---
kind: concept
slug: data-poisoning
title: Data poisoning (attacks on training data and sanitization defenses)
summary: >-
  Training data can be poisoned on purpose, or perturbed by owners to resist learning. Clean-label polytope poisons transfer to unseen victims (author-reported). Outlier sanitization is the classic defense, and one survey finds none held up. LLM-written fakes in a retrieval corpus cut QA exact match by up to 87% (author-reported).
tags: [security, data-quality, robustness, privacy]
papers: ["1905.05897", "2012.10544", "2101.04535", "2101.04898", "2101.05428", "2108.11577", "2112.06409", "2305.13661", "2402.00888"]
related: [dataset-curation, noisy-labels, algorithmic-fairness, adversarial-robustness, backdoor-attack, differential-privacy, face-recognition, federated-learning, retrieval-augmented-generation, ai-generated-text-detection, machine-unlearning, transfer-learning]
status: draft
updated_at: 2026-11-01
---

## Overview

Training data can be altered on purpose, not only by accident. An attacker who
can insert or change training samples can try to change what the trained model
does. The data-centric survey treats this as part of data sanitization, one
step in the path from data collection to model training, next to data
validation and cleaning [arxiv:2112.06409 §3] [arxiv:2112.06409 tab. 1]. The
LLM security survey places data poisoning next to backdoors in its
adversarial-attack family, for language models trained on large amounts of
web text [arxiv:2402.00888 §3] [arxiv:2402.00888 tab. 3]. A third paper uses
crafted training samples in another role: as the attacker's tool for measuring
how much privacy DP-SGD really gives, where the goal is to measure leakage
rather than to change model behaviour [arxiv:2101.04535 §1] [arxiv:2101.04535 §3.2].
A fourth paper turns the idea around: data owners perturb their own images
before publishing them, so that a model trained on the published copies learns
little from them [arxiv:2101.04898 §1] [arxiv:2101.04898 §3.1]. A fifth
paper changes the target. Its generated passages go into the evidence corpus
that an open-domain question-answering system retrieves from, not into any
training set [arxiv:2305.13661 §1] [arxiv:2305.13661 §3.2].

A broader survey puts training-only poisoning, backdoors and federated settings
into one taxonomy, and sorts defenses by whether they check the data, check the
model, or repair a model after training [arxiv:2012.10544 §1] [arxiv:2012.10544 §4].
A federated learning survey covers poisoning of client data in the same way, as
one of several attack surfaces, with a defense that screens client updates
[arxiv:2101.05428 §6.2] [arxiv:2101.05428 §6.2.1]. Backdoors, where a trigger is
needed at test time, have their own page: see
[backdoor-attack](/concepts/backdoor-attack).

The two defensive papers share one idea: a defense looks for suspicious
training samples and removes or neutralises them before or during training.
The data-centric survey cites a study concluding that no evaluated defense held
up against carefully designed attacks [arxiv:2112.06409 §3.3]. The LLM security
survey names defenses for poisoning but reports no effectiveness figures for
them [arxiv:2402.00888 §6.1]. The audit paper does not report defense results.
Its figures are empirical lower bounds on privacy leakage for the attacks it
tests [arxiv:2101.04535 §4.1].

## Variants

### Classic poisoning attacks (taxonomy, with two formulations)

The taxonomy survey sorts training-only attacks by how the poison is crafted
and by whether the victim trains from scratch or fine-tunes a pre-trained model
[arxiv:2012.10544 §1]. Its families are feature collision [§2.2], bilevel
optimisation [§2.3], label flipping [§2.4], influence-function methods [§2.5],
online and p-tampering attacks [§2.6] and federated poisoning [§2.7]. Two
formulations are given. Feature collision crafts a poison whose features move
toward a target's while the image stays close to a base-class image,
so the poison keeps its base label [arxiv:2012.10544 eq. 1] [arxiv:2012.10544 §2.2].
The bilevel problem trains the victim on poisons plus clean data, and scores
the poison set by whether the target then gets the adversary's label
[arxiv:2012.10544 eq. 2] [arxiv:2012.10544 §2.3]. The survey does not state
the weight in the first formulation or the poison budget in the second
[arxiv:2012.10544 eq. 1] [arxiv:2012.10544 eq. 2]. For a benchmark, the survey
summarises a cited comparison of poisoning methods in standard settings:
Witches' Brew did best on from-scratch CIFAR-10, and Bullseye Polytope did
better on Tiny-ImageNet [arxiv:2012.10544 §2.8] [arxiv:2012.10544 §2.3]. These are the
authors' summaries of cited work, not new results.

