mlsanityData to 14 Oct 2026

Label Poisoning is All You Need

arXiv 2310.18933 ↗First posted 29 Oct 2023cs.LG cs.CR cs.CVcited by 29

On the map: LLM safety and security → Backdoor and data poisoning attacks

Abstract (arXiv)

In a backdoor attack, an adversary injects corrupted data into a model's training dataset in order to gain control over its predictions on images with a specific attacker-defined trigger. A typical corrupted training example requires altering both the image, by applying the trigger, and the label. Models trained on clean images, therefore, were considered safe from backdoor attacks. However, in some common machine learning scenarios, the training labels are provided by potentially malicious third-parties. This includes crowd-sourced annotation and knowledge distillation. We, hence, investigate a fundamental question: can we launch a successful backdoor attack by only corrupting labels? We introduce a novel approach to design label-only backdoor attacks, which we call FLIP, and demonstrate its strengths on three datasets (CIFAR-10, CIFAR-100, and Tiny-ImageNet) and four architectures (ResNet-32, ResNet-18, VGG-19, and Vision Transformer). With only 2% of CIFAR-10 labels corrupted, FLIP achieves a near-perfect attack success rate of 99.4% while suffering only a 1.8% drop in the clean test accuracy. Our approach builds upon the recent advances in trajectory matching, originally introduced for dataset distillation.

Key facts. Cited by 29 papers in the map (data through 14 Oct 2026). Placed in Backdoor and data poisoning attacks, one of 12 directions in LLM safety and security. Builds on 74 of its 100 references that are in the map. First posted on arXiv 29 Oct 2023.

Builds on

74 of 100 references.

Closest ancestors · 3

Same direction, newest first

  1. 2022Versatile Weight Attack via Flipping Limited Bits25 Jul
  2. 2021Spinning Language Models: Risks of Propaganda-As-A-Service and Countermeasures9 Dec
  3. 2021Manipulating SGD with Data Ordering Attacks19 Apr

Other references · 71

  1. 2020An Image is Worth 16x16 Words: Transformers for Image Recognition at Scalecited by 30,186
  2. 2015Distilling the Knowledge in a Neural Networkcited by 10,324
  3. 2016Generative Adversarial Imitation Learningcited by 1,597
  4. 2018A Simple Unified Framework for Detecting Out-of-Distribution Samples and Adversarial Attackscited by 1,485
  5. 2020D4RL: Datasets for Deep Data-Driven Reinforcement Learningcited by 1,427
  6. 2017Enhancing The Reliability of Out-of-distribution Image Detection in Neural Networkscited by 1,328
  7. 2017BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chaincited by 1,106
  8. 2017Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoningcited by 1,055
  9. 2019Adversarial Examples Are Not Bugs, They Are Featurescited by 953
  10. 2018How To Backdoor Federated Learningcited by 765
  11. 2018Fine-Pruning: Defending Against Backdooring Attacks on Deep Neural Networkscited by 580
  12. 2019Patient Knowledge Distillation for BERT Model Compressioncited by 508
38 more
  1. 2019Be Your Own Teacher: Improve the Performance of Convolutional Neural Networks via Self Distillationcited by 497
  2. 2018Spectral Signatures in Backdoor Attackscited by 484
  3. 2018An Algorithmic Perspective on Imitation Learningcited by 459
  4. 2019STRIP: A Defence Against Trojan Attacks on Deep Neural Networkscited by 459
  5. 2018Detecting Backdoor Attacks on Deep Neural Networks by Activation Clusteringcited by 456
  6. 2020Backdoor Learning: A Surveycited by 426
  7. 2019Hidden Trigger Backdoor Attackscited by 371
  8. 2020Reflection Backdoor: A Natural Backdoor Attack on Deep Neural Networkscited by 349
  9. 2021Neural Attention Distillation: Erasing Backdoor Triggers from Deep Neural Networkscited by 324
  10. 2019Robust Aggregation for Federated Learningcited by 317
  11. 2020Attack of the Tails: Yes, You Really Can Backdoor Federated Learningcited by 309
  12. 2017Certified Defenses for Data Poisoning Attackscited by 303
  13. 2019Label-Consistent Backdoor Attackscited by 296
  14. 2019Structured Knowledge Distillation for Dense Predictioncited by 279
  15. 2019Can You Really Backdoor Federated Learning?cited by 255
  16. 2019A new Backdoor Attack in CNNs by training set corruption without label poisoningcited by 242
  17. 2020Dataset Meta-Learning from Kernel Ridge-Regressioncited by 230
  18. 2020Auditing Differentially Private Machine Learning: How Private is Private SGD?cited by 218
  19. 2021Dataset Distillation with Infinitely Wide Convolutional Networkscited by 218
  20. 2020Blind Backdoors in Deep Learning Modelscited by 182
  21. 2020Clean-Label Backdoor Attacks on Video Recognition Modelscited by 169
  22. 2020Witches' Brew: Industrial Scale Data Poisoning via Gradient Matchingcited by 163
  23. 2022Backdoor Defense via Decoupling the Training Processcited by 153
  24. 2018SentiNet: Detecting Localized Universal Attacks Against Deep Learning Systemscited by 152
  25. 2019Universal Litmus Patterns: Revealing Backdoor Attacks in CNNscited by 146
  26. 2018Stronger Data Poisoning Attacks Break Data Sanitization Defensescited by 135
  27. 2018Backdoor Embedding in Convolutional Neural Network Models via Invisible Perturbationcited by 134
  28. 2021SPECTRE: Defending Against Backdoor Attacks Using Robust Statisticscited by 130
  29. 2023Privacy Auditing with One (1) Training Runcited by 123
  30. 2020RAB: Provable Robustness Against Backdoor Attackscited by 118
  31. 2020Just How Toxic is Data Poisoning? A Unified Benchmark for Backdoor and Data Poisoning Attackscited by 116
  32. 2019TBT: Targeted Neural Network Attack with Bit Trojancited by 113
  33. 2019Soft-Label Dataset Distillation and Text Dataset Distillationcited by 107
  34. 2020An Embarrassingly Simple Approach for Trojan Attack in Deep Neural Networkscited by 97
  35. 2023SCALE-UP: An Efficient Black-box Input-level Backdoor Detection via Analyzing Scaled Prediction Consistencycited by 97
  36. 2020Flexible Dataset Distillation: Learn Labels Instead of Imagescited by 91
  37. 2022Untargeted Backdoor Watermark: Towards Harmless and Stealthy Dataset Copyright Protectioncited by 86
  38. 2018Byzantine Stochastic Gradient Descentcited by 81

