mlsanityData to 14 Oct 2026

Sharpness-Aware Data Poisoning Attack

arXiv 2305.14851 ↗First posted 24 May 2023cs.CRcited by 10

On the map: LLM safety and security → Backdoor and data poisoning attacks

Abstract (arXiv)

Recent research has highlighted the vulnerability of Deep Neural Networks (DNNs) against data poisoning attacks. These attacks aim to inject poisoning samples into the models' training dataset such that the trained models have inference failures. While previous studies have executed different types of attacks, one major challenge that greatly limits their effectiveness is the uncertainty of the re-training process after the injection of poisoning samples, including the re-training initialization or algorithms. To address this challenge, we propose a novel attack method called ''Sharpness-Aware Data Poisoning Attack (SAPA)''. In particular, it leverages the concept of DNNs' loss landscape sharpness to optimize the poisoning effect on the worst re-trained model. It helps enhance the preservation of the poisoning effect, regardless of the specific retraining procedure employed. Extensive experiments demonstrate that SAPA offers a general and principled strategy that significantly enhances various types of poisoning attacks.

Key facts. Cited by 10 papers in the map (data through 14 Oct 2026). Placed in Backdoor and data poisoning attacks, one of 12 directions in LLM safety and security. Builds on 60 of its 74 references that are in the map. First posted on arXiv 24 May 2023.

Builds on

60 of 74 references.

Closest ancestors · 3

Same direction, newest first

  1. 2022Autoregressive Perturbations for Data Poisoning8 Jun
  2. 2022Indiscriminate Data Poisoning Attacks on Neural Networks19 Apr
  3. 2021Sleeper Agent: Scalable Hidden Trigger Backdoors for Neural Networks Trained from Scratch16 Jun

Other references · 57

  1. 2015Deep Residual Learning for Image Recognitioncited by 52,096
  2. 2021Learning Transferable Visual Models From Natural Language Supervisioncited by 33,744
  3. 2020Language Models are Few-Shot Learnerscited by 32,419
  4. 2020An Image is Worth 16x16 Words: Transformers for Image Recognition at Scalecited by 30,186
  5. 2021High-Resolution Image Synthesis with Latent Diffusion Modelscited by 18,863
  6. 2014Very Deep Convolutional Networks for Large-Scale Image Recognitioncited by 15,364
  7. 2014Explaining and Harnessing Adversarial Examplescited by 7,364
  8. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,415
  9. 2017mixup: Beyond Empirical Risk Minimizationcited by 5,183
  10. 2018MobileNetV2: Inverted Residuals and Linear Bottleneckscited by 4,795
  11. 2021Zero-Shot Text-to-Image Generationcited by 4,288
  12. 2017Improved Regularization of Convolutional Neural Networks with Cutoutcited by 1,628
38 more
  1. 2020Sharpness-Aware Minimization for Efficiently Improving Generalizationcited by 1,417
  2. 2016On Large-Batch Training for Deep Learning: Generalization Gap and Sharp Minimacited by 1,352
  3. 2018Averaging Weights Leads to Wider Optima and Better Generalizationcited by 1,209
  4. 2017Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoningcited by 1,055
  5. 2018Robustness May Be at Odds with Accuracycited by 880
  6. 2017Exploring Generalization in Deep Learningcited by 600
  7. 2017Computing Nonvacuous Generalization Bounds for Deep (Stochastic) Neural Networks with Many More Parameters than Training Datacited by 533
  8. 2018Poison Frogs! Targeted Clean-Label Poisoning Attacks on Neural Networkscited by 519
  9. 2019Fantastic Generalization Measures and Where to Find Themcited by 513
  10. 2018Spectral Signatures in Backdoor Attackscited by 484
  11. 2017Sharp Minima Can Generalize For Deep Netscited by 466
  12. 2018Bilevel Programming for Hyperparameter Optimization and Meta-Learningcited by 405
  13. 2019Hidden Trigger Backdoor Attackscited by 371
  14. 2015Gradient-based Hyperparameter Optimization through Reversible Learningcited by 360
  15. 2016Entropy-SGD: Biasing Gradient Descent Into Wide Valleyscited by 359
  16. 2017A PAC-Bayesian Approach to Spectrally-Normalized Margin Bounds for Neural Networkscited by 314
  17. 2017Certified Defenses for Data Poisoning Attackscited by 303
  18. 2019Label-Consistent Backdoor Attackscited by 296
  19. 2014The Loss Surfaces of Multilayer Networkscited by 280
  20. 2017Forward and Reverse Gradient-Based Hyperparameter Optimizationcited by 234
  21. 2017Towards Poisoning of Deep Learning Algorithms with Back-gradient Optimizationcited by 197
  22. 2021Unlearnable Examples: Making Personal Data Unexploitablecited by 193
  23. 2018Truncated Back-propagation for Bilevel Optimizationcited by 190
  24. 2020Dataset Security for Machine Learning: Data Poisoning, Backdoor Attacks, and Defensescited by 180
  25. 2020Witches' Brew: Industrial Scale Data Poisoning via Gradient Matchingcited by 163
  26. 2019Gradient Descent with Early Stopping is Provably Robust to Label Noise for Overparameterized Neural Networkscited by 159
  27. 2022Towards Understanding Sharpness-Aware Minimizationcited by 146
  28. 2018Stronger Data Poisoning Attacks Break Data Sanitization Defensescited by 135
  29. 2019Transferable Clean-Label Poisoning Attacks on Deep Neural Netscited by 131
  30. 2017A Review on Bilevel Optimization: From Classical to Evolutionary Approaches and Applicationscited by 129
  31. 2022BackdoorBench: A Comprehensive Benchmark of Backdoor Learningcited by 128
  32. 2020MetaPoison: Practical General-purpose Clean-label Data Poisoningcited by 120
  33. 2021Adversarial Examples Make Strong Poisonscited by 119
  34. 2020Just How Toxic is Data Poisoning? A Unified Benchmark for Backdoor and Data Poisoning Attackscited by 116
  35. 2018Is feature selection secure against training data poisoning?cited by 93
  36. 2020A Generic First-Order Algorithmic Framework for Bi-Level Programming Beyond Lower-Level Singletoncited by 79
  37. 2020Bullseye Polytope: A Scalable Clean-Label Poisoning Attack with Improved Transferabilitycited by 66
  38. 2022How Does Sharpness-Aware Minimization Minimize Sharpness?cited by 65

