mlsanityData to 7 Oct 2026

CorruptEncoder: Data Poisoning based Backdoor Attacks to Contrastive Learning

arXiv 2211.08229 ↗First posted 15 Nov 2022cs.CR cs.CV cs.LGcited by 28

On the map: LLM safety and security → Backdoor and data poisoning attacks

Abstract (arXiv)

Contrastive learning (CL) pre-trains general-purpose encoders using an unlabeled pre-training dataset, which consists of images or image-text pairs. CL is vulnerable to data poisoning based backdoor attacks (DPBAs), in which an attacker injects poisoned inputs into the pre-training dataset so the encoder is backdoored. However, existing DPBAs achieve limited effectiveness. In this work, we take the first step to analyze the limitations of existing backdoor attacks and propose new DPBAs called CorruptEncoder to CL. CorruptEncoder introduces a new attack strategy to create poisoned inputs and uses a theory-guided method to maximize attack effectiveness. Our experiments show that CorruptEncoder substantially outperforms existing DPBAs. In particular, CorruptEncoder is the first DPBA that achieves more than 90% attack success rates with only a few (3) reference images and a small poisoning ratio 0.5%. Moreover, we also propose a defense, called localized cropping, to defend against DPBAs. Our results show that our defense can reduce the effectiveness of DPBAs, but it sacrifices the utility of the encoder, highlighting the need for new defenses.

Key facts. Cited by 28 papers in the map (data through 7 Oct 2026). Placed in Backdoor and data poisoning attacks, one of 12 directions in LLM safety and security. Builds on 26 of its 38 references that are in the map. First posted on arXiv 15 Nov 2022.

Builds on

26 of 38 references.

Closest ancestors · 2

Same direction, newest first

  1. 2022PoisonedEncoder: Poisoning the Unlabeled Pre-training Data in Contrastive Learning13 May
  2. 2021BadEncoder: Backdoor Attacks to Pre-trained Encoders in Self-Supervised Learning1 Aug

Other references · 24

  1. 2021Learning Transferable Visual Models From Natural Language Supervisioncited by 33,456
  2. 2020A Simple Framework for Contrastive Learning of Visual Representationscited by 11,979
  3. 2014ImageNet Large Scale Visual Recognition Challengecited by 8,441
  4. 2016Grad-CAM: Visual Explanations from Deep Networks via Gradient-based Localizationcited by 6,690
  5. 2020Bootstrap your own latent: A new approach to self-supervised Learningcited by 4,712
  6. 2021Scaling Up Visual and Vision-Language Representation Learning With Noisy Text Supervisioncited by 3,848
  7. 2020Unsupervised Learning of Visual Features by Contrasting Cluster Assignmentscited by 2,845
  8. 2020Improved Baselines with Momentum Contrastive Learningcited by 2,282
  9. 2017BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chaincited by 1,052
  10. 2017Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoningcited by 1,012
  11. 2020Prototypical Contrastive Learning of Unsupervised Representationscited by 636
  12. 2019Hidden Trigger Backdoor Attackscited by 359
12 more
  1. 2020Reflection Backdoor: A Natural Backdoor Attack on Deep Neural Networkscited by 341
  2. 2020Invisible Backdoor Attack with Sample-Specific Triggerscited by 338
  3. 2020How Well Do Self-Supervised Models Transfer?cited by 213
  4. 2019Detecting AI Trojans Using Meta Neural Analysiscited by 192
  5. 2021Poisoning and Backdooring Contrastive Learningcited by 149
  6. 2019TBT: Targeted Neural Network Attack with Bit Trojancited by 112
  7. 2020Intrinsic Certified Robustness of Bagging against Data Poisoning Attackscited by 90
  8. 2021Backdoor Attacks on Self-Supervised Learningcited by 89
  9. 2020On Certifying Robustness against Backdoor Attacks via Randomized Smoothingcited by 74
  10. 2022Crafting Better Contrastive Views for Siamese Representation Learningcited by 67
  11. 2021Mean Shift for Self-Supervised Learningcited by 65
  12. 2020Certified Robustness of Nearest Neighbors against Data Poisoning and Backdoor Attackscited by 58

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2023: 3; 2024: 8; 2025: 9; 2026: 8.

28 papers.

Sort:

By area:

  1. 2023Nightshade: Prompt-Specific Poisoning Attacks on Text-to-Image Generative Modelscited by 72
  2. 2023Detecting Backdoors in Pre-trained Encoderscited by 53
  3. 2024BadMerging: Backdoor Attacks Against Model Mergingcited by 32
  4. 2025Data Poisoning in Deep Learning: A Surveycited by 20
  5. 2025Stealthy Backdoor Attack in Self-Supervised Learning Vision Encoders for Large Vision Language Modelscited by 13
  6. 2023SSL-Cleanse: Trojan Detection and Mitigation in Self-Supervised Learningcited by 11
  7. 2024Mutual Information Guided Backdoor Mitigation for Pre-trained Encoderscited by 8
  8. 2024Semantic Shield: Defending Vision-Language Models Against Backdooring and Poisoning via Fine-grained Knowledge Alignmentcited by 7
  9. 2024DeDe: Detecting Backdoor Samples for SSL Encoders via Decoderscited by 6
  10. 2025Backdooring Self-Supervised Contrastive Learning by Noisy Alignmentcited by 6
  11. 2024Model Supply Chain Poisoning: Backdooring Pre-trained Models via Embedding Indistinguishabilitycited by 5
  12. 2025Retrievals Can Be Detrimental: Unveiling the Backdoor Vulnerability of Retrieval-Augmented Diffusion Modelscited by 5
16 more
  1. 2024Mudjacking: Patching Backdoor Vulnerabilities in Foundation Modelscited by 4
  2. 2025Secure Transfer Learning: Training Clean Models Against Backdoor in (Both) Pre-trained Encoders and Downstream Datasetscited by 3
  3. 2024Breaking PEFT Limitations: Leveraging Weak-to-Strong Knowledge Transfer for Backdoor Attacks in LLMscited by 2
  4. 2025Dataset Ownership Verification for Pre-trained Masked Modelscited by 2
  5. 2025IPBA: Imperceptible Perturbation Backdoor Attack in Federated Self-Supervised Learningcited by 1
  6. 2025Backdoor Vectors: a Task Arithmetic View on Backdoor Attacks and Defensescited by 1
  7. 2026BackdoorIDS: Zero-shot Backdoor Detection for Pretrained Vision Encodercited by 1
  8. 2024Pre-trained Encoder Inference: Revealing Upstream Encoders In Downstream Machine Learning Servicescited by 0
  9. 2025TrojanDec: Data-free Detection of Trojan Inputs in Self-supervised Learningcited by 0
  10. 2026Backdoor Attacks on Multi-modal Contrastive Learningcited by 0
  11. 2026Adjustable Text-Guided Backdoor Attacks with Natural-Word Triggers on Multimodal Pretrained Modelscited by 0
  12. 2026Repurposing and Evaluating the (In)Feasibility of Dataset Poisoning enabled Watermarking for Contrastive Learningcited by 0
  13. 2026Beyond Native Success: Auditing Deployment-Interface Exposure of CLIP Backdoorscited by 0
  14. 2026DEFUSE: Generalizable Backdoor Defense for Self-Supervised Encoders with Generative Priorscited by 0
  15. 2026FIDA: Feature Instability-Driven Attack on Self-Supervised Facial Representationcited by 0
  16. 2026TraceGuard: Adaptive Multimodal Poison Filtering through Cross-Feature Rank Agreementcited by 0