mlsanityData to 7 Oct 2026

Exact Certification of Data-Poisoning Attacks Using Mixed-Integer Programming

arXiv 2602.16944 ↗First posted 18 Feb 2026cs.LGcited by 3

On the map: LLM safety and security → Backdoor and data poisoning attacks

Abstract (arXiv)

This work introduces a verification framework that provides both sound and complete guarantees for data poisoning attacks during neural network training. We formulate adversarial data manipulation, model training, and test-time evaluation in a single mixed-integer quadratic programming (MIQCP) problem. Finding the global optimum of the proposed formulation provably yields worst-case poisoning attacks, while simultaneously bounding the effectiveness of all possible attacks on the given training pipeline. Our framework encodes both the gradient-based training dynamics and model evaluation at test time, enabling the first exact certification of training-time robustness. Experimental evaluation on small models confirms that our approach delivers a complete characterization of robustness against data poisoning.

Key facts. Cited by 3 papers in the map (data through 7 Oct 2026). Placed in Backdoor and data poisoning attacks, one of 12 directions in LLM safety and security. Builds on 37 of its 49 references that are in the map. First posted on arXiv 18 Feb 2026.

Builds on

37 of 49 references.

Closest ancestors · 5

Same direction, newest first

  1. 2025Abstract Gradient Training: A Unified Certification Framework for Data Poisoning, Unlearning, and Differential Privacy12 Nov
  2. 2025Keeping up with dynamic attackers: Certifying robustness to adaptive online data poisoning23 Feb
  3. 2024Certified Robustness to Data Poisoning in Gradient-Based Training9 Jun
  4. 2023Run-Off Election: Improved Provable Defense against Data Poisoning Attacks5 Feb
  5. 2022Improved Certified Defenses against Data Poisoning with (Deterministic) Finite Aggregation5 Feb

Other references · 32

  1. 2014Explaining and Harnessing Adversarial Examplescited by 7,287
  2. 2013Intriguing properties of neural networkscited by 5,114
  3. 2017BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chaincited by 1,052
  4. 2017Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoningcited by 1,012
  5. 2017Reluplex: An Efficient SMT Solver for Verifying Deep Neural Networkscited by 739
  6. 2017Provable defenses against adversarial examples via the convex outer adversarial polytopecited by 564
  7. 2018Efficient Neural Network Robustness Certification with General Activation Functionscited by 439
  8. 2017Wild Patterns: Ten Years After the Rise of Adversarial Machine Learningcited by 411
  9. 2018On the Effectiveness of Interval Bound Propagation for Training Verifiably Robust Modelscited by 322
  10. 2017Certified Defenses for Data Poisoning Attackscited by 288
  11. 2023Poisoning Web-Scale Training Datasets is Practicalcited by 276
  12. 2018Towards Fast Computation of Certified Robustness for ReLU Networkscited by 254
20 more
  1. 2017Formal Verification of Piece-Wise Linear Feed-Forward Neural Networkscited by 241
  2. 2017Towards Poisoning of Deep Learning Algorithms with Back-gradient Optimizationcited by 188
  3. 2018Scaling provable adversarial defensescited by 141
  4. 2019Transferable Clean-Label Poisoning Attacks on Deep Neural Netscited by 129
  5. 2018A Dual Approach to Scalable Verification of Deep Networkscited by 125
  6. 2018Strong mixed-integer programming formulations for trained neural networkscited by 115
  7. 2020Deep Partition Aggregation: Provable Defense against General Poisoning Attackscited by 112
  8. 2020Certified Robustness to Label-Flipping Attacks via Randomized Smoothingcited by 103
  9. 2020Learning to Detect Malicious Clients for Robust Federated Learningcited by 86
  10. 2020On the Effectiveness of Mitigating Data Poisoning Attacks with Gradient Shapingcited by 82
  11. 2022Certified Training: Small Boxes are All You Needcited by 51
  12. 2021Partition-based formulations for mixed-integer optimization of trained ReLU neural networkscited by 39
  13. 2023When Deep Learning Meets Polyhedral Theory: A Surveycited by 39
  14. 2022Physical Backdoor Attacks to Lane Detection Systems in Autonomous Drivingcited by 29
  15. 2023A DPLL(T) Framework for Verifying Deep Neural Networkscited by 23
  16. 2018Poisoning Behavioral Malware Clusteringcited by 14
  17. 2024Scaling Mixed-Integer Programming for Certification of Neural Network Controllers Using Bounds Tighteningcited by 6
  18. 2024Certification for Differentially Private Prediction in Gradient-Based Trainingcited by 6
  19. 2024Exact Certification of (Graph) Neural Networks Against Label Poisoningcited by 5
  20. 2024FullCert: Deterministic End-to-End Certification for Training and Inference of Neural Networkscited by 2

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2026: 3.

3 papers.

  1. 2026Relaxation-Informed Training of Neural Network Surrogate Modelscited by 1
  2. 2026Hybrid Robustness Verification for Spatio-Temporal Neural Networkscited by 0
  3. 2026SoK: Formal Methods for Fact-Checking and Information Integritycited by 0