50 most cited of 57 All 57 (JSON)

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2023: 1; 2024: 5; 2025: 2; 2026: 2.

10 papers.

  1. 2024Copyright Protection in Generative AI: A Technical Perspectivecited by 38
  2. 2024Data Poisoning for In-context Learningcited by 21
  3. 2024Provably Unlearnable Data Examplescited by 18
  4. 2024Toward Availability Attacks in 3D Point Cloudscited by 7
  5. 2023Safe and Robust Watermark Injection with a Single OoD Imagecited by 3
  6. 2025Circumventing Backdoor Space via Weight Symmetrycited by 2
  7. 2025Class-Conditional Neural Polarizer: A Lightweight and Effective Backdoor Defense by Purifying Poisoned Featurescited by 1
  8. 2024Deferred Poisoning: Making the Model More Vulnerable via Hessian Singularizationcited by 0
  9. 2026Sharpness-Aware Poisoning: Enhancing Transferability of Injective Attacks on Recommender Systemscited by 0
  10. 2026Certification of Machine Learning Models via Directional Sharpnesscited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2025Data Poisoning in Deep Learning: A Survey
  2. 2022Not All Poisons are Created Equal: Robust Training against Data Poisoning
  3. 2021Poison Forensics: Traceback of Data Poisoning Attacks in Neural Networks
  4. 2024Reliable Poisoned Sample Detection against Backdoor Attacks Enhanced by Sharpness Aware Minimization
  5. 2024Have You Poisoned My Data? Defending Neural Networks against Data Poisoning
  6. 2023Pick your Poison: Undetectability versus Robustness in Data Poisoning Attacks
  7. 2022Wild Patterns Reloaded: A Survey of Machine Learning Security against Training Data Poisoning
  8. 2023Exploring the Limits of Model-Targeted Indiscriminate Data Poisoning Attacks