mlsanityData to 7 Oct 2026

Amplifying Membership Exposure via Data Poisoning

arXiv 2211.00463 ↗First posted 1 Nov 2022cs.CR stat.MLcited by 29

On the map: LLM safety and security → Backdoor and data poisoning attacks

Abstract (arXiv)

As in-the-wild data are increasingly involved in the training stage, machine learning applications become more susceptible to data poisoning attacks. Such attacks typically lead to test-time accuracy degradation or controlled misprediction. In this paper, we investigate the third type of exploitation of data poisoning - increasing the risks of privacy leakage of benign training samples. To this end, we demonstrate a set of data poisoning attacks to amplify the membership exposure of the targeted class. We first propose a generic dirty-label attack for supervised classification algorithms. We then propose an optimization-based clean-label attack in the transfer learning scenario, whereby the poisoning samples are correctly labeled and look "natural" to evade human moderation. We extensively evaluate our attacks on computer vision benchmarks. Our results show that the proposed attacks can substantially increase the membership inference precision with minimum overall test-time model performance degradation. To mitigate the potential negative impacts of our attacks, we also investigate feasible countermeasures.

Key facts. Cited by 29 papers in the map (data through 7 Oct 2026). Placed in Backdoor and data poisoning attacks, one of 12 directions in LLM safety and security. Builds on 37 of its 67 references that are in the map. First posted on arXiv 1 Nov 2022.

Builds on

37 of 67 references.

References · 37

  1. 2014Deep Learning Face Attributes in the Wildcited by 3,679
  2. 2016Towards Evaluating the Robustness of Neural Networkscited by 2,976
  3. 2016Deep Learning with Differential Privacycited by 2,682
  4. 2016Membership Inference Attacks against Machine Learning Modelscited by 2,221
  5. 2018The Secret Sharer: Evaluating and Testing Unintended Memorization in Neural Networkscited by 847
  6. 2021Membership Inference Attacks From First Principlescited by 839
  7. 2017Ensemble Adversarial Training: Attacks and Defensescited by 833
  8. 2020Fast is better than free: Revisiting adversarial trainingcited by 723
  9. 2019Adversarial Training for Free!cited by 638
  10. 2018Poison Frogs! Targeted Clean-Label Poisoning Attacks on Neural Networkscited by 500
  11. 2018ML-Leaks: Model and Data Independent Membership Inference Attacks and Defenses on Machine Learning Modelscited by 475
  12. 2018Rotation Equivariant CNNs for Digital Pathologycited by 420
25 more
  1. 2019Differential Privacy Has Disparate Impact on Model Accuracycited by 316
  2. 2020Attack of the Tails: Yes, You Really Can Backdoor Federated Learningcited by 307
  3. 2020Systematic Evaluation of Privacy Risks of Machine Learning Modelscited by 273
  4. 2020Data Poisoning Attacks Against Federated Learning Systemscited by 266
  5. 2019White-box vs Black-box: Bayes Optimal Strategies for Membership Inferencecited by 265
  6. 2018Manipulating Machine Learning: Poisoning Attacks and Countermeasures for Regression Learningcited by 219
  7. 2021Adversary Instantiation: Lower Bounds for Differentially Private Machine Learningcited by 193
  8. 2019Stolen Memories: Leveraging Model Memorization for Calibrated White-Box Membership Inferencecited by 168
  9. 2018SpotTune: Transfer Learning through Adaptive Fine-tuningcited by 166
  10. 2020Clean-Label Backdoor Attacks on Video Recognition Modelscited by 162
  11. 2020Membership Leakage in Label-Only Exposurescited by 156
  12. 2020Dynamic Backdoor Attacks Against Machine Learning Modelscited by 147
  13. 2019Privacy Risks of Securing Machine Learning Models against Adversarial Examplescited by 136
  14. 2019Transferable Clean-Label Poisoning Attacks on Deep Neural Netscited by 129
  15. 2020MetaPoison: Practical General-purpose Clean-label Data Poisoningcited by 114
  16. 2020Graph Backdoorcited by 112
  17. 2018A Survey on Data Collection for Machine Learning: a Big Data -- AI Integration Perspectivecited by 111
  18. 2018Adversarial Attacks on Node Embeddings via Graph Poisoningcited by 109
  19. 2014Differentially Private Empirical Risk Minimization: Efficient Algorithms and Tight Error Boundscited by 104
  20. 2022Truth Serum: Poisoning Machine Learning Models to Reveal Their Secretscited by 94
  21. 2016Towards the Science of Security and Privacy in Machine Learningcited by 89
  22. 2021Practical Blind Membership Inference Attack via Differential Comparisonscited by 73
  23. 2019Adversarially robust transfer learningcited by 66
  24. 2021Property Inference From Poisoningcited by 56
  25. 2017LOGAN: Membership Inference Attacks Against Generative Modelscited by 28

