mlsanityData to 7 Oct 2026

Hidden Poison: Machine Unlearning Enables Camouflaged Poisoning Attacks

arXiv 2212.10717 ↗First posted 21 Dec 2022cs.LG cs.AI cs.CRcited by 37

On the map: LLM safety and security → Backdoor and data poisoning attacks

Abstract (arXiv)

We introduce camouflaged data poisoning attacks, a new attack vector that arises in the context of machine unlearning and other settings when model retraining may be induced. An adversary first adds a few carefully crafted points to the training dataset such that the impact on the model's predictions is minimal. The adversary subsequently triggers a request to remove a subset of the introduced points at which point the attack is unleashed and the model's predictions are negatively affected. In particular, we consider clean-label targeted attacks (in which the goal is to cause the model to misclassify a specific test point) on datasets including CIFAR-10, Imagenette, and Imagewoof. This attack is realized by constructing camouflage datapoints that mask the effect of a poisoned dataset.

Key facts. Cited by 37 papers in the map (data through 7 Oct 2026). Placed in Backdoor and data poisoning attacks, one of 12 directions in LLM safety and security. Builds on 48 of its 68 references that are in the map. First posted on arXiv 21 Dec 2022.

Builds on

48 of 68 references.

Closest ancestors · 3

Same direction, newest first

  1. 2022Not All Poisons are Created Equal: Robust Training against Data Poisoning18 Oct
  2. 2022Wild Patterns Reloaded: A Survey of Machine Learning Security against Training Data Poisoning4 May
  3. 2022Indiscriminate Data Poisoning Attacks on Neural Networks19 Apr

Other references · 45

  1. 2015Deep Residual Learning for Image Recognitioncited by 51,809
  2. 2014Adam: A Method for Stochastic Optimizationcited by 36,960
  3. 2019PyTorch: An Imperative Style, High-Performance Deep Learning Librarycited by 20,160
  4. 2014Very Deep Convolutional Networks for Large-Scale Image Recognitioncited by 15,267
  5. 2014ImageNet Large Scale Visual Recognition Challengecited by 8,441
  6. 2018MobileNetV2: Inverted Residuals and Linear Bottleneckscited by 4,773
  7. 2017BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chaincited by 1,052
  8. 2019Machine Unlearningcited by 1,020
  9. 2017Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoningcited by 1,012
  10. 2019Eternal Sunshine of the Spotless Net: Selective Forgetting in Deep Networkscited by 599
  11. 2019Certified Data Removal from Machine Learning Modelscited by 512
  12. 2018Poison Frogs! Targeted Clean-Label Poisoning Attacks on Neural Networkscited by 500
33 more
  1. 2018Spectral Signatures in Backdoor Attackscited by 457
  2. 2019Making AI Forget You: Data Deletion in Machine Learningcited by 447
  3. 2021Remember What You Want to Forget: Algorithms for Machine Unlearningcited by 360
  4. 2019Hidden Trigger Backdoor Attackscited by 359
  5. 2018Not All Samples Are Created Equal: Deep Learning with Importance Samplingcited by 323
  6. 2020Amnesiac Machine Learningcited by 305
  7. 2020Descent-to-Delete: Gradient-Based Methods for Machine Unlearningcited by 303
  8. 2017Certified Defenses for Data Poisoning Attackscited by 288
  9. 2021Unrolling SGD: Understanding Factors Influencing Machine Unlearningcited by 274
  10. 2019Can You Really Backdoor Federated Learning?cited by 250
  11. 2020Approximate Data Deletion from Machine Learning Modelscited by 250
  12. 2017Towards Poisoning of Deep Learning Algorithms with Back-gradient Optimizationcited by 188
  13. 2020When Machine Unlearning Jeopardizes Privacycited by 181
  14. 2020Dataset Security for Machine Learning: Data Poisoning, Backdoor Attacks, and Defensescited by 171
  15. 2021Adaptive Machine Unlearningcited by 164
  16. 2020Mixed-Privacy Forgetting in Deep Networkscited by 158
  17. 2020Witches' Brew: Industrial Scale Data Poisoning via Gradient Matchingcited by 156
  18. 2021Machine Unlearning via Algorithmic Stabilitycited by 128
  19. 2022The Privacy Onion Effect: Memorization is Relativecited by 128
  20. 2018Stronger Data Poisoning Attacks Break Data Sanitization Defensescited by 125
  21. 2020Machine Unlearning for Random Forestscited by 125
  22. 2018Sever: A Robust Meta-Algorithm for Stochastic Optimizationcited by 123
  23. 2020MetaPoison: Practical General-purpose Clean-label Data Poisoningcited by 114
  24. 2020Variational Bayesian Unlearningcited by 114
  25. 2020Just How Toxic is Data Poisoning? A Unified Benchmark for Backdoor and Data Poisoning Attackscited by 109
  26. 2019Analyzing Information Leakage of Updates to Natural Language Modelscited by 89
  27. 2018Technical Report: When Does Machine Learning FAIL? Generalized Transferability for Evasion and Poisoning Attackscited by 78
  28. 2018Label Sanitization against Label Flipping Poisoning Attackscited by 68
  29. 2020Bullseye Polytope: A Scalable Clean-Label Poisoning Attack with Improved Transferabilitycited by 65
  30. 2022Forget Unlearning: Towards True Data-Deletion in Machine Learningcited by 58
  31. 2021Hard to Forget: Poisoning Attacks on Certified Machine Unlearningcited by 47
  32. 2020Towards Probabilistic Verification of Machine Unlearningcited by 46
  33. 2022Support Vector Machines under Adversarial Label Contaminationcited by 15

