PUREVQ-GAN: Defending Data Poisoning Attacks through Vector-Quantized Bottlenecks
On the map: LLM safety and security → Backdoor and data poisoning attacks
Abstract (arXiv)
We introduce PureVQ-GAN, a defense against data poisoning that forces backdoor triggers through a discrete bottleneck using Vector-Quantized VAE with GAN discriminator. By quantizing poisoned images through a learned codebook, PureVQ-GAN destroys fine-grained trigger patterns while preserving semantic content. A GAN discriminator ensures outputs match the natural image distribution, preventing reconstruction of out-of-distribution perturbations. On CIFAR-10, PureVQ-GAN achieves 0% poison success rate (PSR) against Gradient Matching and Bullseye Polytope attacks, and 1.64% against Narcissus while maintaining 91-95% clean accuracy. Unlike diffusion-based defenses requiring hundreds of iterative refinement steps, PureVQ-GAN is over 50x faster, making it practical for real training pipelines.
Key facts. No citing papers in the map yet (data through 14 Oct 2026). Placed in Backdoor and data poisoning attacks, one of 12 directions in LLM safety and security. Builds on 8 of its 16 references that are in the map. First posted on arXiv 30 Sep 2025.
Builds on
8 of 16 references.
Closest ancestors · 2
Same direction, newest first
- 2024PureGen: Universal Data Purification for Train-Time Poison Defense via Generative Model Dynamics28 May
- 2022Friendly Noise against Adversarial Noise: A Powerful Defense against Data Poisoning Attacks14 Aug
Other references · 6
- 2017Neural Discrete Representation Learningcited by 4,712
- 2020Taming Transformers for High-Resolution Image Synthesiscited by 3,253
- 2017BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chaincited by 1,106
- 2020Witches' Brew: Industrial Scale Data Poisoning via Gradient Matchingcited by 163
- 2022Narcissus: A Practical Clean-Label Backdoor Attack with Limited Informationcited by 103
- 2020Bullseye Polytope: A Scalable Clean-Label Poisoning Attack with Improved Transferabilitycited by 66
Built on by
Not cited yet.
Similar, not cited
Close in wording, no citation either way
- 2025VAGUEGAN: Stealthy Poisoning and Backdoor Attacks on Image Generative Pipelines
- 2023Beating Backdoor Attack at Its Own Game
- 2023Silent Killer: A Stealthy, Clean-Label, Black-Box Backdoor Attack
- 2023UltraClean: A Simple Framework to Train Robust Neural Networks against Backdoor Attacks
- 2026Exact Certification of Data-Poisoning Attacks Using Mixed-Integer Programming
- 2021De-Pois: An Attack-Agnostic Defense against Data Poisoning Attacks
- 2025Breaking the Stealth-Potency Trade-off in Clean-Image Backdoors with Generative Trigger Optimization
- 2024PureEBM: Universal Poison Purification via Mid-Run Dynamics of Energy-Based Models