The data-centric survey names two attack families for poisoning training data,
feature collision and convex polytope attacks, for tabular and image data
[arxiv:2112.06409 §3.3] [arxiv:2112.06409 tab. 1]. It names them as the threat
but gives no algorithm, parameters or results for either one
[arxiv:2112.06409 §3.3]. The convex polytope attack has its own card, in the
next section. Cards: [taxonomy survey, arXiv:2012.10544](/papers/2012.10544);
[data-centric survey, arXiv:2112.06409](/papers/2112.06409).

### Clean-label convex polytope attack (black-box transfer, experimental)

This attack keeps every poison's true label, so a person checking labels sees
nothing wrong. The attacker needs no victim outputs or weights, only similar
training data to train substitute networks on [arxiv:1905.05897 §2]. For each
substitute, the objective asks the target's features to lie inside the convex
hull of the poisons' features. The coefficients are fitted separately for each
model, and the poison pixels stay within an epsilon box around their base
images [arxiv:1905.05897 eq. 3] [arxiv:1905.05897 §3.3]. The paper's Proposition 1 gives
this condition, and says it is weaker than feature collision, so the poisons
can sit farther from the target [arxiv:1905.05897 §3.3]. The substitutes use Dropout
while the poisons are crafted [arxiv:1905.05897 §3.6].

In the paper's CIFAR-10 transfer-learning setup, five ship poisons (1% of the
500 fine-tuning images) are used against one frog target [arxiv:1905.05897 §4].
The paper reports that the convex polytope objective transfers better than
feature collision, and that feature collision stays at or below 0.5
[arxiv:1905.05897 §4.1]. The abstract's headline is more than 50% transfer
success at 1% poisoning, but the paper does not define success in its text
[arxiv:1905.05897 §4.1]. End-to-end training needs a different form. The
last-layer objective almost never succeeds, while a multi-layer version that
also matches shallow cuts of the substitute reports above 0.6 for the gray-box
victims it tests [arxiv:1905.05897 §4.3] [arxiv:1905.05897 eq. 4]. Per-victim
values are only shown in a bar chart [arxiv:1905.05897 fig. 5]. Card:
[Transferable Clean-Label Poisoning Attacks on Deep Neural Nets, arXiv:1905.05897](/papers/1905.05897).

### Removing known poisoned labels from a trained model (unlearning, experimental)

This is a repair after training, not a sanitization step. When the poisoned
points are known, the trained model is corrected without retraining. The
unlearning paper replaces the wrong labels of the affected points with corrected
ones, and updates the model with a closed-form step derived from influence
functions [arxiv:2108.11577 §4.1] [arxiv:2108.11577 §5]. The first-order step
needs a rate tau, while the second-order step needs an inverse-Hessian-vector
product and no rate [arxiv:2108.11577 §5.1] [arxiv:2108.11577 §5.2].

On a CIFAR-10 CNN with 2500 poisoned labels, both update rules and fine-tuning
come close to the clean model's accuracy. The first-order update took about
10 s, against more than 15 minutes for retraining [arxiv:2108.11577 §7.3]
[arxiv:2108.11577 fig. 9]. With 10000 poisoned labels, no method restored the
clean accuracy [arxiv:2108.11577 §7.3]. In that experiment only the
fully connected layers were updated [arxiv:2108.11577 §7.3]. For neural
networks the paper gives no guarantee and checks results only with outside
measures [arxiv:2108.11577 §8]. The method also assumes that the points to
remove are already known; finding them is out of scope [arxiv:2108.11577 §8].
Card: [Machine Unlearning of Features and Labels, arXiv:2108.11577](/papers/2108.11577).

