mlsanityData to 7 Oct 2026

BagFlip: A Certified Defense against Data Poisoning

arXiv 2205.13634 ↗First posted 26 May 2022cs.LGcited by 18

On the map: LLM safety and security → Backdoor and data poisoning attacks

Abstract (arXiv)

Machine learning models are vulnerable to data-poisoning attacks, in which an attacker maliciously modifies the training set to change the prediction of a learned model. In a trigger-less attack, the attacker can modify the training set but not the test inputs, while in a backdoor attack the attacker can also modify test inputs. Existing model-agnostic defense approaches either cannot handle backdoor attacks or do not provide effective certificates (i.e., a proof of a defense). We present BagFlip, a model-agnostic certified approach that can effectively defend against both trigger-less and backdoor attacks. We evaluate BagFlip on image classification and malware detection datasets. BagFlip is equal to or more effective than the state-of-the-art approaches for trigger-less attacks and more effective than the state-of-the-art approaches for backdoor attacks.

Key facts. Cited by 18 papers in the map (data through 7 Oct 2026). Placed in Backdoor and data poisoning attacks, one of 12 directions in LLM safety and security. Builds on 32 of its 46 references that are in the map. First posted on arXiv 26 May 2022.

Builds on

32 of 46 references.

Closest ancestors · 2

Same direction, newest first

  1. 2022Improved Certified Defenses against Data Poisoning with (Deterministic) Finite Aggregation5 Feb
  2. 2021Turn the Combination Lock: Learnable Textual Backdoor Attacks via Word Substitution11 Jun

Other references · 30

  1. 2019Certified Adversarial Robustness via Randomized Smoothingcited by 1,324
  2. 2017BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chaincited by 1,052
  3. 2017Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoningcited by 1,012
  4. 2018Fine-Pruning: Defending Against Backdooring Attacks on Deep Neural Networkscited by 550
  5. 2020On Adaptive Attacks to Adversarial Example Defensescited by 547
  6. 2018Poison Frogs! Targeted Clean-Label Poisoning Attacks on Neural Networkscited by 500
  7. 2018Spectral Signatures in Backdoor Attackscited by 457
  8. 2019STRIP: A Defence Against Trojan Attacks on Deep Neural Networkscited by 437
  9. 2019Hidden Trigger Backdoor Attackscited by 359
  10. 2020Attack of the Tails: Yes, You Really Can Backdoor Federated Learningcited by 307
  11. 2019Label-Consistent Backdoor Attackscited by 285
  12. 2018EMBER: An Open Dataset for Training Static PE Malware Machine Learning Modelscited by 164
18 more
  1. 2020Witches' Brew: Industrial Scale Data Poisoning via Gradient Matchingcited by 156
  2. 2019Transferable Clean-Label Poisoning Attacks on Deep Neural Netscited by 129
  3. 2018Stronger Data Poisoning Attacks Break Data Sanitization Defensescited by 125
  4. 2020RAB: Provable Robustness Against Backdoor Attackscited by 115
  5. 2020Deep Partition Aggregation: Provable Defense against General Poisoning Attackscited by 112
  6. 2020Certified Robustness to Label-Flipping Attacks via Randomized Smoothingcited by 103
  7. 2020Intrinsic Certified Robustness of Bagging against Data Poisoning Attackscited by 90
  8. 2018Is feature selection secure against training data poisoning?cited by 88
  9. 2019Defending Neural Backdoors via Generative Distribution Modelingcited by 82
  10. 2019Data Poisoning against Differentially-Private Learners: Attacks and Defensescited by 75
  11. 2020On Certifying Robustness against Backdoor Attacks via Randomized Smoothingcited by 74
  12. 2019Tight Certificates of Adversarial Robustness for Randomly Smoothed Classifierscited by 65
  13. 2020Bullseye Polytope: A Scalable Clean-Label Poisoning Attack with Improved Transferabilitycited by 65
  14. 2020Certified Robustness of Nearest Neighbors against Data Poisoning and Backdoor Attackscited by 58
  15. 2020Curse of Dimensionality on Randomized Smoothing for Certifiable Robustnesscited by 56
  16. 2020Backdoors in Neural Models of Source Codecited by 27
  17. 2021Certifying Robustness to Programmable Data Bias in Decision Treescited by 21
  18. 2020A Framework of Randomized Selection Based Certified Defenses Against Data Poisoning Attackscited by 12

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2023: 5; 2024: 8; 2025: 2; 2026: 3.

18 papers.

Sort:

By area:

  1. 2023Shared Adversarial Unlearning: Backdoor Mitigation by Unlearning Shared Adversarial Examplescited by 40
  2. 2024Provably Unlearnable Data Examplescited by 18
  3. 2023CBD: A Certified Backdoor Detector Based on Local Dominant Probabilitycited by 13
  4. 2024Dialectical Alignment: Resolving the Tension of 3H and Security Threats of LLMscited by 11
  5. 2023PECAN: A Deterministic Certified Defense Against Backdoor Attackscited by 5
  6. 2024Relational DNN Verification With Cross Executional Bound Refinementcited by 5
  7. 2024Test-Time Multimodal Backdoor Detection by Contrastive Promptingcited by 5
  8. 2024Provable Robustness of (Graph) Neural Networks Against Data Poisoning and Backdoor Attackscited by 5
  9. 2025Keeping up with dynamic attackers: Certifying robustness to adaptive online data poisoningcited by 3
  10. 2024FullCert: Deterministic End-to-End Certification for Training and Inference of Neural Networkscited by 2
  11. 2023Pick your Poison: Undetectability versus Robustness in Data Poisoning Attackscited by 1
  12. 2024Certified Robustness to Clean-Label Poisoning Using Diffusion Denoisingcited by 1
6 more
  1. 2023Mendata: A Framework to Purify Manipulated Training Datacited by 0
  2. 2024MIBP-Cert: Certified Training against Data Perturbations with Mixed-Integer Bilinear Programscited by 0
  3. 2025Robustness Certificates for Neural Networks Against Data Poisoning and Evasion Attackscited by 0
  4. 2026Exact Certification of Neural Networks and Partition Aggregation Ensembles against Label Poisoningcited by 0
  5. 2026Detecting Trojaned DNNs via Spectral Regression Analysiscited by 0
  6. 2026Provable Robustness against Backdoor Attacks via the Primal-Dual Perspective on Differential Privacycited by 0