mlsanityData to 7 Oct 2026

Autoregressive Perturbations for Data Poisoning

arXiv 2206.03693 ↗First posted 8 Jun 2022cs.LG cs.CRcited by 45

On the map: LLM safety and security → Backdoor and data poisoning attacks

Abstract (arXiv)

The prevalence of data scraping from social media as a means to obtain datasets has led to growing concerns regarding unauthorized use of data. Data poisoning attacks have been proposed as a bulwark against scraping, as they make data "unlearnable" by adding small, imperceptible perturbations. Unfortunately, existing methods require knowledge of both the target architecture and the complete dataset so that a surrogate network can be trained, the parameters of which are used to generate the attack. In this work, we introduce autoregressive (AR) poisoning, a method that can generate poisoned data without access to the broader dataset. The proposed AR perturbations are generic, can be applied across different datasets, and can poison different architectures. Compared to existing unlearnable methods, our AR poisons are more resistant against common defenses such as adversarial training and strong data augmentations. Our analysis further provides insight into what makes an effective data poison.

Key facts. Cited by 45 papers in the map (data through 7 Oct 2026). Placed in Backdoor and data poisoning attacks, one of 12 directions in LLM safety and security. Builds on 30 of its 46 references that are in the map. First posted on arXiv 8 Jun 2022.

Builds on

30 of 46 references.

References · 30

  1. 2015Deep Residual Learning for Image Recognitioncited by 51,809
  2. 2021Learning Transferable Visual Models From Natural Language Supervisioncited by 33,456
  3. 2020An Image is Worth 16x16 Words: Transformers for Image Recognition at Scalecited by 29,915
  4. 2014Very Deep Convolutional Networks for Large-Scale Image Recognitioncited by 15,267
  5. 2016Densely Connected Convolutional Networkscited by 6,691
  6. 2022Hierarchical Text-Conditional Image Generation with CLIP Latentscited by 6,539
  7. 2019EfficientNet: Rethinking Model Scaling for Convolutional Neural Networkscited by 6,415
  8. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  9. 2017mixup: Beyond Empirical Risk Minimizationcited by 5,155
  10. 2021Zero-Shot Text-to-Image Generationcited by 4,276
  11. 2014Going Deeper with Convolutionscited by 4,231
  12. 2017MobileNets: Efficient Convolutional Neural Networks for Mobile Vision Applicationscited by 3,827
18 more
  1. 2019CutMix: Regularization Strategy to Train Strong Classifiers with Localizable Featurescited by 2,875
  2. 2017Improved Regularization of Convolutional Neural Networks with Cutoutcited by 1,623
  3. 2017Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoningcited by 1,012
  4. 2019Adversarial Examples Are Not Bugs, They Are Featurescited by 950
  5. 2018Robustness May Be at Odds with Accuracycited by 873
  6. 2018Poison Frogs! Targeted Clean-Label Poisoning Attacks on Neural Networkscited by 500
  7. 2020The Pitfalls of Simplicity Bias in Neural Networkscited by 349
  8. 2020Large image datasets: A pyrrhic win for computer vision?cited by 237
  9. 2021Unlearnable Examples: Making Personal Data Unexploitablecited by 188
  10. 2020Dataset Security for Machine Learning: Data Poisoning, Backdoor Attacks, and Defensescited by 171
  11. 2020Witches' Brew: Industrial Scale Data Poisoning via Gradient Matchingcited by 156
  12. 2019Transferable Clean-Label Poisoning Attacks on Deep Neural Netscited by 129
  13. 2021Adversarial Examples Make Strong Poisonscited by 115
  14. 2021Better Safe Than Sorry: Preventing Delusive Adversaries with Adversarial Trainingcited by 58
  15. 2021Preventing Unauthorized Use of Proprietary Data: Poisoning for Secure Dataset Releasecited by 35
  16. 2022Poisons that are learned faster are more effectivecited by 14
  17. 2021Fooling Adversarial Training with Inducing Noisecited by 12
  18. 2022Learnability Lock: Authorized Learnability Control Through Adversarial Invertible Transformationscited by 7

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2022: 1; 2023: 8; 2024: 18; 2025: 8; 2026: 10.

45 papers.