### Federated poisoning (named in a survey, no algorithm)

In federated learning, an adversary poisons the training data of some devices,
directly or through other devices, and the attack can be targeted or
non-targeted [arxiv:2101.05428 §6.2]. The survey's stated defense is to identify
malicious participants from their model updates before averaging each round
[arxiv:2101.05428 §6.2.1]. It gives no detection rule, threshold or result for
that defense [arxiv:2101.05428 §6.2.1]. The taxonomy survey treats the same
setting, with its own note on screening under secure aggregation
[arxiv:2012.10544 §2.7]. Card: [Federated Learning: Opportunities and Challenges, arXiv:2101.05428](/papers/2101.05428).

### Poisoning of LLM and generative-model training data (named, not described)

The LLM security survey lists poisoning attacks on language and generative
models: TrojanLM, TrojanPuzzle, AgentPoison, CodeBreaker, "You autocomplete
me", NightShade and AutoPoison, plus Shadowcast for vision-language models
[arxiv:2402.00888 tab. 3] [arxiv:2402.00888 §4.2.2]. It gives no algorithm for
any of them. The two sample counts it quotes are author-reported from the cited
works: Shadowcast needs as few as 50 poisoned samples for vision-language
models, and NightShade as few as 100 poisoned instances for text-to-image
models [arxiv:2402.00888 §4.2.2]. The two counts are for different modalities
and are not comparable. The survey also says most attacks and defenses in its
review were designed or tested on small models, not LLMs [arxiv:2402.00888 §8].
Card: [LLM security and privacy survey, arXiv:2402.00888](/papers/2402.00888).

### Pollution of a retrieval corpus with LLM-written text (experimental)

This variant does not change training data. The paper adds generated passages
to the corpus that a retriever searches, and a reader answers from the passages
it retrieves [arxiv:2305.13661 §1] [arxiv:2305.13661 §4.2]. The generator is
GPT-3.5 (`text-davinci-003`), used zero-shot [arxiv:2305.13661 §3.1]. It writes
one fake passage per question in each of four settings: a background document
(Benign), a document that supports a chosen false answer (Gen), an edited real
passage (Imi), and a false answer rephrased ten ways, aimed at the reader (Hack)
[arxiv:2305.13661 §3.2] [arxiv:2305.13661 §4.3]. Under Gen, Imi and Hack, exact
match falls 14% to 54% for the DPR-based setups and 20% to 87% for the
BM25-based setups [arxiv:2305.13661 §4.4] [arxiv:2305.13661 tab. 2]. Hack does
the most damage. With BM25 on NQ-1500, a fake passage was in the top 10 for
96.80% of questions [arxiv:2305.13661 tab. 7]. The authors estimate $0.01 to
$0.04 per 200-word fake document, at the prices of the time [arxiv:2305.13661 §6].
All numbers are author-reported on NQ-1500 and a 2020 COVID news subset
[arxiv:2305.13661 §4.1]. Card: [On the Risk of Misinformation Pollution with LLMs, arXiv:2305.13661](/papers/2305.13661).

### Poisoning as a privacy audit of DP-SGD (experimental)

The audit paper puts crafted training examples inside an attack game that tests
the differential-privacy guarantee of DP-SGD [arxiv:2101.04535 §3.2]. A
crafter prepares two training sets that differ by one example, a trainer picks
one at random, and a distinguisher guesses which one was used
[arxiv:2101.04535 §3.2]. Six settings differ in what the distinguisher sees and
what the crafter may change [arxiv:2101.04535 tab. 1]. For CIFAR-10 at target
epsilon 4, the black-box API-access setting gives an empirical lower bound of
0.31 [arxiv:2101.04535 §4.1]. The dataset attack, which uses gradient access
and a malicious dataset, gives 3.6 against the same proven epsilon of 4
[arxiv:2101.04535 §4.6]. The paper reports these as author-reported values, and
most of its bounds appear only in figures [arxiv:2101.04535 fig. 3]
[arxiv:2101.04535 fig. 8]. Card: [Adversary Instantiation, arXiv:2101.04535](/papers/2101.04535).

