mlsanityData to 7 Oct 2026

PureGen: Universal Data Purification for Train-Time Poison Defense via Generative Model Dynamics

arXiv 2405.18627 ↗First posted 28 May 2024cs.LG cs.AI cs.CRcited by 3

On the map: Diffusion models → Robustness, privacy and adversarial aspects

also in 1 more
Abstract (arXiv)

Train-time data poisoning attacks threaten machine learning models by introducing adversarial examples during training, leading to misclassification. Current defense methods often reduce generalization performance, are attack-specific, and impose significant training overhead. To address this, we introduce a set of universal data purification methods using a stochastic transform, Psi(x), realized via iterative Langevin dynamics of Energy-Based Models (EBMs), Denoising Diffusion Probabilistic Models (DDPMs), or both. These approaches purify poisoned data with minimal impact on classifier generalization. Our specially trained EBMs and DDPMs provide state-of-the-art defense against various attacks (including Narcissus, Bullseye Polytope, Gradient Matching) on CIFAR-10, Tiny-ImageNet, and CINIC-10, without needing attack or classifier-specific information. We discuss performance trade-offs and show that our methods remain highly effective even with poisoned or distributionally shifted generative model training data.

Key facts. Cited by 3 papers in the map (data through 7 Oct 2026). Placed in Robustness, privacy and adversarial aspects, one of 14 directions in Diffusion models. Builds on 39 of its 55 references that are in the map. First posted on arXiv 28 May 2024.

Builds on

39 of 55 references.

Closest ancestors · 2

Same direction, newest first

  1. 2023The Devil's Advocate: Shattering the Illusion of Unexploitable Data using Diffusion Models15 Mar
  2. 2022Diffusion Models for Adversarial Purification16 May

Other references · 37

  1. 2020Denoising Diffusion Probabilistic Modelscited by 20,851
  2. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  3. 2016Deep Learning with Differential Privacycited by 2,682
  4. 2018Spectral Normalization for Generative Adversarial Networkscited by 1,618
  5. 2017BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chaincited by 1,052
  6. 2017Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoningcited by 1,012
  7. 2020Captum: A unified and generic model interpretability library for PyTorchcited by 542
  8. 2018Poison Frogs! Targeted Clean-Label Poisoning Attacks on Neural Networkscited by 500
  9. 2018Spectral Signatures in Backdoor Attackscited by 457
  10. 2018Detecting Backdoor Attacks on Deep Neural Networks by Activation Clusteringcited by 429
  11. 2019Hidden Trigger Backdoor Attackscited by 359
  12. 2017Certified Defenses for Data Poisoning Attackscited by 288
25 more
  1. 2021Anti-Backdoor Learning: Training Clean Models on Poisoned Datacited by 258
  2. 2021Unlearnable Examples: Making Personal Data Unexploitablecited by 188
  3. 2016A Theory of Generative ConvNetcited by 174
  4. 2020Witches' Brew: Industrial Scale Data Poisoning via Gradient Matchingcited by 156
  5. 2019Transferable Clean-Label Poisoning Attacks on Deep Neural Netscited by 129
  6. 2020RAB: Provable Robustness Against Backdoor Attackscited by 115
  7. 2020MetaPoison: Practical General-purpose Clean-label Data Poisoningcited by 114
  8. 2020Deep Partition Aggregation: Provable Defense against General Poisoning Attackscited by 112
  9. 2020Just How Toxic is Data Poisoning? A Unified Benchmark for Backdoor and Data Poisoning Attackscited by 109
  10. 2019On the Anatomy of MCMC-Based Maximum Likelihood Learning of Energy-Based Modelscited by 105
  11. 2022Narcissus: A Practical Clean-Label Backdoor Attack with Limited Informationcited by 102
  12. 2021Sleeper Agent: Scalable Hidden Trigger Backdoors for Neural Networks Trained from Scratchcited by 98
  13. 2020Strong Data Augmentation Sanitizes Poisoning and Backdoor Attacks Without an Accuracy Tradeoffcited by 86
  14. 2020On the Effectiveness of Mitigating Data Poisoning Attacks with Gradient Shapingcited by 82
  15. 2019Data Poisoning against Differentially-Private Learners: Attacks and Defensescited by 75
  16. 2018Shield: Fast, Practical Defense and Vaccination for Deep Learning using JPEG Compressioncited by 74
  17. 2019Learning to Confuse: Generating Training Time Adversarial Data with Auto-Encodercited by 70
  18. 2020Bullseye Polytope: A Scalable Clean-Label Poisoning Attack with Improved Transferabilitycited by 65
  19. 2021Availability Attacks Create Shortcutscited by 60
  20. 2022Adaptive Second Order Coresets for Data-efficient Machine Learningcited by 60
  21. 2020Stochastic Security: Adversarial Defense Using Long-Run Dynamics of Energy-Based Modelscited by 58
  22. 2021Better Safe Than Sorry: Preventing Delusive Adversaries with Adversarial Trainingcited by 58
  23. 2022Not All Poisons are Created Equal: Robust Training against Data Poisoningcited by 29
  24. 2022Friendly Noise against Adversarial Noise: A Powerful Defense against Data Poisoning Attackscited by 20
  25. 2020Learning to Generate Noise for Multi-Attack Robustnesscited by 17

Built on by

Cited by year

Citing papers per year: 2024: 1; 2025: 2.

3 papers.

  1. 2024BridgePure: Limited Protection Leakage Can Break Black-Box Data Protectioncited by 3
  2. 2025Data Security in Large Language Models: Risks, Defense, and Directionscited by 0
  3. 2025PUREVQ-GAN: Defending Data Poisoning Attacks through Vector-Quantized Bottleneckscited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2025Defending Diffusion Models Against Membership Inference Attacks via Higher-Order Langevin Dynamics
  2. 2025Defending Against Frequency-Based Attacks with Diffusion Models
  3. 2024DiffBreak: Is Diffusion-Based Purification Robust?
  4. 2024LoRID: Low-Rank Iterative Diffusion for Adversarial Purification
  5. 2023Leveraging Diffusion-Based Image Variations for Robust Training on Poisoned Data
  6. 2024Towards Understanding the Robustness of Diffusion-Based Purification: A Stochastic Perspective
  7. 2023From Trojan Horses to Castle Walls: Unveiling Bilateral Data Poisoning Effects in Diffusion Models
  8. 2025Divide and Conquer: Heterogeneous Noise Integration for Diffusion-based Adversarial Purification