Research map / Adversarial robustness and security / Certified and empirical robustness
Deep Partition Aggregation: Provable Defenses against General Poisoning Attacks
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's title only (no summary yet). Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use SS-DPA rather than the prior certified label-flipping defense | label-flipping defense · MNIST | median certified robustness: 645 vs. < 200 label flips | Helped |
| Use SS-DPA rather than the prior certified label-flipping defense | label-flipping defense · CIFAR-10 | median certified robustness: 392 vs. 175 | Helped |
| Increase ensemble size from k=1200 to k=3000 (ablation) | DPA · MNIST | median certified robustness: 448 -> 509 | Helped |
| Increase ensemble size from k=1200 to k=3000 (ablation) | SS-DPA · MNIST | median certified robustness: 485 -> 645 | Helped |
| Increase ensemble size from k=50 to k=1000 (ablation) | SS-DPA · CIFAR-10 | median certified robustness: 25 -> 392 | Helped |
| Increase ensemble size (ablation) | DPA and SS-DPA · MNIST, CIFAR-10, and GTSRB | clean accuracy | Hurt |
| Use sorted-index partitions instead of hash partitions (ablation) | SS-DPA · MNIST | median certified robustness: 460 -> 485; 606 -> 645 | Helped |
| Use sorted-index partitions instead of hash partitions (ablation) | SS-DPA · CIFAR-10 and GTSRB | median certified robustness: CIFAR-10: 25 -> 25, 124 -> 124, 387 -> 392; GTSRB: 25 -> 25, 50 -> 50, 99 -> 99, 174 -> 176 | No clear effect |
| Use sorted-index partitions instead of hash partitions (ablation) | SS-DPA · MNIST | base classifier accuracy: 78.64% -> 80.77%; 55.04% -> 57.65% | Helped |
| Use distinct random seeds per partition instead of the same seed (ablation) | DPA · MNIST | clean accuracy: 95.33% -> 95.85%; 92.90% -> 93.36% | Helped |
| Use distinct random seeds per partition instead of the same seed (ablation) | SS-DPA · MNIST | clean accuracy: 94.45% -> 95.62%; 91.60% -> 93.90% | Hurt |
| Use distinct random seeds per partition instead of the same seed (ablation) | DPA and SS-DPA · all evaluated settings | median certified robustness: MNIST DPA k=1200: 443 -> 448; MNIST SS-DPA k=1200: 501 -> 485 | Mixed |
Closest papers by meaning
- Improved Certified Defenses against Data Poisoning with (Deterministic) Finite Aggregation (ICML 2022 · similarity 0.93)
- Attack To Defend: Exploiting Adversarial Attacks for Detecting Poisoned Models (CVPR 2024 · similarity 0.87)
- Adversarial Training for Defense Against Label Poisoning Attacks (ICLR 2025 · similarity 0.86)
- Wicked Oddities: Selectively Poisoning for Effective Clean-Label Backdoor Attacks (ICLR 2025 · similarity 0.86)
- Provable Robustness against a Union of L_0 Adversarial Attacks (AAAI 2024 · similarity 0.85)
- Generalization Bound and New Algorithm for Clean-Label Backdoor Attack (ICML 2024 · similarity 0.85)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.