mlsanityData to 7 Oct 2026

Exploring the Limits of Model-Targeted Indiscriminate Data Poisoning Attacks

arXiv 2303.03592 ↗First posted 7 Mar 2023cs.LG cs.CRcited by 23

On the map: LLM safety and security → Backdoor and data poisoning attacks

Abstract (arXiv)

Indiscriminate data poisoning attacks aim to decrease a model's test accuracy by injecting a small amount of corrupted training data. Despite significant interest, existing attacks remain relatively ineffective against modern machine learning (ML) architectures. In this work, we introduce the notion of model poisoning reachability as a technical tool to explore the intrinsic limits of data poisoning attacks towards target parameters (i.e., model-targeted attacks). We derive an easily computable threshold to establish and quantify a surprising phase transition phenomenon among popular ML models: data poisoning attacks can achieve certain target parameters only when the poisoning ratio exceeds our threshold. Building on existing parameter corruption attacks and refining the Gradient Canceling attack, we perform extensive experiments to confirm our theoretical findings, test the predictability of our transition threshold, and significantly improve existing indiscriminate data poisoning baselines over a range of datasets and models. Our work highlights the critical role played by the poisoning ratio, and sheds new insights on existing empirical results, attacks and mitigation strategies in data poisoning.

Key facts. Cited by 23 papers in the map (data through 7 Oct 2026). Placed in Backdoor and data poisoning attacks, one of 12 directions in LLM safety and security. Builds on 33 of its 55 references that are in the map. First posted on arXiv 7 Mar 2023.

Builds on

33 of 55 references.

Closest ancestors · 5

Same direction, newest first

  1. 2022Lethal Dose Conjecture on Data Poisoning5 Aug
  2. 2022Autoregressive Perturbations for Data Poisoning8 Jun
  3. 2022Indiscriminate Data Poisoning Attacks on Neural Networks19 Apr
  4. 2022Robustly-reliable learners under poisoning attacks8 Mar
  5. 2022Improved Certified Defenses against Data Poisoning with (Deterministic) Finite Aggregation5 Feb

Other references · 28

  1. 2015Deep Residual Learning for Image Recognitioncited by 51,809
  2. 2019PyTorch: An Imperative Style, High-Performance Deep Learning Librarycited by 20,160
  3. 2013Intriguing properties of neural networkscited by 5,114
  4. 2016SGDR: Stochastic Gradient Descent with Warm Restartscited by 4,993
  5. 2020The Pile: An 800GB Dataset of Diverse Text for Language Modelingcited by 2,346
  6. 2017Understanding Black-box Predictions via Influence Functionscited by 1,714
  7. 2017BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chaincited by 1,052
  8. 2017Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoningcited by 1,012
  9. 2018Spectral Signatures in Backdoor Attackscited by 457
  10. 2017A Downsampled Variant of ImageNet as an Alternative to the CIFAR datasetscited by 374
  11. 2019Hidden Trigger Backdoor Attackscited by 359
  12. 2017Towards Poisoning of Deep Learning Algorithms with Back-gradient Optimizationcited by 188
16 more
  1. 2021Unlearnable Examples: Making Personal Data Unexploitablecited by 188
  2. 2022Datamodels: Predicting Predictions from Training Datacited by 186
  3. 2020Threats to Federated Learning: A Surveycited by 171
  4. 2020Dataset Security for Machine Learning: Data Poisoning, Backdoor Attacks, and Defensescited by 171
  5. 2019Transferable Clean-Label Poisoning Attacks on Deep Neural Netscited by 129
  6. 2018Stronger Data Poisoning Attacks Break Data Sanitization Defensescited by 125
  7. 2018Sever: A Robust Meta-Algorithm for Stochastic Optimizationcited by 123
  8. 2020Adversarial Machine Learning -- Industry Perspectivescited by 121
  9. 2021Back to the Drawing Board: A Critical Evaluation of Poisoning Attacks on Production Federated Learningcited by 116
  10. 2021Adversarial Examples Make Strong Poisonscited by 115
  11. 2020Deep Partition Aggregation: Provable Defense against General Poisoning Attackscited by 112
  12. 2020Bullseye Polytope: A Scalable Clean-Label Poisoning Attack with Improved Transferabilitycited by 65
  13. 2021Availability Attacks Create Shortcutscited by 60
  14. 2021Preventing Unauthorized Use of Proprietary Data: Poisoning for Secure Dataset Releasecited by 35
  15. 2020Exploring the Vulnerability of Deep Neural Networks: A Study of Parameter Corruptioncited by 26
  16. 2021Adversarial Parameter Defense by Multi-Step Risk Minimizationcited by 2

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2023: 1; 2024: 14; 2025: 5; 2026: 3.

23 papers.

Sort:

By area:

  1. 2024Machine Unlearning Fails to Remove Data Poisoning Attackscited by 35
  2. 2024Purify Unlearnable Examples via Rate-Constrained Variational Autoencoderscited by 18
  3. 2024Provably Unlearnable Data Examplescited by 18
  4. 2024AI Risk Management Should Incorporate Both Safety and Securitycited by 17
  5. 2025MTL-UE: Learning to Learn Nothing for Multi-Task Learningcited by 11
  6. 2024Disguised Copyright Infringement of Latent Diffusion Modelscited by 10
  7. 2024Indiscriminate Data Poisoning Attacks on Pre-trained Feature Extractorscited by 8
  8. 2023Transferable Availability Poisoning Attackscited by 5
  9. 2024Distribution Learnability and Robustnesscited by 4
  10. 2024UTrace: Poisoning Forensics for Private Collaborative Learningcited by 3
  11. 2024The poison of dimensionalitycited by 3
  12. 2024Engineering Trustworthy AI: A Developer Guide for Empirical Risk Minimizationcited by 3
11 more
  1. 2024BridgePure: Limited Protection Leakage Can Break Black-Box Data Protectioncited by 3
  2. 2024Adversarial Data Poisoning Attacks on Quantum Machine Learning in the NISQ Eracited by 2
  3. 2024Beyond Full Poisoning: Effective Availability Attacks with Partial Perturbationcited by 1
  4. 2025Stress-Testing ML Pipelines with Adversarial Data Corruptioncited by 1
  5. 2024Hard Work Does Not Always Pay Off: Poisoning Attacks on Neural Architecture Searchcited by 0
  6. 2025Are Targeted Data Poisoning Attacks as Effective as We Think?cited by 0
  7. 2025SecureLearn -- An Attack-agnostic Defense for Multiclass Machine Learning Against Data Poisoning Attackscited by 0
  8. 2025Towards Provably Unlearnable Examples via Bayes Error Optimisationcited by 0
  9. 2026UTOPIA: Unlearnable Tabular Data via Decoupled Shortcut Embeddingcited by 0
  10. 2026When Stronger Triggers Backfire: A High-Dimensional Theory of Backdoor Attackscited by 0
  11. 2026Sequential Data Poisoning in LLM Post-Trainingcited by 0