Research map / Adversarial robustness and security / Attacks on text and graphs
Witches' Brew: Industrial Scale Data Poisoning via Gradient Matching
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's title only (no summary yet). Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use gradient matching instead of feature-collision objectives | CIFAR-10 ResNet-18 poisoning · CIFAR-10, ResNet-18, 1% budget, ε=16 | avg. poison success: 90.00% (± 3.87) vs 3.75% (± 3.56); 90.00% (± 3.87) vs 1.25% (± 1.19) | Helped |
| Use gradient matching instead of MetaPoison | CIFAR-10 ResNet-18 poisoning · CIFAR-10, ResNet-18, 1% budget, ε=16 | avg. poison success: 90.00% (± 3.87) vs 42.50 % (± 8.33) | Helped |
| Use differentiable data augmentation when the victim augments images (ablation) | Gradient matching with one model · CIFAR-10, 1% budget, ε=16 | poison accuracy: 32.50% (± 12.27) -> 91.25% (± 6.14) | Helped |
| Replace an 8-model ensemble with differentiable data augmentation (ablation) | Gradient matching · CIFAR-10, 1% budget, ε=16 | poison accuracy: 78.75% (± 11.77) vs 91.25% (± 6.14) | Mixed |
| Use a heterogeneous 6-model ensemble rather than a single ResNet-18 | Gradient matching · CIFAR-10 benchmark, VGG11 transfer | avg. accuracy of poisoned CIFAR-10: 8% -> 35% | Helped |
| Reduce attacker knowledge from 10% to 1% of training data (ablation) | Gradient matching · CIFAR-10, 1% poison budget, ε=16 | poison success: 90.00% (± 3.87) -> 87.50% (± 7.07) | No clear effect |
| Reduce the poisons used by the victim from 100% to 25% (ablation) | Gradient matching · CIFAR-10, 1% poison budget, ε=16 | poison success: 90.00% (± 3.87) -> 80.00% (± 9.81) | Hurt |
| Use gradient matching against ImageNet with a 0.05% poison budget and ε=8 | ResNet-18 trained from scratch · ImageNet | poison success: 80% | Helped |
| Use gradient matching in the black-box Cloud AutoML setting | Cloud AutoML · ImageNet, target-label predictions | top-5 success: 5 out of 5 | Helped |
| Use gradient matching in the black-box Cloud AutoML setting | Cloud AutoML · ImageNet, target-label predictions | top-1 success: 1 out of 5 | Helped |
Closest papers by meaning
- From Trojan Horses to Castle Walls: Unveiling Bilateral Data Poisoning Effects in Diffusion Models (NeurIPS 2024 · similarity 0.90)
- Machine Unlearning Fails to Remove Data Poisoning Attacks (ICLR 2025 · similarity 0.90)
- Wicked Oddities: Selectively Poisoning for Effective Clean-Label Backdoor Attacks (ICLR 2025 · similarity 0.89)
- Attack To Defend: Exploiting Adversarial Attacks for Detecting Poisoned Models (CVPR 2024 · similarity 0.89)
- Sharpness-Aware Data Poisoning Attack (ICLR 2024 · similarity 0.89)
- A Theoretical Analysis of Backdoor Poisoning Attacks in Convolutional Neural Networks (ICML 2024 · similarity 0.89)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.