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2023: 9; 2024: 14; 2025: 10; 2026: 4.

37 papers.

Sort:

By area:

  1. 2023Model Sparsity Can Simplify Machine Unlearningcited by 206
  2. 2023Exploring the Landscape of Machine Unlearning: A Comprehensive Survey and Taxonomycited by 44
  3. 2024Machine Unlearning Fails to Remove Data Poisoning Attackscited by 35
  4. 2024Threats, Attacks, and Defenses in Machine Unlearning: A Surveycited by 34
  5. 2024Machine Unlearning: A Comprehensive Surveycited by 33
  6. 2023Certified Minimax Unlearning with Generalization Rates and Deletion Capacitycited by 29
  7. 2023MultiDelete for Multimodal Machine Unlearningcited by 20
  8. 2024Label-Agnostic Forgetting: A Supervision-Free Unlearning in Deep Modelscited by 18
  9. 2024MU-Bench: A Multitask Multimodal Benchmark for Machine Unlearningcited by 16
  10. 2023ERASER: Machine Unlearning in MLaaS via an Inference Serving-Aware Approachcited by 15
  11. 2023Choosing Public Datasets for Private Machine Learning via Gradient Subspace Distancecited by 14
  12. 2024Unstable Unlearning: The Hidden Risk of Concept Resurgence in Diffusion Modelscited by 14
25 more
  1. 2023Uncovering Adversarial Risks of Test-Time Adaptationcited by 12
  2. 2024Ferrari: Federated Feature Unlearning via Optimizing Feature Sensitivitycited by 11
  3. 2025Towards Lifecycle Unlearning Commitment Management: Measuring Sample-level Unlearning Completenesscited by 11
  4. 2023Ticketed Learning-Unlearning Schemescited by 10
  5. 2025Erased but Not Forgotten: How Backdoors Compromise Concept Erasurecited by 9
  6. 2024Label Smoothing Improves Machine Unlearningcited by 8
  7. 2024Forget Vectors at Play: Universal Input Perturbations Driving Machine Unlearning in Image Classificationcited by 6
  8. 2024Attack and Reset for Unlearning: Exploiting Adversarial Noise toward Machine Unlearning through Parameter Re-initializationcited by 5
  9. 2025CoUn: Empowering Machine Unlearning via Contrastive Learningcited by 4
  10. 2024Exploring Fairness in Educational Data Mining in the Context of the Right to be Forgottencited by 3
  11. 2025ReVeil: Unconstrained Concealed Backdoor Attack on Deep Neural Networks using Machine Unlearningcited by 3
  12. 2025Propaganda AI: An Analysis of Semantic Divergence in Large Language Modelscited by 3
  13. 2025Unlearning's Blind Spots: Over-Unlearning and Prototypical Relearning Attackcited by 3
  14. 2024Releasing Malevolence from Benevolence: The Menace of Benign Data on Machine Unlearningcited by 2
  15. 2023Tailoring Adversarial Attacks on Deep Neural Networks for Targeted Class Manipulation Using DeepFool Algorithmcited by 1
  16. 2024Dataset Condensation Driven Machine Unlearningcited by 1
  17. 2024Unlearn to Relearn Backdoors: Deferred Backdoor Functionality Attacks on Deep Learning Modelscited by 1
  18. 2025Recalling The Forgotten Class Memberships: Unlearned Models Can Be Noisy Labelers to Leak Privacycited by 1
  19. 2025BadFU: Backdoor Federated Learning through Adversarial Machine Unlearningcited by 1
  20. 2026Attack by Unlearning: Unlearning-Induced Adversarial Attacks on Graph Neural Networkscited by 1
  21. 2025How to Protect Models against Adversarial Unlearning?cited by 0
  22. 2025Controllable Machine Unlearning via Gradient Pivotingcited by 0
  23. 2026EVE: Efficient Verification of Data Erasure through Customized Perturbation in Approximate Unlearningcited by 0
  24. 2026ROKA: Robust Knowledge Unlearning against Adversariescited by 0
  25. 2026Reviewing Model Collapse and Countermeasurescited by 0