# Provable one-poison backdoor attacks on linear models and ReLU neural networks

arXiv: https://arxiv.org/abs/2508.05600 · HTML: https://mlsanity.com/paper/2508.05600/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 11 of its 33 references that are in the map.
- First posted on arXiv 7 Aug 2025.

## Builds on (most cited first, 11 of 11)

- [Poison Frogs! Targeted Clean-Label Poisoning Attacks on Neural Networks](https://mlsanity.com/paper/1804.00792/) (2018)
- [Poisoning Retrieval Corpora by Injecting Adversarial Passages](https://mlsanity.com/paper/2310.19156/) (2023)
- [Wild Patterns Reloaded: A Survey of Machine Learning Security against Training Data Poisoning](https://mlsanity.com/paper/2205.01992/) (2022)
- ["Glue pizza and eat rocks" -- Exploiting Vulnerabilities in Retrieval-Augmented Generative Models](https://mlsanity.com/paper/2406.19417/) (2024)
- [Deep Neural Networks with Random Gaussian Weights: A Universal Classification Strategy?](https://mlsanity.com/paper/1504.08291/) (2015)
- [Excess Capacity and Backdoor Poisoning](https://mlsanity.com/paper/2109.00685/) (2021)
- [Few-shot Backdoor Attacks via Neural Tangent Kernels](https://mlsanity.com/paper/2210.05929/) (2022)
- [Generalization Bound and New Algorithm for Clean-Label Backdoor Attack](https://mlsanity.com/paper/2406.00588/) (2024)
- [Demystifying Poisoning Backdoor Attacks from a Statistical Perspective](https://mlsanity.com/paper/2310.10780/) (2023)
- [The poison of dimensionality](https://mlsanity.com/paper/2409.17328/) (2024)
- [NLP Security and Ethics, in the Wild](https://mlsanity.com/paper/2504.06669/) (2025)

## Abstract (arXiv)

Backdoor poisoning attacks are a threat to machine learning models that are trained on data collected from untrusted sources; these attacks enable attackers to inject malicious behavior into the model that can be triggered by specially crafted inputs. Prior work has established bounds on the success of backdoor attacks and their impact on the benign learning task, however, an open question is what amount of poison data is needed for a successful backdoor attack. Typical attacks either use few samples but need much information about the data points, or need to poison many data points. In this paper, we show that an adversary can mount a one-poison backdoor attack without knowledge of individual training data, requiring only coarse geometric bounds of the input space and training parameters. We identify provably sufficient conditions that allow an adversary with one poison sample with high probability to inject a backdoor into linear models and MLPs. We show that our backdoor has zero backdooring error and the injection does not significantly impact the benign learning task performance.