mlsanityData to 7 Oct 2026

Not All Poisons are Created Equal: Robust Training against Data Poisoning

arXiv 2210.09671 ↗First posted 18 Oct 2022cs.LG cs.CRcited by 29

On the map: LLM safety and security → Backdoor and data poisoning attacks

Abstract (arXiv)

Data poisoning causes misclassification of test time target examples by injecting maliciously crafted samples in the training data. Existing defenses are often effective only against a specific type of targeted attack, significantly degrade the generalization performance, or are prohibitive for standard deep learning pipelines. In this work, we propose an efficient defense mechanism that significantly reduces the success rate of various data poisoning attacks, and provides theoretical guarantees for the performance of the model. Targeted attacks work by adding bounded perturbations to a randomly selected subset of training data to match the targets' gradient or representation. We show that: (i) under bounded perturbations, only a number of poisons can be optimized to have a gradient that is close enough to that of the target and make the attack successful; (ii) such effective poisons move away from their original class and get isolated in the gradient space; (iii) dropping examples in low-density gradient regions during training can successfully eliminate the effective poisons, and guarantees similar training dynamics to that of training on full data. Our extensive experiments show that our method significantly decreases the success rate of state-of-the-art targeted attacks, including Gradient Matching and Bullseye Polytope, and easily scales to large datasets.

Key facts. Cited by 29 papers in the map (data through 7 Oct 2026). Placed in Backdoor and data poisoning attacks, one of 12 directions in LLM safety and security. Builds on 29 of its 40 references that are in the map. First posted on arXiv 18 Oct 2022.

Builds on

29 of 40 references.

Closest ancestors · 1

Same direction, newest first

  1. 2021Sleeper Agent: Scalable Hidden Trigger Backdoors for Neural Networks Trained from Scratch16 Jun

Other references · 28

  1. 2014Very Deep Convolutional Networks for Large-Scale Image Recognitioncited by 15,267
  2. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  3. 2016Deep Learning with Differential Privacycited by 2,682
  4. 2021Convex optimizationcited by 2,479
  5. 2017BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chaincited by 1,052
  6. 2017Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoningcited by 1,012
  7. 2018Poison Frogs! Targeted Clean-Label Poisoning Attacks on Neural Networkscited by 500
  8. 2018Spectral Signatures in Backdoor Attackscited by 457
  9. 2018Detecting Backdoor Attacks on Deep Neural Networks by Activation Clusteringcited by 429
  10. 2019Hidden Trigger Backdoor Attackscited by 359
  11. 2018Not All Samples Are Created Equal: Deep Learning with Importance Samplingcited by 323
  12. 2017Certified Defenses for Data Poisoning Attackscited by 288
16 more
  1. 2021Anti-Backdoor Learning: Training Clean Models on Poisoned Datacited by 258
  2. 2020Deep learning versus kernel learning: an empirical study of loss landscape geometry and the time evolution of the Neural Tangent Kernelcited by 185
  3. 2020Witches' Brew: Industrial Scale Data Poisoning via Gradient Matchingcited by 156
  4. 2019Transferable Clean-Label Poisoning Attacks on Deep Neural Netscited by 129
  5. 2018Stronger Data Poisoning Attacks Break Data Sanitization Defensescited by 125
  6. 2020RAB: Provable Robustness Against Backdoor Attackscited by 115
  7. 2020MetaPoison: Practical General-purpose Clean-label Data Poisoningcited by 114
  8. 2020Deep Partition Aggregation: Provable Defense against General Poisoning Attackscited by 112
  9. 2020Just How Toxic is Data Poisoning? A Unified Benchmark for Backdoor and Data Poisoning Attackscited by 109
  10. 2014Lazier Than Lazy Greedycited by 97
  11. 2020Strong Data Augmentation Sanitizes Poisoning and Backdoor Attacks Without an Accuracy Tradeoffcited by 86
  12. 2020On the Effectiveness of Mitigating Data Poisoning Attacks with Gradient Shapingcited by 82
  13. 2019Data Poisoning against Differentially-Private Learners: Attacks and Defensescited by 75
  14. 2020Bullseye Polytope: A Scalable Clean-Label Poisoning Attack with Improved Transferabilitycited by 65
  15. 2021Better Safe Than Sorry: Preventing Delusive Adversaries with Adversarial Trainingcited by 58
  16. 2020On Evaluating Neural Network Backdoor Defensescited by 4

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2022: 2; 2023: 9; 2024: 11; 2025: 4; 2026: 3.

