mlsanityData to 7 Oct 2026

Indiscriminate Data Poisoning Attacks on Neural Networks

arXiv 2204.09092 ↗First posted 19 Apr 2022cs.LG cs.CRcited by 24

On the map: LLM safety and security → Backdoor and data poisoning attacks

Abstract (arXiv)

Data poisoning attacks, in which a malicious adversary aims to influence a model by injecting "poisoned" data into the training process, have attracted significant recent attention. In this work, we take a closer look at existing poisoning attacks and connect them with old and new algorithms for solving sequential Stackelberg games. By choosing an appropriate loss function for the attacker and optimizing with algorithms that exploit second-order information, we design poisoning attacks that are effective on neural networks. We present efficient implementations that exploit modern auto-differentiation packages and allow simultaneous and coordinated generation of tens of thousands of poisoned points, in contrast to existing methods that generate poisoned points one by one. We further perform extensive experiments that empirically explore the effect of data poisoning attacks on deep neural networks.

Key facts. Cited by 24 papers in the map (data through 7 Oct 2026). Placed in Backdoor and data poisoning attacks, one of 12 directions in LLM safety and security. Builds on 40 of its 74 references that are in the map. First posted on arXiv 19 Apr 2022.

Builds on

40 of 74 references.

Closest ancestors · 2

Same direction, newest first

  1. 2021Data Poisoning Won't Save You From Facial Recognition28 Jun
  2. 2021Manipulating SGD with Data Ordering Attacks19 Apr

Other references · 38

  1. 2015Deep Residual Learning for Image Recognitioncited by 51,809
  2. 2019PyTorch: An Imperative Style, High-Performance Deep Learning Librarycited by 20,160
  3. 2013Intriguing properties of neural networkscited by 5,114
  4. 2020The Pile: An 800GB Dataset of Diverse Text for Language Modelingcited by 2,346
  5. 2017Understanding Black-box Predictions via Influence Functionscited by 1,714
  6. 2017BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chaincited by 1,052
  7. 2017Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoningcited by 1,012
  8. 2018Poison Frogs! Targeted Clean-Label Poisoning Attacks on Neural Networkscited by 500
  9. 2018Spectral Signatures in Backdoor Attackscited by 457
  10. 2019Hidden Trigger Backdoor Attackscited by 359
  11. 2017Certified Defenses for Data Poisoning Attackscited by 288
  12. 2020Influence Functions in Deep Learning Are Fragilecited by 247
26 more
  1. 2016Robust Estimators in High Dimensions without the Computational Intractabilitycited by 209
  2. 2016Unrolled Generative Adversarial Networkscited by 208
  3. 2017Towards Poisoning of Deep Learning Algorithms with Back-gradient Optimizationcited by 188
  4. 2021Unlearnable Examples: Making Personal Data Unexploitablecited by 188
  5. 2020Threats to Federated Learning: A Surveycited by 171
  6. 2020Dataset Security for Machine Learning: Data Poisoning, Backdoor Attacks, and Defensescited by 171
  7. 2017Deep Learning is Robust to Massive Label Noisecited by 164
  8. 2020Witches' Brew: Industrial Scale Data Poisoning via Gradient Matchingcited by 156
  9. 2016Agnostic Estimation of Mean and Covariancecited by 131
  10. 2019Transferable Clean-Label Poisoning Attacks on Deep Neural Netscited by 129
  11. 2018Stronger Data Poisoning Attacks Break Data Sanitization Defensescited by 125
  12. 2018Sever: A Robust Meta-Algorithm for Stochastic Optimizationcited by 123
  13. 2020Adversarial Machine Learning -- Industry Perspectivescited by 121
  14. 2021Back to the Drawing Board: A Critical Evaluation of Poisoning Attacks on Production Federated Learningcited by 116
  15. 2021Adversarial Examples Make Strong Poisonscited by 115
  16. 2020MetaPoison: Practical General-purpose Clean-label Data Poisoningcited by 114
  17. 2020Just How Toxic is Data Poisoning? A Unified Benchmark for Backdoor and Data Poisoning Attackscited by 109
  18. 2020Bullseye Polytope: A Scalable Clean-Label Poisoning Attack with Improved Transferabilitycited by 65
  19. 2021Availability Attacks Create Shortcutscited by 60
  20. 2015Robust Covariance and Scatter Matrix Estimation under Huber's Contamination Modelcited by 47
  21. 2021Preventing Unauthorized Use of Proprietary Data: Poisoning for Secure Dataset Releasecited by 35
  22. 2019On Solving Minimax Optimization Locally: A Follow-the-Ridge Approachcited by 34
  23. 2020MaxUp: A Simple Way to Improve Generalization of Neural Network Trainingcited by 27
  24. 2019Poisoning Attacks with Generative Adversarial Netscited by 21
  25. 2022An Equivalence Between Data Poisoning and Byzantine Gradient Attackscited by 16
  26. 2020Newton-type Methods for Minimax Optimizationcited by 11

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2022: 2; 2023: 5; 2024: 9; 2025: 6; 2026: 2.

24 papers.

Sort:

By area:

  1. 2023Nightshade: Prompt-Specific Poisoning Attacks on Text-to-Image Generative Modelscited by 72
  2. 2022Hidden Poison: Machine Unlearning Enables Camouflaged Poisoning Attackscited by 37
  3. 2024Machine Unlearning Fails to Remove Data Poisoning Attackscited by 35
  4. 2023Exploring the Limits of Model-Targeted Indiscriminate Data Poisoning Attackscited by 23
  5. 2023Detection and Defense of Unlearnable Examplescited by 13
  6. 2024Game-Theoretic Unlearnable Example Generatorcited by 12
  7. 2024Disguised Copyright Infringement of Latent Diffusion Modelscited by 10
  8. 2025Position: Curvature Matrices Should Be Democratized via Linear Operatorscited by 9
  9. 2022A law of adversarial risk, interpolation, and label noisecited by 8
  10. 2024Indiscriminate Data Poisoning Attacks on Pre-trained Feature Extractorscited by 8
  11. 2023What Distributions are Robust to Indiscriminate Poisoning Attacks for Linear Learners?cited by 3
  12. 2024BridgePure: Limited Protection Leakage Can Break Black-Box Data Protectioncited by 3
12 more
  1. 2023Dropout Attackscited by 2
  2. 2024Inverting Gradient Attacks Makes Powerful Data Poisoningcited by 2
  3. 2024Adversarial Data Poisoning Attacks on Quantum Machine Learning in the NISQ Eracited by 2
  4. 2025Provable Watermarking for Data Poisoning Attackscited by 2
  5. 2024Beyond Full Poisoning: Effective Availability Attacks with Partial Perturbationcited by 1
  6. 2025Stress-Testing ML Pipelines with Adversarial Data Corruptioncited by 1
  7. 2026Efficient Bilevel Optimization with KFAC-Based Hypergradientscited by 1
  8. 2024Hard Work Does Not Always Pay Off: Poisoning Attacks on Neural Architecture Searchcited by 0
  9. 2025Approaching the Harm of Gradient Attacks While Only Flipping Labelscited by 0
  10. 2025What's Pulling the Strings? Evaluating Integrity and Attribution in AI Training and Inference through Concept Shiftcited by 0
  11. 2025Are Targeted Data Poisoning Attacks as Effective as We Think?cited by 0
  12. 2026Sequential Data Poisoning in LLM Post-Trainingcited by 0