Research map / Adversarial robustness and security / Certified and empirical robustness
How Robust Are Randomized Smoothing Based Defenses to Data Poisoning?
Check your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's title only (no summary yet). Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Add clean-label, imperceptibly perturbed PACD poison data | Gaussian augmentation training · CIFAR10 Ship, σ=0.25 | ACR: 0.521±0.05 -> 0.059±0.02 | Hurt |
| Add clean-label, imperceptibly perturbed PACD poison data | MACER training · MNIST digit 8, σ=0.25 | ACR: 0.915±0.01 -> 0.431±0.13 | Hurt |
| Add clean-label, imperceptibly perturbed PACD poison data | SmoothAdv training · CIFAR10 Ship, σ=0.25 | ACR: 0.504±0.02 -> 0.271±0.02 | Hurt |
| Use PACD poisoning rather than watermarking | Gaussian augmentation training · CIFAR10 Ship, σ=0.25 | ACR: 0.470±0.01 -> 0.059±0.02 | Hurt |
| Use standard-training-optimized poisons against robust training | GA, SmoothAdv, and MACER · MNIST and CIFAR10 target classes | target-class accuracy: 98.99±0.14 -> 98.31±1.65; 99.18±0.23 -> 99.31±0.29; 99.21±0.56 -> 98.31±0.58; 88.84±2.39 -> 88.38±2.13; 79.48±2.69 -> 74 | No clear effect |
| Increase poison perturbation strength ε (ablation) | PACD with Gaussian augmentation · Target-class data | ACR | Hurt |
| Increase poison perturbation strength ε (ablation) | PACD with Gaussian augmentation · Target-class poison examples | visual detectability | Hurt |
| Use larger weight regularization with GA (ablation) | PACD-poisoned MNIST digit 8 · MNIST digit 8, σ=0.5 | ACR: 1.48±0.02 -> 0.85±0.09; 0.73±0.10 -> 0.72±0.08 | Mixed |
| Use larger weight regularization without GA (ablation) | PACD-poisoned MNIST digit 8 · MNIST digit 8 | ACR: 0.01±0.01 -> 0.68±0.05 | Helped |
| Use larger weight regularization without GA (ablation) | Clean MNIST digit 8 model · MNIST digit 8 | target-class accuracy: 99% -> 92% | Hurt |
| Reinitialize lower-level model parameters during poison optimization (ablation) | PACD bilevel optimization · Random retraining initializations | poison transfer effectiveness | Helped |
| Use PACD poisons generated against GA on different robust training methods | GA-optimized poison data · MNIST and CIFAR10 target classes | ACR | Hurt |
Closest papers by meaning
- On Robustness of Linear Classifiers to Targeted Data Poisoning (AAAI 2026 · similarity 0.91)
- Not All Poisons are Created Equal: Robust Training against Data Poisoning (ICML 2022 · similarity 0.90)
- Certified Robustness to Label-Flipping Attacks via Randomized Smoothing (ICML 2020 · similarity 0.90)
- On the Scalability of Certified Adversarial Robustness with Generated Data (NeurIPS 2024 · similarity 0.87)
- Provably Cost-Sensitive Adversarial Defense via Randomized Smoothing (ICML 2025 · similarity 0.87)
- Robust Nonparametric Regression under Poisoning Attack (AAAI 2024 · similarity 0.87)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.