### Poisoning as data protection: unlearnable examples (experimental)

Here the owner of the data is the one who adds the noise. The unlearnable-examples
paper perturbs each image before it is published, within an L-infinity bound of
8/255 for CIFAR-10, CIFAR-100 and SVHN, and 16/255 for its ImageNet subset
[arxiv:2101.04898 §4] [arxiv:2101.04898 app. B]. The noise is error-minimizing:
a ResNet-18 source model is trained alongside it, and the noise is updated to
lower that model's loss on each example, in an alternating loop
[arxiv:2101.04898 §3.2] [arxiv:2101.04898 alg. 1]. It comes in two forms: one
pattern per class (class-wise) and one per image (sample-wise)
[arxiv:2101.04898 §3.1]. On CIFAR-10 with ResNet-18, class-wise noise cuts clean
test accuracy to 16.42%, against 94.95% for clean training
[arxiv:2101.04898 tab. 2]. Across four target models, class-wise noise leaves
13% to 17% accuracy on CIFAR-10 [arxiv:2101.04898 tab. 1]. The paper also reports
a face recognition case study, with 16% accuracy on the protected identities
against 86% on clean ones [arxiv:2101.04898 §4.5]. All numbers are author-reported.
Card: [Unlearnable Examples, arXiv:2101.04898](/papers/2101.04898).

### Outlier-based sanitization (the usual defense for classic poisoning)

Sanitization defends against poisoned training data, usually by outlier
detection that discards suspicious points [arxiv:2112.06409 §3.3]
[arxiv:2112.06409 fig. 5]. The survey gives no detector, score, or drop rate, so
the choice is open [arxiv:2112.06409 §3.3]. The taxonomy survey notes that
outlier-based defenses can be bypassed by adaptive poisons placed close
together [arxiv:2012.10544 §4.1.1]. Cards: [data-centric survey, arXiv:2112.06409](/papers/2112.06409);
[taxonomy survey, arXiv:2012.10544](/papers/2012.10544).

### Defenses named for LLM-era poisoning (no effectiveness figures)

For the poisoning attacks above, the LLM security survey names these defenses:
static analysis, STRIP, fine-pruning, data curation, query rephrasing and
perplexity filtering [arxiv:2402.00888 tab. 3] [arxiv:2402.00888 §6.1]. Its
results table reports no effectiveness numbers for any of them against
poisoning. The survey's defense figures are for jailbreak defenses, not
poisoning defenses [arxiv:2402.00888 §6.1]. Card: [LLM security and privacy survey, arXiv:2402.00888](/papers/2402.00888).

### Detection, warning prompts and voting for corpus pollution (preliminary)

These defenses address the retrieval setting above. The paper calls all three
preliminary [arxiv:2305.13661 §5]. A RoBERTa classifier that tells generated
passages from human ones reaches AUROC 99.7 for Gen, 91.4 for Imi and 99.8 for
Hack when trained on in-domain NQ-1500 passages. Trained on GPT-3 Wikipedia
completions instead, it reaches 64.8, 50.7 and 52.6 [arxiv:2305.13661 tab. 3].
A warning in the reader prompt changes exact match by +8% (Gen), −7% (Imi) and
0% (Hack), so the effect is inconsistent [arxiv:2305.13661 tab. 4]. Voting over
five readers, each given 10 passages, raises exact match by +11%, +12% and +23%
over the baseline in the same three settings [arxiv:2305.13661 tab. 4]
[arxiv:2305.13661 §5]. The baseline values in that table match the DPR + GPT,
10-context row of tab. 2, while its caption names another setup
[arxiv:2305.13661 tab. 2]. Check the setup before comparing these numbers.
Card: [On the Risk of Misinformation Pollution with LLMs, arXiv:2305.13661](/papers/2305.13661).

