# Data-Poisoning Audits for Causal Effect Estimation

arXiv: https://arxiv.org/abs/2607.19692 · HTML: https://mlsanity.com/paper/2607.19692/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 23 of its 39 references that are in the map.
- First posted on arXiv 22 Jul 2026.

## Builds on (most cited first, 23 of 23)

- [Understanding Black-box Predictions via Influence Functions](https://mlsanity.com/paper/1703.04730/) (2017)
- [Certified Defenses for Data Poisoning Attacks](https://mlsanity.com/paper/1706.03691/) (2017)
- [Manipulating Machine Learning: Poisoning Attacks and Countermeasures for Regression Learning](https://mlsanity.com/paper/1804.00308/) (2018)
- [Semiparametric doubly robust targeted double machine learning: a review](https://mlsanity.com/paper/2203.06469/) (2022)
- [Automated versus do-it-yourself methods for causal inference: Lessons learned from a data analysis competition](https://mlsanity.com/paper/1707.02641/) (2017)
- [Balancing Covariates via Propensity Score Weighting](https://mlsanity.com/paper/1609.07494/) (2016)
- [Bounds on the conditional and average treatment effect with unobserved confounding factors](https://mlsanity.com/paper/1808.09521/) (2018)
- [Causal Inference with Noisy and Missing Covariates via Matrix Factorization](https://mlsanity.com/paper/1806.00811/) (2018)
- [An Evaluation Toolkit to Guide Model Selection and Cohort Definition in Causal Inference](https://mlsanity.com/paper/1906.00442/) (2019)
- [Robust Estimation of Causal Effects via High-Dimensional Covariate Balancing Propensity Score](https://mlsanity.com/paper/1812.08683/) (2018)
- [Partial Identification with Noisy Covariates: A Robust Optimization Approach](https://mlsanity.com/paper/2202.10665/) (2022)
- [Stabilized Inverse Probability Weighting via Isotonic Calibration](https://mlsanity.com/paper/2411.06342/) (2024)
- [Abstract Gradient Training: A Unified Certification Framework for Data Poisoning, Unlearning, and Differential Privacy](https://mlsanity.com/paper/2511.09400/) (2025)
- [Data Poisoning Attacks on Off-Policy Policy Evaluation Methods](https://mlsanity.com/paper/2404.04714/) (2024)
- [Deception by Omission: Using Adversarial Missingness to Poison Causal Structure Learning](https://mlsanity.com/paper/2305.20043/) (2023)
- [Generalization Bounds for Causal Regression: Insights, Guarantees and Sensitivity Analysis](https://mlsanity.com/paper/2405.09516/) (2024)
- [Heavy Tail Robust Estimation and Inference for Average Treatment Effects](https://mlsanity.com/paper/2412.08458/) (2024)
- [Poisoning Bayesian Inference via Data Deletion and Replication](https://mlsanity.com/paper/2503.04480/) (2025)
- [Outlier-Resistant Estimators for Average Treatment Effect in Causal Inference](https://mlsanity.com/paper/2106.13946/) (2021)
- [Quantifying Error in the Presence of Confounders for Causal Inference](https://mlsanity.com/paper/1907.04805/) (2019)
- [Covariate Balancing Methods for Randomized Controlled Trials Are Not Adversarially Robust](https://mlsanity.com/paper/2110.13262/) (2021)
- [Exploiting Missing Data Remediation Strategies using Adversarial Missingness Attacks](https://mlsanity.com/paper/2409.04407/) (2024)
- [A Distributionally Robust Framework for Nuisance in Causal Effect Estimation](https://mlsanity.com/paper/2505.17717/) (2025)

## Abstract (arXiv)

Observational causal analyses increasingly pool records across sites, vendors, and collection systems, creating vulnerability to append-only attacks in which plausible records are strategically selected to alter a reported treatment effect. We develop a data-poisoning audit for augmented inverse-probability-weighted estimation. The analyst specifies a finite catalog of feasible records, an append budget, and nested source capacities, and the adversary selects a feasible subset to maximize movement in a prespecified direction. With preprocessing and nuisance fits held fixed, we propose a greedy scan that computes the exact finite-sample worst-case movement at every append budget. To account for nuisance refitting, we go on to derive a total-influence score combining each record's direct contribution with its effect through the propensity and outcome models. We further obtain a conservative finite-budget bound for the fully refitted estimate. Extensive simulations validate the exact result and show that total influence improves local refit prediction, while multisite and public-data analyses demonstrate material sensitivity at small append budgets. By translating adversarial data-composition risk into movement curves and critical budgets, the framework supports more reliable causal reporting and the design of source-level safeguards.