Protecting against simultaneous data poisoning attacks
On the map: LLM safety and security → Backdoor and data poisoning attacks
Abstract (arXiv)
Current backdoor defense methods are evaluated against a single attack at a time. This is unrealistic, as powerful machine learning systems are trained on large datasets scraped from the internet, which may be attacked multiple times by one or more attackers. We demonstrate that simultaneously executed data poisoning attacks can effectively install multiple backdoors in a single model without substantially degrading clean accuracy. Furthermore, we show that existing backdoor defense methods do not effectively prevent attacks in this setting. Finally, we leverage insights into the nature of backdoor attacks to develop a new defense, BaDLoss, that is effective in the multi-attack setting. With minimal clean accuracy degradation, BaDLoss attains an average attack success rate in the multi-attack setting of 7.98% in CIFAR-10 and 10.29% in GTSRB, compared to the average of other defenses at 64.48% and 84.28% respectively.
Key facts. Cited by 1 paper in the map (data through 7 Oct 2026). Placed in Backdoor and data poisoning attacks, one of 12 directions in LLM safety and security. Builds on 54 of its 72 references that are in the map. First posted on arXiv 23 Aug 2024.
Builds on
54 of 72 references.
Closest ancestors · 4
Same direction, newest first
- 2023Rethinking Backdoor Attacks19 Jul
- 2023Instructions as Backdoors: Backdoor Vulnerabilities of Instruction Tuning for Large Language Models24 May
- 2021Sleeper Agent: Scalable Hidden Trigger Backdoors for Neural Networks Trained from Scratch16 Jun
- 2021Rethinking the Backdoor Attacks' Triggers: A Frequency Perspective7 Apr
Other references · 50
- 2015Deep Residual Learning for Image Recognitioncited by 51,809
- 2022LAION-5B: An open large-scale dataset for training next generation image-text modelscited by 4,131
- 2017BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chaincited by 1,052
- 2017Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoningcited by 1,012
- 2017A Closer Look at Memorization in Deep Networkscited by 936
- 2018Fine-Pruning: Defending Against Backdooring Attacks on Deep Neural Networkscited by 550
- 2021Just Train Twice: Improving Group Robustness without Training Group Informationcited by 522
- 2020What Neural Networks Memorize and Why: Discovering the Long Tail via Influence Estimationcited by 492
- 2018Spectral Signatures in Backdoor Attackscited by 457
- 2019STRIP: A Defence Against Trojan Attacks on Deep Neural Networkscited by 437
- 2018Detecting Backdoor Attacks on Deep Neural Networks by Activation Clusteringcited by 429
- 2020Reflection Backdoor: A Natural Backdoor Attack on Deep Neural Networkscited by 341
38 more
- 2020Invisible Backdoor Attack with Sample-Specific Triggerscited by 338
- 2021Neural Attention Distillation: Erasing Backdoor Triggers from Deep Neural Networkscited by 313
- 2020Input-Aware Dynamic Backdoor Attackcited by 304
- 2019Label-Consistent Backdoor Attackscited by 285
- 2023Poisoning Web-Scale Training Datasets is Practicalcited by 276
- 2021Anti-Backdoor Learning: Training Clean Models on Poisoned Datacited by 258
- 2023Poisoning Language Models During Instruction Tuningcited by 254
- 2019A new Backdoor Attack in CNNs by training set corruption without label poisoningcited by 237
- 2021Adversarial Neuron Pruning Purifies Backdoored Deep Modelscited by 230
- 2021Adversarial Unlearning of Backdoors via Implicit Hypergradientcited by 160
- 2022Backdoor Defense via Decoupling the Training Processcited by 149
- 2018SentiNet: Detecting Localized Universal Attacks Against Deep Learning Systemscited by 148
- 2018Backdoor Embedding in Convolutional Neural Network Models via Invisible Perturbationcited by 131
- 2021SPECTRE: Defending Against Backdoor Attacks Using Robust Statisticscited by 123
- 2019TABOR: A Highly Accurate Approach to Inspecting and Restoring Trojan Backdoors in AI Systemscited by 120
- 2022Narcissus: A Practical Clean-Label Backdoor Attack with Limited Informationcited by 102
- 2020Practical Detection of Trojan Neural Networks: Data-Limited and Data-Free Casescited by 93
- 2022Membership Inference Attacks by Exploiting Loss Trajectorycited by 93
- 2019Defending Neural Backdoors via Generative Distribution Modelingcited by 82
- 2020On the Effectiveness of Mitigating Data Poisoning Attacks with Gradient Shapingcited by 82
- 2022Towards Adversarial Evaluations for Inexact Machine Unlearningcited by 82
- 2021Black-box Detection of Backdoor Attacks with Limited Information and Datacited by 71
- 2019Bypassing Backdoor Detection Algorithms in Deep Learningcited by 69
- 2022Mechanistic Mode Connectivitycited by 50
- 2022Towards A Proactive ML Approach for Detecting Backdoor Poison Samplescited by 40
- 2023Backdoor Defense via Deconfounded Representation Learningcited by 38
- 2021DP-InstaHide: Provably Defusing Poisoning and Backdoor Attacks with Differentially Private Data Augmentationscited by 33
- 2022Post-Training Detection of Backdoor Attacks for Two-Class and Multi-Attack Scenarioscited by 29
- 2022Metadata Archaeology: Unearthing Data Subsets by Leveraging Training Dynamicscited by 26
- 2020Defending against Backdoor Attack on Deep Neural Networkscited by 22
- 2022Selective Prediction via Training Dynamicscited by 20
- 2023Distilling Cognitive Backdoor Patterns within an Imagecited by 20
- 2022Deconstructing Distributions: A Pointwise Framework of Learningcited by 19
- 2021Backdoor Attack through Frequency Domaincited by 18
- 2022Trap and Replace: Defending Backdoor Attacks by Trapping Them into an Easy-to-Replace Subnetworkcited by 12
- 2023On the Difficulty of Defending Contrastive Learning against Backdoor Attackscited by 8
- 2022Towards Effective and Robust Neural Trojan Defenses via Input Filteringcited by 7
- 2021MISA: Online Defense of Trojaned Models using Misattributionscited by 4
Built on by
Citing papers per year: 2026: 1.
1 paper.