Research map / Adversarial robustness and security / Backdoor and poisoning
Certified Robustness of Nearest Neighbors against Data Poisoning and Backdoor Attacks
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's title only (no summary yet). Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use kNN's intrinsic nearest-neighbor majority vote instead of certified-defense baselines | kNN · MNIST and CIFAR10, data poisoning and backdoor attacks | certified accuracy | Helped |
| Use rNN's intrinsic nearest-neighbor majority vote instead of certified-defense baselines | rNN · MNIST and CIFAR10, data poisoning and backdoor attacks | certified accuracy | Helped |
| Use rNN (r=4) instead of Bagging | MNIST · Data poisoning, poisoning size 1,000 | certified accuracy: 22.9% | Helped |
| Use rNN (r=4) instead of DPA | MNIST · Data poisoning, poisoning size 1,000 | certified accuracy: 40.8% | Helped |
| Jointly certify multiple testing examples rather than certify them individually (ablation) | rNN · MNIST, data poisoning, poisoning size 1,000 | certified accuracy: 15.1% | Helped |
| Use ISLAND grouping rather than Random Division grouping (ablation) | rNN joint certification · MNIST and CIFAR10, data poisoning and backdoor attacks | certified accuracy | Helped |
| Use CLIP features rather than the non-SSL features (ablation) | kNN · CIFAR10, data poisoning, poisoning size 500 | certified accuracy: 43.0% | Helped |
| Use self-supervised CLIP features (ablation) | rNN · CIFAR10 | certified accuracy | Helped |
| Vary k, with smaller k favoring clean accuracy and larger k favoring robustness as poisoning grows (ablation) | kNN · MNIST and CIFAR10, data poisoning and backdoor attacks | certified accuracy | Mixed |
| Vary r, with smaller r favoring clean accuracy and larger r favoring robustness as poisoning grows (ablation) | rNN · MNIST and CIFAR10, data poisoning and backdoor attacks | certified accuracy | Mixed |
| Use rNN rather than kNN when poisoning size is large | Nearest-neighbor classifiers · MNIST and CIFAR10, data poisoning and backdoor attacks | certified accuracy | Helped |
| Apply joint certification to rNN rather than individual certification (ablation) | rNN · Data poisoning and backdoor attacks | certified accuracy | Helped |
Closest papers by meaning
- Backdoor Secrets Unveiled: Identifying Backdoor Data with Optimized Scaled Prediction Consistency (ICLR 2024 · similarity 0.85)
- RPP: A Certified Poisoned-Sample Detection Framework for Backdoor Attacks under Dataset Imbalance (NeurIPS 2026 · similarity 0.85)
- Protecting against simultaneous data poisoning attacks (ICLR 2025 · similarity 0.85)
- Activation Gradient based Poisoned Sample Detection Against Backdoor Attacks (ICLR 2025 · similarity 0.84)
- Robustness Inspired Graph Backdoor Defense (ICLR 2025 · similarity 0.84)
- Provable Robustness against Backdoor Attacks via the Primal-Dual Perspective on Differential Privacy (NeurIPS 2026 · similarity 0.84)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.