## When to use which

| Situation | Use | Why |
|---|---|---|
| Training data from an untrusted source and no threat model yet | Write down the threat model before choosing a defense | The data-centric survey gives no ranking of defenses; it says no evaluated defense held up against careful attacks [arxiv:2112.06409 §3.3] |
| Routine data-quality checks on incoming batches (not a poisoning defense) | Validation against statistics from earlier data, reporting anomalies for a person to decide | The paper describes this as checking new batches against a schema of earlier statistics, and does not present it as a poisoning defense [arxiv:2112.06409 §3.1] |
| Need some cheap filter on suspicious samples in classic training data | Outlier-based sanitization, as the default the data-centric survey describes | It is the usual defense in that survey [arxiv:2112.06409 §3.3]. Do not treat it as sufficient against a determined attacker [arxiv:2112.06409 §3.3] [arxiv:2012.10544 §4.1.1] |
| Need a provable bound on how much poisoning can change the model | Certified defenses or DP training, with the gap to empirical results in mind | The taxonomy survey says certified defenses are far from meaningful guarantees at realistic scale [arxiv:2012.10544 §4.6], and that DP-SGD resists poisoning empirically much less than its worst-case theory suggests [arxiv:2012.10544 §4.4.3] |
| Federated training where you want to screen incoming client updates | Plan for a conflict with secure aggregation | The taxonomy survey notes that masking client updates blocks screening of incoming models [arxiv:2012.10544 §2.7]. The FL survey says it is hard to find malicious participants under secure aggregation [arxiv:2101.05428 §6.4.1]. Several robust-aggregation and detection methods need a clean reference set or a fixed notion of normal client behaviour [arxiv:2012.10544 §4.5.1] [arxiv:2012.10544 §4.6] |
| Pretraining or fine-tuning on web-scraped text or code | Data curation and perplexity filtering, among the defenses the LLM security survey names | The survey names them for poisoning but gives no effectiveness figures [arxiv:2402.00888 §6.1] [arxiv:2402.00888 tab. 3] |
| Removing suspicious samples could drop a group | Measure group representation after filtering | The data-centric survey notes that removing noisy samples can worsen bias by removing too many examples from an underrepresented group [arxiv:2112.06409 §5.3] |
| Need to know how many poisoned samples an attack needs | Read the primary attack papers | The LLM security survey quotes counts (50 and 100) but no setup, and the counts are for different modalities [arxiv:2402.00888 §4.2.2] |
| Need an empirical check on how much a DP-SGD run leaks | Poisoning-based audit with a Monte Carlo test and a Clopper-Pearson lower bound on epsilon | The audit turns the distinguisher's error rates into a confidence lower bound on epsilon [arxiv:2101.04535 §3.3] [arxiv:2101.04535 eq. 5]. Stronger attacker powers give higher bounds [arxiv:2101.04535 §4.1] [arxiv:2101.04535 §4.6] |
| Publishing your own images so that models trained on them learn little, and you control all of your uploads | Class-wise error-minimizing noise on the whole set, within 8/255 for CIFAR-scale images | Class-wise noise reached lower accuracy than sample-wise on CIFAR-10 [arxiv:2101.04898 tab. 1] and took about a tenth of standard training time to generate, against about 60% for sample-wise [arxiv:2101.04898 app. B] |
