mlsanityData to 7 Oct 2026

Hard Work Does Not Always Pay Off: Poisoning Attacks on Neural Architecture Search

arXiv 2405.06073 ↗First posted 9 May 2024cs.LG cs.CRcited by 0

On the map: LLM safety and security → Backdoor and data poisoning attacks

Abstract (arXiv)

We study the robustness of data-centric methods to find neural network architectures, known as neural architecture search (NAS), against data poisoning. To audit this robustness, we design a poisoning framework that enables the systematic evaluation of the ability of NAS to produce architectures under data corruption. Our framework examines four off-the-shelf NAS algorithms, representing different approaches to architecture discovery, against four data poisoning attacks, including one we tailor specifically for NAS. In our evaluation with the CIFAR-10 and CIFAR-100 benchmarks, we show that NAS is seemingly robust to data poisoning, showing marginal accuracy drops even under large poisoning budgets. However, we demonstrate that when considering NAS algorithms designed to achieve a few percentage points of accuracy gain, this expected improvement can be substantially diminished under data poisoning. We also show that the reduction varies across NAS algorithms and analyze the factors contributing to their robustness. Our findings are: (1) Training-based NAS algorithms are the least robust due to their reliance on data. (2) Training-free NAS approaches are the most robust but produce architectures that perform similarly to random selections from the search space. (3) NAS algorithms can produce architectures with improved accuracy, even when using out-of-distribution data like MNIST. We lastly discuss potential countermeasures. Our code is available at: https://github.com/ztcoalson/NAS-Robustness-to-Data-Poisoning

Key facts. No citing papers in the map yet (data through 7 Oct 2026). Placed in Backdoor and data poisoning attacks, one of 12 directions in LLM safety and security. Builds on 48 of its 68 references that are in the map. First posted on arXiv 9 May 2024.

Builds on

48 of 68 references.

Closest ancestors · 5

Same direction, newest first

  1. 2023Exploring the Limits of Model-Targeted Indiscriminate Data Poisoning Attacks7 Mar
  2. 2022Amplifying Membership Exposure via Data Poisoning1 Nov
  3. 2022Friendly Noise against Adversarial Noise: A Powerful Defense against Data Poisoning Attacks14 Aug
  4. 2022Indiscriminate Data Poisoning Attacks on Neural Networks19 Apr
  5. 2022Indiscriminate Poisoning Attacks on Unsupervised Contrastive Learning22 Feb

Other references · 43

  1. 2015Deep Residual Learning for Image Recognitioncited by 51,809
  2. 2017Fashion-MNIST: a Novel Image Dataset for Benchmarking Machine Learning Algorithmscited by 4,283
  3. 2019Benchmarking Neural Network Robustness to Common Corruptions and Perturbationscited by 2,857
  4. 2018Neural Tangent Kernel: Convergence and Generalization in Neural Networkscited by 2,597
  5. 2018DARTS: Differentiable Architecture Searchcited by 1,782
  6. 2016Neural Architecture Search with Reinforcement Learningcited by 1,489
  7. 2017Learning Transferable Architectures for Scalable Image Recognitioncited by 1,097
  8. 2017BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chaincited by 1,052
  9. 2018MnasNet: Platform-Aware Neural Architecture Search for Mobilecited by 937
  10. 2018Regularized Evolution for Image Classifier Architecture Searchcited by 902
  11. 2018Efficient Neural Architecture Search via Parameter Sharingcited by 831
  12. 2018ProxylessNAS: Direct Neural Architecture Search on Target Task and Hardwarecited by 666
31 more
  1. 2018Poison Frogs! Targeted Clean-Label Poisoning Attacks on Neural Networkscited by 500
  2. 2017Progressive Neural Architecture Searchcited by 483
  3. 2019Confident Learning: Estimating Uncertainty in Dataset Labelscited by 411
  4. 2017The Effectiveness of Data Augmentation in Image Classification using Deep Learningcited by 368
  5. 2017Certified Defenses for Data Poisoning Attackscited by 288
  6. 2016Designing Neural Network Architectures using Reinforcement Learningcited by 277
  7. 2023Poisoning Web-Scale Training Datasets is Practicalcited by 276
  8. 2019PC-DARTS: Partial Channel Connections for Memory-Efficient Architecture Searchcited by 265
  9. 2019Progressive Differentiable Architecture Search: Bridging the Depth Gap between Search and Evaluationcited by 230
  10. 2017Hierarchical Representations for Efficient Architecture Searchcited by 188
  11. 2019The Evolved Transformercited by 180
  12. 2021Neural Architecture Search on ImageNet in Four GPU Hours: A Theoretically Inspired Perspectivecited by 168
  13. 2020Witches' Brew: Industrial Scale Data Poisoning via Gradient Matchingcited by 156
  14. 2018Stronger Data Poisoning Attacks Break Data Sanitization Defensescited by 125
  15. 2020MetaPoison: Practical General-purpose Clean-label Data Poisoningcited by 114
  16. 2020Deep Partition Aggregation: Provable Defense against General Poisoning Attackscited by 112
  17. 2020Just How Toxic is Data Poisoning? A Unified Benchmark for Backdoor and Data Poisoning Attackscited by 109
  18. 2020Certified Robustness to Label-Flipping Attacks via Randomized Smoothingcited by 103
  19. 2020Strong Data Augmentation Sanitizes Poisoning and Backdoor Attacks Without an Accuracy Tradeoffcited by 86
  20. 2020On the Effectiveness of Mitigating Data Poisoning Attacks with Gradient Shapingcited by 82
  21. 2020DARTS-: Robustly Stepping out of Performance Collapse Without Indicatorscited by 81
  22. 2020NSGANetV2: Evolutionary Multi-Objective Surrogate-Assisted Neural Architecture Searchcited by 75
  23. 2020Bullseye Polytope: A Scalable Clean-Label Poisoning Attack with Improved Transferabilitycited by 65
  24. 2020On the Number of Linear Regions of Convolutional Neural Networkscited by 49
  25. 2018Detection of Adversarial Training Examples in Poisoning Attacks through Anomaly Detectioncited by 43
  26. 2021NASI: Label- and Data-agnostic Neural Architecture Search at Initializationcited by 28
  27. 2024Privacy Backdoors: Enhancing Membership Inference through Poisoning Pre-trained Modelscited by 28
  28. 2020Exploring the Vulnerability of Deep Neural Networks: A Study of Parameter Corruptioncited by 26
  29. 2021ProxyBO: Accelerating Neural Architecture Search via Bayesian Optimization with Zero-cost Proxiescited by 20
  30. 2022Unifying and Boosting Gradient-Based Training-Free Neural Architecture Searchcited by 17
  31. 2024Robustifying and Boosting Training-Free Neural Architecture Searchcited by 4

Built on by

Not cited yet.