50 most cited of 71 All 71 (JSON)

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2024: 12; 2025: 9; 2026: 8.

29 papers.

Sort:

By area:

  1. 2025Data Poisoning in Deep Learning: A Surveycited by 20
  2. 2024BackdoorBench: A Comprehensive Benchmark and Analysis of Backdoor Learningcited by 19
  3. 2024Understanding the Gains from Repeated Self-Distillationcited by 15
  4. 2024Preference Poisoning Attacks on Reward Model Learningcited by 14
  5. 2024Exact Certification of (Graph) Neural Networks Against Label Poisoningcited by 6
  6. 2025Adversarial Training for Defense Against Label Poisoning Attackscited by 6
  7. 2025LLM Misalignment via Adversarial RLHF Platformscited by 5
  8. 2026Revisiting Backdoor Threat in Federated Instruction Tuning from a Signal Aggregation Perspectivecited by 5
  9. 2024Injecting Undetectable Backdoors in Obfuscated Neural Networks and Language Modelscited by 3
  10. 2024Guarding the Gate: ConceptGuard Battles Concept-Level Backdoors in Concept Bottleneck Modelscited by 3
  11. 2025Q-Detection: A Quantum-Classical Hybrid Poisoning Attack Detection Methodcited by 3
  12. 2026From Internal Diagnosis to External Auditing: A VLM-Driven Paradigm for Data-Free Online Backdoor Defensecited by 3
17 more
  1. 2024CAT: Concept-level backdoor ATtacks for Concept Bottleneck Modelscited by 1
  2. 2024Unlearn to Relearn Backdoors: Deferred Backdoor Functionality Attacks on Deep Learning Modelscited by 1
  3. 2025LexiMark: Robust Watermarking via Lexical Substitutions to Enhance Membership Verification of an LLM's Textual Training Datacited by 1
  4. 2025Detect & Score: Privacy-Preserving Misbehaviour Detection and Contribution Evaluation in Federated Learningcited by 1
  5. 2024BackdoorBench: A Comprehensive Benchmark and Analysis of Backdoor Learningcited by 0
  6. 2024Hidden in Plain Sight: Undetectable Adversarial Bias Attacks on Vulnerable Patient Populationscited by 0
  7. 2024Composite Concept Extraction through Backdooringcited by 0
  8. 2024Impact of Inaccurate Contamination Ratio on Robust Unsupervised Anomaly Detectioncited by 0
  9. 2025Robustness of Selected Learning Models under Label-Flipping Attackcited by 0
  10. 2025Approaching the Harm of Gradient Attacks While Only Flipping Labelscited by 0
  11. 2025Surveying the Operational Cybersecurity and Supply Chain Threat Landscape when Developing and Deploying AI Systemscited by 0
  12. 2026Topology-Independent Robustness of the Weighted Mean under Label Poisoning Attacks in Heterogeneous Decentralized Learningcited by 0
  13. 2026One RNG to Rule Them All: How Randomness Becomes an Attack Vector in Machine Learningcited by 0
  14. 2026It Takes One to Bias Them All: Breaking Bad with One-Shot GRPOcited by 0
  15. 2026Anti-Backdoor Coreset Selection via Cumulative Entropycited by 0
  16. 2026STAR-FL: Secure Federated Learning with Spatial-Temporal Analysis and Robust Aggregationcited by 0
  17. 2026Space Over Statistic, Retraining Over Ranking: Auditing Training Labels Under Label-Only Backdoorscited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2024Clean-image Backdoor Attacks
  2. 2023Towards Sample-specific Backdoor Attack with Clean Labels via Attribute Trigger
  3. 2022Narcissus: A Practical Clean-Label Backdoor Attack with Limited Information
  4. 2024A Backdoor Approach with Inverted Labels Using Dirty Label-Flipping Attacks
  5. 2022Enhancing Clean Label Backdoor Attack with Two-phase Specific Triggers
  6. 2024Impart: An Imperceptible and Effective Label-Specific Backdoor Attack
  7. 2024Clean-Label Physical Backdoor Attacks with Data Distillation
  8. 2023Adversarial Clean Label Backdoor Attacks and Defenses on Text Classification Systems