Sort:

By area:

  1. 2023Image Shortcut Squeezing: Countering Perturbative Availability Poisons with Compressioncited by 39
  2. 2023Learning the Unlearnable: Adversarial Augmentations Suppress Unlearnable Example Attackscited by 28
  3. 2023Exploring the Limits of Model-Targeted Indiscriminate Data Poisoning Attackscited by 23
  4. 2023What Can We Learn from Unlearnable Datasets?cited by 21
  5. 2022Self-Ensemble Protection: Training Checkpoints Are Good Data Protectorscited by 19
  6. 2023The Devil's Advocate: Shattering the Illusion of Unexploitable Data using Diffusion Modelscited by 19
  7. 2024Purify Unlearnable Examples via Rate-Constrained Variational Autoencoderscited by 18
  8. 2024Provably Unlearnable Data Examplescited by 18
  9. 2024Semantic Deep Hiding for Robust Unlearnable Examplescited by 13
  10. 2024UnSeg: One Universal Unlearnable Example Generator is Enough against All Image Segmentationcited by 13
  11. 2024Efficient Availability Attacks against Supervised and Contrastive Learning Simultaneouslycited by 12
  12. 2025MTL-UE: Learning to Learn Nothing for Multi-Task Learningcited by 11
33 more
  1. 2024Disguised Copyright Infringement of Latent Diffusion Modelscited by 10
  2. 2024ECLIPSE: Expunging Clean-label Indiscriminate Poisons via Sparse Diffusion Purificationcited by 9
  3. 2024Unlearnable Examples Detection via Iterative Filteringcited by 9
  4. 2025Temporal Unlearnable Examples: Preventing Personal Video Data from Unauthorized Exploitation by Object Trackingcited by 9
  5. 2024Indiscriminate Data Poisoning Attacks on Pre-trained Feature Extractorscited by 8
  6. 2023APBench: A Unified Benchmark for Availability Poisoning Attacks and Defensescited by 7
  7. 2024Toward Availability Attacks in 3D Point Cloudscited by 7
  8. 2023Transferable Availability Poisoning Attackscited by 5
  9. 2024Nonlinear Transformations Against Unlearnable Datasetscited by 5
  10. 2026When Priors Backfire: On the Vulnerability of Unlearnable Examples to Pretrainingcited by 5
  11. 2025How Far Are We from True Unlearnability?cited by 4
  12. 2024Towards Operationalizing Right to Data Protectioncited by 3
  13. 2024BridgePure: Limited Protection Leakage Can Break Black-Box Data Protectioncited by 3
  14. 2025T2UE: Generating Unlearnable Examples from Text Descriptionscited by 3
  15. 2026Full spectrum Unlearnable Examples via Spectral Equalizationcited by 3
  16. 2024Finding needles in a haystack: A Black-Box Approach to Invisible Watermark Detectioncited by 2
  17. 2025Provable Watermarking for Data Poisoning Attackscited by 2
  18. 2026Why Do Unlearnable Examples Work: A Novel Perspective of Mutual Informationcited by 2
  19. 2026LLM Benchmark Datasets Should Be Contamination-Resistantcited by 2
  20. 2023Unlearnable Examples Give a False Sense of Data Privacy: Understanding and Relearningcited by 1
  21. 2024Be Persistent: Towards a Unified Solution for Mitigating Shortcuts in Deep Learningcited by 1
  22. 2024Beyond Full Poisoning: Effective Availability Attacks with Partial Perturbationcited by 1
  23. 2024Learning from Convolution-based Unlearnable Datasetscited by 1
  24. 2025Detect & Score: Privacy-Preserving Misbehaviour Detection and Contribution Evaluation in Federated Learningcited by 1
  25. 2026Perturbation-Induced Linearization: Constructing Unlearnable Data with Solely Linear Classifierscited by 1
  26. 2024Deferred Poisoning: Making the Model More Vulnerable via Hessian Singularizationcited by 0
  27. 2025Are Targeted Data Poisoning Attacks as Effective as We Think?cited by 0
  28. 2025Learning to Generate Cross-Task Unexploitable Examplescited by 0
  29. 2026UTOPIA: Unlearnable Tabular Data via Decoupled Shortcut Embeddingcited by 0
  30. 2026Unlearnable Faces: Privacy Protection Surviving Extraction Pipelinecited by 0
  31. 2026Adversarial Attacks for Good: A Survey of Proactive Protection across the Visual Content Lifecyclecited by 0
  32. 2026Reversible Unlearnable Examples: Towards the Copyright Protection in Deep Learning Eracited by 0
  33. 2026Leveraging Imperfect Restoration for Data Availability Attackcited by 0