| Only part of the data can be protected, for example other people keep posting clean copies | Do not rely on the noise alone | Protection drops quickly below full coverage: at 80% perturbed, the mixed set reached 87.23% against 16.42% at full coverage [arxiv:2101.04898 §4.3] [arxiv:2101.04898 tab. 2] |
| Protection must hold against adversarially trained models | Assume it may not, and test with adversarial training | At the same budget, adversarial training gives 85% on the unlearnable CIFAR-10 [arxiv:2101.04898 app. D]; the paper calls this an open problem |
| Choosing a DP-SGD noise setting or a distinguisher threshold | Fix both before the run, not from the audit's outcome | The paper keeps the noise multiplier with the best practical epsilon [arxiv:2101.04535 app. A], and does not state how the threshold tau is chosen [arxiv:2101.04535 §4.1]. Choosing either from the same trials makes the bound optimistic |
| Open-domain QA or RAG over a corpus that others can write to, such as web text or a wiki | Test with a polluted corpus before relying on the reader, and expect generated fakes to reach the top ranks | One fake passage per question lowered exact match by 14% to 87% [arxiv:2305.13661 §4.4] [arxiv:2305.13661 tab. 2], and with BM25 a fake was in the top 10 for 96.80% of NQ-1500 questions [arxiv:2305.13661 tab. 7] |
| Need to detect machine-written passages in your corpus | An in-domain classifier, trained on labeled passages from that corpus | In-domain AUROC was 91.4 to 99.8, but out-of-domain training gave 50.7 to 64.8 [arxiv:2305.13661 tab. 3]. Without in-domain labels, there is no evidence the detector works |
| The reader can afford several calls per question | Vote over several readers, each given its own group of passages | Voting gave the largest gains in the paper's table, 11% to 23% relative to the poisoned baseline [arxiv:2305.13661 tab. 4]. Cost grows with the number of passages [arxiv:2305.13661 §5] |
| Only a prompt change is possible | A warning in the reader prompt, tested on your own data first | Gains were inconsistent: +8%, −7% and 0% across the three settings [arxiv:2305.13661 tab. 4] |
| Poisoned labels are already in a trained model, and you know which points they are | Closed-form unlearning of those points, checked against a retrain for cost and accuracy | At 2500 poisoned labels the update came close to clean accuracy and ran far faster than retraining [arxiv:2108.11577 §7.3] [arxiv:2108.11577 fig. 9]. At 10000 no method restored accuracy [arxiv:2108.11577 §7.3]. The method needs the points as input [arxiv:2108.11577 §8] |
| Poisoned points are unknown | Find them first with a detection step, such as the outlier-based sanitization above; unlearning cannot start without them | Finding leaks is out of scope for the unlearning paper [arxiv:2108.11577 §8], and the data-centric survey names outlier detection as the usual defense [arxiv:2112.06409 §3.3] |
| Red-teaming a fine-tuning pipeline for clean-label targeted poisoning | Build substitutes on similar data, craft with the convex polytope objective and Dropout on, and measure transfer on your own victim | The paper reports transfer to black-box victims with 5 poisons in its setup, and feature collision at or below 0.5 [arxiv:1905.05897 §4.1]. The numbers are author-reported for one frog target and ship poisons [arxiv:1905.05897 §4] |

