Research map / Adversarial robustness and security / Attacks on text and graphs
Sharpness-Aware Data Poisoning Attack
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes Sharpness-Aware Data Poisoning Attack (SAPA), which optimizes poisons against an approximately worst-case re-trained model found via a sharpness-style inner perturbation, and plugs it into targeted, backdoor and untargeted poisoning attacks on CIFAR10/100.
Problem
Data poisoning attacks on DNNs trained from scratch are weakened by re-training uncertainty (initialization, algorithm, architecture), so poisons crafted against one victim model often lose effect when the victim is re-trained.
Approach
Treat the poisoning objective as a min-max over a sharpness-style neighborhood of the surrogate model: craft poisons that remain effective on the approximately worst model within a small parameter perturbation ball, and use this sharpness-aware adversarial objective as a drop-in replacement for the standard adversarial objective of existing attacks (Grad-Match, Sleeper Agent, Error-Min, Error-Max)
Key results
- On CIFAR10 targeted attacks at 16/255 budget and 1% poisoning ratio, SAPA+Grad-Match reaches 80.1% success vs 72.9% for Grad-Match.
- On CIFAR10 backdoor attacks at 8/255 and ResNet18, SAPA+Sleeper Agent reaches 49.3% success vs 31.5% for Sleeper Agent.
- On CIFAR10 untargeted attacks at 100% poisoning, Error-Min+SAPA lowers clean test accuracy to 10.9% vs 21.2% for Error-Min (ResNet18).
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Add SAPA to Grad-Match | Grad-Match · CIFAR10 targeted (16/255, 1%) | success rate: 72.9$\pm$3.4 -> 80.1$\pm$3.5 | Helped |
| Add SAPA to Grad-Match | Grad-Match · CIFAR100 targeted (8/255, 1%) | success rate: 62.1$\pm$3.5 -> 86.8$\pm$3.9 | Helped |
| Add SAPA to Sleeper Agent | Sleeper Agent · CIFAR100 backdoor (ResNet18, 8/255) | success rate: 26.7$\pm$4.3 -> 41.8$\pm$3.2 | Helped |
| Add SAPA to Error-Max | Error-Max · CIFAR10 untargeted (100%, ResNet18) | test accuracy: 11.9 -> 9.6 | Helped |
| Add SAPA to Error-Min | Error-Min · CIFAR10 untargeted (100%, ResNet18) | test accuracy: 21.2 -> 10.9 | Helped |
| Add SAPA to Error-Min | Error-Min · CIFAR10 untargeted with adversarial training | test accuracy: 82.0 -> 73.2 | Helped |
| Add SAPA to Error-Max | Error-Max · CIFAR10 untargeted with adversarial training | test accuracy: 80.3 -> 72.5 | Helped |
| Set sharpness radius ρ to 0.01 rather than 0.1 (ablation) | SAPA+GM · CIFAR10 targeted | success rate: 82.1 -> 76.5 | Hurt |
| Set sharpness radius ρ to 0.5 rather than 0.1 (ablation) | SAPA+GM · CIFAR10 targeted | success rate: 82.1 -> 69.3 | Hurt |
| Set sharpness radius ρ to 0.01 rather than 0.1 (ablation) | SAPA+Sleeper Agent · CIFAR10 backdoor | success rate: 97.6 -> 92.7 | Hurt |
| Set sharpness radius ρ to 0.5 rather than 0.1 (ablation) | SAPA+Sleeper Agent · CIFAR10 backdoor | success rate: 97.6 -> 83.2 | Hurt |
| Retrain with Mix-Up rather than SGD (ablation) | SAPA-based attacks · CIFAR10 targeted attack | success rate: 80.1 -> 65.5 | Hurt |
Surprising findings
- Mix-Up as a re-training algorithm substantially weakens poisoning effects across all studied attacks, including SAPA.
Limitations
- Only evaluated on image classification (CIFAR10, CIFAR100, SVHN); not self-supervised learning, text or graphs.
- Performance is sensitive to the sharpness radius rho; very small or large values degrade attack success.
Experimental setup
Datasets: CIFAR10 CIFAR100 SVHN
Benchmarks: CIFAR10 CIFAR100 SVHN
Metrics: success rate test accuracy running time
Baselines: Bullseye Poison-Frog Meta-Poison Grad-Match Hidden-trigger Clean-label Sleeper Agent Separable Perturbation Autoregressive Perturbation Error-Min
Builds on: Gradient Matching Sleeper Agent Error-Min Error-Max Sharpness-Aware Minimization
Closest papers by meaning
- Attack To Defend: Exploiting Adversarial Attacks for Detecting Poisoned Models (CVPR 2024 · similarity 0.87)
- Poisoning Attacks on LLMs Require a Near-constant Number of Poison Samples (NeurIPS 2026 · similarity 0.86)
- Data Poisoning Attacks against Conformal Prediction (ICML 2024 · similarity 0.85)
- Machine Unlearning Fails to Remove Data Poisoning Attacks (ICLR 2025 · similarity 0.85)
- A Theoretical Analysis of Backdoor Poisoning Attacks in Convolutional Neural Networks (ICML 2024 · similarity 0.85)
- From Trojan Horses to Castle Walls: Unveiling Bilateral Data Poisoning Effects in Diffusion Models (NeurIPS 2024 · similarity 0.85)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.