) (2020)
- [Wild Patterns: Ten Years After the Rise of Adversarial Machine Learning](https://mlsanity.com/paper/1712.03141/) (2017)
- [Big Self-Supervised Models Advance Medical Image Classification](https://mlsanity.com/paper/2101.05224/) (2021)
- [Large image datasets: A pyrrhic win for computer vision?](https://mlsanity.com/paper/2006.16923/) (2020)
- [Towards Poisoning of Deep Learning Algorithms with Back-gradient Optimization](https://mlsanity.com/paper/1708.08689/) (2017)
- [Unlearnable Examples: Making Personal Data Unexploitable](https://mlsanity.com/paper/2101.04898/) (2021)
- [Poisoning and Backdooring Contrastive Learning](https://mlsanity.com/paper/2106.09667/) (2021)
- [Robust Pre-Training by Adversarial Contrastive Learning](https://mlsanity.com/paper/2010.13337/) (2020)

## Built on by (most cited first, 30 of 34)

- [Transferable Unlearnable Examples](https://mlsanity.com/paper/2210.10114/) (2022)
- [Image Shortcut Squeezing: Countering Perturbative Availability Poisons with Compression](https://mlsanity.com/paper/2301.13838/) (2023)
- [Unlearnable Clusters: Towards Label-agnostic Unlearnable Examples](https://mlsanity.com/paper/2301.01217/) (2022)
- [Stable Unlearnable Example: Enhancing the Robustness of Unlearnable Examples via Stable Error-Minimizing Noise](https://mlsanity.com/paper/2311.13091/) (2023)
- [Unlearnable Examples Give a False Sense of Security: Piercing through Unexploitable Data with Learnable Examples](https://mlsanity.com/paper/2305.09241/) (2023)
- [Machine Unlearning in Large Language Models](https://mlsanity.com/paper/2404.16841/) (2024)
- [UnSeg: One Universal Unlearnable Example Generator is Enough against All Image Segmentation](https://mlsanity.com/paper/2410.09909/) (2024)
- [Detection and Defense of Unlearnable Examples](https://mlsanity.com/paper/2312.08898/) (2023)
- [Semantic Deep Hiding for Robust Unlearnable Examples](https://mlsanity.com/paper/2406.17349/) (2024)
- [Efficient Availability Attacks against Supervised and Contrastive Learning Simultaneously](https://mlsanity.com/paper/2402.04010/) (2024)
- [MTL-UE: Learning to Learn Nothing for Multi-Task Learning](https://mlsanity.com/paper/2505.05279/) (2025)
- [Indiscriminate Data Poisoning Attacks on Pre-trained Feature Extractors](https://mlsanity.com/paper/2402.12626/) (2024)
- [Medical Unlearnable Examples: Securing Medical Data from Unauthorized Training via Sparsity-Aware Local Masking](https://mlsanity.com/paper/2403.10573/) (2024)
- [APBench: A Unified Benchmark for Availability Poisoning Attacks and Defenses](https://mlsanity.com/paper/2308.03258/) (2023)
- [Toward Availability Attacks in 3D Point Clouds](https://mlsanity.com/paper/2407.11011/) (2024)
- [DeDe: Detecting Backdoor Samples for SSL Encoders via Decoders](https://mlsanity.com/paper/2411.16154/) (2024)
- [Transferable Availability Poisoning Attacks](https://mlsanity.com/paper/2310.05141/) (2023)
- [Nonlinear Transformations Against Unlearnable Datasets](https://mlsanity.com/paper/2406.02883/) (2024)
- [When Priors Backfire: On the Vulnerability of Unlearnable Examples to Pretraining](https://mlsanity.com/paper/2603.04731/) (2026)
- [FCert: Certifiably Robust Few-Shot Classification in the Era of Foundation Models](https://mlsanity.com/paper/2404.08631/) (2024)
- [BridgePure: Limited Protection Leakage Can Break Black-Box Data Protection](https://mlsanity.com/paper/2412.21061/) (2024)
- [T2UE: Generating Unlearnable Examples from Text Descriptions](https://mlsanity.com/paper/2508.03091/) (2025)
- [A Linear Approach to Data Poisoning](https://mlsanity.com/paper/2505.15175/) (2025)
- [Provable Watermarking for Data Poisoning Attacks](https://mlsanity.com/paper/2510.09210/) (2025)
- [Why Do Unlearnable Examples Work: A Novel Perspective of Mutual Information](https://mlsanity.com/paper/2603.03725/) (2026)
- [Exploiting Supervised Poison Vulnerability to Strengthen Self-Supervised Defense](https://mlsanity.com/paper/2409.08509/) (2024)
- [REPEAT: Improving Uncertainty Estimation in Representation Learning Explainability](https://mlsanity.com/paper/2412.08513/) (2024)
- [Safety-Efficacy Trade Off: Robustness against Data-Poisoning](https://mlsanity.com/paper/2602.00822/) (2026)
- [Hard Work Does Not Always Pay Off: Poisoning Attacks on Neural Architecture Search](https://mlsanity.com/paper/2405.06073/) (2024)
- [Empirical Perturbation Analysis of Linear System Solvers from a Data Poisoning Perspective](https://mlsanity.com/paper/2410.00878/) (2024)

## Abstract (arXiv)

Indiscriminate data poisoning attacks are quite effective against supervised learning. However, not much is known about their impact on unsupervised contrastive learning (CL). This paper is the first to consider indiscriminate poisoning attacks of contrastive learning. We propose Contrastive Poisoning (CP), the first effective such attack on CL. We empirically show that Contrastive Poisoning, not only drastically reduces the performance of CL algorithms, but also attacks supervised learning models, making it the most generalizable indiscriminate poisoning attack. We also show that CL algorithms with a momentum encoder are more robust to indiscriminate poisoning, and propose a new countermeasure based on matrix completion. Code is available at: https://github.com/kaiwenzha/contrastive-poisoning.