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2023: 9; 2024: 8; 2025: 6; 2026: 6.

29 papers.

Sort:

By area:

  1. 2023Students Parrot Their Teachers: Membership Inference on Model Distillationcited by 31
  2. 2024AI Risk Management Should Incorporate Both Safety and Securitycited by 17
  3. 2023ERASER: Machine Unlearning in MLaaS via an Inference Serving-Aware Approachcited by 15
  4. 2024SAP: Corrective Machine Unlearning with Scaled Activation Projection for Label Noise Robustnesscited by 10
  5. 2023SoK: Unintended Interactions among Machine Learning Defenses and Riskscited by 6
  6. 2024A Method to Facilitate Membership Inference Attacks in Deep Learning Modelscited by 6
  7. 2023VertexSerum: Poisoning Graph Neural Networks for Link Inferencecited by 5
  8. 2024Rethinking the impact of noisy labels in graph classification: A utility and privacy perspectivecited by 5
  9. 2025Energy-Latency Attacks: A New Adversarial Threat to Deep Learningcited by 5
  10. 2025Exploiting Leaderboards for Large-Scale Distribution of Malicious Modelscited by 5
  11. 2023Discriminative Adversarial Privacy: Balancing Accuracy and Membership Privacy in Neural Networkscited by 4
  12. 2023Chameleon: Increasing Label-Only Membership Leakage with Adaptive Poisoningcited by 4
17 more
  1. 2023SecurityNet: Assessing Machine Learning Vulnerabilities on Public Modelscited by 4
  2. 2024Efficient and Private: Memorisation under differentially private parameter-efficient fine-tuning in language modelscited by 2
  3. 2025BadReward: Clean-Label Poisoning of Reward Models in Text-to-Image RLHFcited by 2
  4. 2023Membership Inference Attacks on DNNs using Adversarial Perturbationscited by 1
  5. 2024Distributional Black-Box Model Inversion Attack with Multi-Agent Reinforcement Learningcited by 1
  6. 2024On Active Privacy Auditing in Supervised Fine-tuning for White-Box Language Modelscited by 1
  7. 2025The Ripple Effect: On Unforeseen Complications of Backdoor Attackscited by 1
  8. 2025Covert Attacks on Machine Learning Training in Passively Secure MPCcited by 1
  9. 2025Dual-View Inference Attack: Machine Unlearning Amplifies Privacy Exposurecited by 1
  10. 2026SoK: Challenges in Tabular Membership Inference Attackscited by 1
  11. 2026AI Security in the Foundation Model Era: A Comprehensive Survey from a Unified Perspectivecited by 1
  12. 2023Do Backdoors Assist Membership Inference Attacks?cited by 0
  13. 2024Hard Work Does Not Always Pay Off: Poisoning Attacks on Neural Architecture Searchcited by 0
  14. 2026SoK: Enhancing Cryptographic Collaborative Learning with Differential Privacycited by 0
  15. 2026SoK: Colluding Adversaries in Machine Learning Pipelinescited by 0
  16. 2026MemCatalyst: Amplifying Data Auditing on Vision-Language Models via Data Poisoningcited by 0
  17. 2026The Privacy Fallacy of Crowdsourced Fine-Tuning: Extracting Proprietary Data via Topic-Based Poisoningcited by 0