## Implementation sketch

The papers give no algorithm for sanitization. The sketch below is the generic
form of the outlier step the data-centric survey describes [arxiv:2112.06409 §3.3].
The score function, the drop fraction and any threshold are not stated in the paper.

```pseudocode
# Outlier-based sanitization of a training set  [arxiv:2112.06409 §3.3]
# Input: samples X (N items), score(x) where high = suspicious, drop fraction
# Output: the subset of samples kept for training

def sanitize(X, score, drop_fraction):
    # Score every training sample with a detector  [arxiv:2112.06409 §3.3]
    s = [score(x) for x in X]
    # Keep the least suspicious samples; the drop rate is not stated  [§3.3]
    keep = int(len(X) * (1 - drop_fraction))
    kept_idx = argsort(s)[:keep]
    return [X[i] for i in kept_idx]
```

## Contradictions

The papers do not report incompatible numbers, but they differ on what the
defense is and on what the numbers measure.

- The data-centric survey says outlier-based sanitization is the usual defense
  and cites a study concluding that no evaluated defense held up against
  careful attacks [arxiv:2112.06409 §3.3]. The LLM security survey names
  other defenses for poisoning (STRIP, fine-pruning, perplexity filtering) and
  reports no effectiveness numbers for any of them [arxiv:2402.00888 §6.1].
  Neither result settles which defense works.
- The FL survey recommends screening client updates before averaging
  [arxiv:2101.05428 §6.2.1], while the taxonomy survey notes that masking client
  updates blocks that screening [arxiv:2012.10544 §2.7]. Both papers state the
  tension, and neither gives a fix. The FL survey's own text also says
  malicious participants are hard to find under secure aggregation
  [arxiv:2101.05428 §6.4.1].
- The taxonomy survey reports that adaptive poisons placed close together can
  bypass outlier-based defenses [arxiv:2012.10544 §4.1.1]. That bears on the
  "usual defense" claim above. The bypass is a claim the survey states, not a
  result it measures, and the survey gives no experiment of its own.
- The taxonomy survey says many poisoning methods are less effective than
  advertised when the victim's architecture, optimiser or augmentation differs
  from the attack's setting, and that experimental settings vary too much to
  compare across studies [arxiv:2012.10544 §2.8] [arxiv:2012.10544 §5]. Treat
  the numbers in the other cards as separate settings, not one scale.
- The unlearnable-examples card tests recovery with adversarial training and
  with data augmentation [arxiv:2101.04898 app. D] [arxiv:2101.04898 tab. 3].
  It lists no run of outlier-based sanitization against its noise, so whether
  the defense the data-centric survey names removes this protection is not
  shown by any card here [arxiv:2101.04898 §4].
- Within the LLM security survey, the adversarial-attack section first describes
  attacks that perturb training samples, but its formula and the description
  after it use perturbations added to inputs at test time [arxiv:2402.00888 §4.2].
  Read the primary sources before deciding which setting a given attack uses.
- The audit paper's black-box CIFAR-10 result (0.31 against a proven 4) and its
  dataset-attack result (3.6 against a proven 4) are different settings, not
  conflicting results. The authors read the gap as the proven bound being tight
  in the worst case and loose on average [arxiv:2101.04535 §4.7]. These numbers
  are author-reported, and the paper's own code link is blinded for review
  [arxiv:2101.04535 app. A].
- The defense numbers for the sanitization survey and for the retrieval paper
  do not compare directly. The survey's claim concerns poisoned training data
  [arxiv:2112.06409 §3.3]. The retrieval paper's detector and voting results
  concern generated passages in a QA corpus, and its detector works only when
  trained on in-domain passages [arxiv:2305.13661 tab. 3] [arxiv:2305.13661 §5].
- The convex polytope paper's headline, more than 50% transfer success at 1%
  poisoning, is stated in its abstract. Its text does not define success, and
  its body puts the convex polytope results at or near 0.5 for most victims
  [arxiv:1905.05897 §4.1]. The two are not directly comparable until the
  success criterion is known.

## Papers

- [Transferable Clean-Label Poisoning Attacks on Deep Neural Nets, arXiv:1905.05897](/papers/1905.05897): a black-box clean-label attack that makes poisons enclose the target's features in substitute models, with Dropout-based substitutes and a multi-layer variant for end-to-end victims.
- [Machine Unlearning of Features and Labels, arXiv:2108.11577](/papers/2108.11577): a closed-form influence-function update that removes known poisoned or wrong labels from a trained model, with a certificate only for strongly convex models.
- [Dataset Security for Machine Learning, arXiv:2012.10544](/papers/2012.10544): a survey that puts training-only poisoning, backdoors and their defenses into one taxonomy, with federated settings and open problems, and no experiments of its own.
- [Federated Learning: Opportunities and Challenges, arXiv:2101.05428](/papers/2101.05428): a survey of federated learning that lists data poisoning among its attacks, with a screening defense and no experiments.
- [data-centric survey, arXiv:2112.06409](/papers/2112.06409): a survey placing poisoning attacks and outlier-based sanitization in its data-sanitization step, with a caveat on defenses.
- [LLM security and privacy survey, arXiv:2402.00888](/papers/2402.00888): a survey listing LLM-era poisoning attacks and the defenses named for them, with sample counts quoted from cited works.
- [Adversary Instantiation, arXiv:2101.04535](/papers/2101.04535): an experimental paper that uses poisoned and malicious training data to lower-bound the epsilon of DP-SGD, with black-box and stronger attacker settings.
- [Unlearnable Examples, arXiv:2101.04898](/papers/2101.04898): an experimental paper in which data owners add error-minimizing noise to their own images so that models trained on them learn little, with class-wise and sample-wise forms.
- [On the Risk of Misinformation Pollution with LLMs, arXiv:2305.13661](/papers/2305.13661): GPT-3.5 writes fake passages that are added to a QA retrieval corpus, with detection, warning-prompt and voting defenses that are only partly effective.