29 papers.

Sort:

By area:

  1. 2023CleanCLIP: Mitigating Data Poisoning Attacks in Multimodal Contrastive Learningcited by 62
  2. 2024Shadowcast: Stealthy Data Poisoning Attacks Against Vision-Language Modelscited by 48
  3. 2024SmallToLarge (S2L): Scalable Data Selection for Fine-tuning Large Language Models by Summarizing Training Trajectories of Small Modelscited by 43
  4. 2022Hidden Poison: Machine Unlearning Enables Camouflaged Poisoning Attackscited by 37
  5. 2023Data and Model Poisoning Backdoor Attacks on Wireless Federated Learning, and the Defense Mechanisms: A Comprehensive Surveycited by 17
  6. 2023Rethinking Backdoor Attackscited by 14
  7. 2024Mitigating Unauthorized Speech Synthesis for Voice Protectioncited by 8
  8. 2023BELT: Old-School Backdoor Attacks can Evade the State-of-the-Art Defense with Backdoor Exclusivity Liftingcited by 7
  9. 2022Differentially Private Optimizers Can Learn Adversarially Robust Modelscited by 6
  10. 2023A Proxy Attack-Free Strategy for Practically Improving the Poisoning Efficiency in Backdoor Attackscited by 5
  11. 2024AdvBDGen: Adversarially Fortified Prompt-Specific Fuzzy Backdoor Generator Against LLM Alignmentcited by 5
  12. 2025No, of Course I Can! Deeper Fine-Tuning Attacks That Bypass Token-Level Safety Mechanismscited by 5
17 more
  1. 2024PureGen: Universal Data Purification for Train-Time Poison Defense via Generative Model Dynamicscited by 3
  2. 2025PoisonedParrot: Subtle Data Poisoning Attacks to Elicit Copyright-Infringing Content from Large Language Modelscited by 3
  3. 2023Effective Backdoor Mitigation in Vision-Language Models Depends on the Pre-training Objectivecited by 2
  4. 2024Clean Label Attacks against SLU Systemscited by 2
  5. 2023Unlearnable Examples Give a False Sense of Data Privacy: Understanding and Relearningcited by 1
  6. 2023HINT: Healthy Influential-Noise based Training to Defend against Data Poisoning Attackscited by 1
  7. 2024Have You Poisoned My Data? Defending Neural Networks against Data Poisoningcited by 1
  8. 2024Vera Verto: Multimodal Hijacking Attackcited by 1
  9. 2024Generalizable Targeted Data Poisoning against Varying Physical Objectscited by 1
  10. 2026Angel or Demon: Investigating the Plasticity Interventions' Impact on Backdoor Threats in Deep Reinforcement Learningcited by 1
  11. 2023Mendata: A Framework to Purify Manipulated Training Datacited by 0
  12. 2024Robust Influence-based Training Methods for Noisy Brain MRIcited by 0
  13. 2024PureEBM: Universal Poison Purification via Mid-Run Dynamics of Energy-Based Modelscited by 0
  14. 2025Like Oil and Water: Group Robustness Methods and Poisoning Defenses May Be at Oddscited by 0
  15. 2025Addressing The Devastating Effects Of Single-Task Data Poisoning In Exemplar-Free Continual Learningcited by 0
  16. 2026TraceGuard: Adaptive Multimodal Poison Filtering through Cross-Feature Rank Agreementcited by 0
  17. 2026SAGE: Similarity-Based Cleaning of Poisoned Training Data from Verified Examplescited by 0