mlsanityData to 7 Oct 2026

PureEBM: Universal Poison Purification via Mid-Run Dynamics of Energy-Based Models

arXiv 2405.19376 ↗First posted 28 May 2024cs.LG cs.AIcited by 0

On the map: LLM safety and security → Backdoor and data poisoning attacks

Abstract (arXiv)

Data poisoning attacks pose a significant threat to the integrity of machine learning models by leading to misclassification of target distribution data by injecting adversarial examples during training. Existing state-of-the-art (SoTA) defense methods suffer from limitations, such as significantly reduced generalization performance and significant overhead during training, making them impractical or limited for real-world applications. In response to this challenge, we introduce a universal data purification method that defends naturally trained classifiers from malicious white-, gray-, and black-box image poisons by applying a universal stochastic preprocessing step PsiT(x), realized by iterative Langevin sampling of a convergent Energy Based Model (EBM) initialized with an image x. Mid-run dynamics of PsiT(x) purify poison information with minimal impact on features important to the generalization of a classifier network. We show that EBMs remain universal purifiers, even in the presence of poisoned EBM training data, and achieve SoTA defense on leading triggered and triggerless poisons. This work is a subset of a larger framework introduced in pgen with a more detailed focus on EBM purification and poison defense.

Key facts. No citing papers in the map yet (data through 7 Oct 2026). Placed in Backdoor and data poisoning attacks, one of 12 directions in LLM safety and security. Builds on 32 of its 43 references that are in the map. First posted on arXiv 28 May 2024.

Builds on

32 of 43 references.

Closest ancestors · 3

Same direction, newest first

  1. 2022Not All Poisons are Created Equal: Robust Training against Data Poisoning18 Oct
  2. 2022Friendly Noise against Adversarial Noise: A Powerful Defense against Data Poisoning Attacks14 Aug
  3. 2021Sleeper Agent: Scalable Hidden Trigger Backdoors for Neural Networks Trained from Scratch16 Jun

Other references · 29

  1. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  2. 2016Deep Learning with Differential Privacycited by 2,682
  3. 2018Spectral Normalization for Generative Adversarial Networkscited by 1,618
  4. 2017BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chaincited by 1,052
  5. 2020Captum: A unified and generic model interpretability library for PyTorchcited by 542
  6. 2018Poison Frogs! Targeted Clean-Label Poisoning Attacks on Neural Networkscited by 500
  7. 2018Detecting Backdoor Attacks on Deep Neural Networks by Activation Clusteringcited by 429
  8. 2019Hidden Trigger Backdoor Attackscited by 359
  9. 2017Certified Defenses for Data Poisoning Attackscited by 288
  10. 2021Anti-Backdoor Learning: Training Clean Models on Poisoned Datacited by 258
  11. 2016A Theory of Generative ConvNetcited by 174
  12. 2020Witches' Brew: Industrial Scale Data Poisoning via Gradient Matchingcited by 156
17 more
  1. 2019Transferable Clean-Label Poisoning Attacks on Deep Neural Netscited by 129
  2. 2020RAB: Provable Robustness Against Backdoor Attackscited by 115
  3. 2020MetaPoison: Practical General-purpose Clean-label Data Poisoningcited by 114
  4. 2020Deep Partition Aggregation: Provable Defense against General Poisoning Attackscited by 112
  5. 2020Just How Toxic is Data Poisoning? A Unified Benchmark for Backdoor and Data Poisoning Attackscited by 109
  6. 2019On the Anatomy of MCMC-Based Maximum Likelihood Learning of Energy-Based Modelscited by 105
  7. 2022Narcissus: A Practical Clean-Label Backdoor Attack with Limited Informationcited by 102
  8. 2020Strong Data Augmentation Sanitizes Poisoning and Backdoor Attacks Without an Accuracy Tradeoffcited by 86
  9. 2020On the Effectiveness of Mitigating Data Poisoning Attacks with Gradient Shapingcited by 82
  10. 2019Data Poisoning against Differentially-Private Learners: Attacks and Defensescited by 75
  11. 2020Bullseye Polytope: A Scalable Clean-Label Poisoning Attack with Improved Transferabilitycited by 65
  12. 2020Stochastic Security: Adversarial Defense Using Long-Run Dynamics of Energy-Based Modelscited by 58
  13. 2021Better Safe Than Sorry: Preventing Delusive Adversaries with Adversarial Trainingcited by 58
  14. 2015Preconditioned Stochastic Gradient Descentcited by 48
  15. 2020Learning to Generate Noise for Multi-Attack Robustnesscited by 17
  16. 2018Preconditioner on Matrix Lie Group for SGDcited by 15
  17. 2022Black Box Lie Group Preconditioners for SGDcited by 8

Built on by

Not cited yet.