Research map / Adversarial robustness and security / Attacks on text and graphs
Exploring the Limits of Model-Targeted Indiscriminate Data Poisoning Attacks
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's title only (no summary yet). Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use Gradient Canceling instead of TGDA or Gradient Matching | model-targeted poisoning attacks · MNIST | accuracy drop (%): LR, ε_d=1: -8.97 / -12.13 -> -67.01; NN: -5.49 / -4.03 -> -12.05; CNN: -4.76 / -6.94 -> -23.80 | Helped |
| Use Gradient Canceling instead of TGDA or Gradient Matching | model-targeted poisoning attacks · CIFAR-10 | accuracy drop (%): ε_d=1: GC -18.33; TGDA -17.21; Gradient Matching -9.80 | Mixed |
| Use Gradient Canceling instead of TGDA or Gradient Matching | model-targeted poisoning attacks · TinyImageNet | accuracy drop (%): ε_d=1: -14.33 / -10.85 -> -20.15 | Helped |
| Increase poisoning ratio from ε_d=0.03 to ε_d=1 | Gradient Canceling · MNIST, CIFAR-10, and TinyImageNet | accuracy drop (%): MNIST LR -22.97 -> -67.01; MNIST NN -6.10 -> -12.05; MNIST CNN -9.55 -> -23.80; CIFAR-10 -13.73 -> -18.33; TinyImageNet | Helped |
| Clip poisoned features to the clean-data range (ablation) | Gradient Canceling under Sever defense · MNIST | accuracy drop (%): ε_d=1: LR -67.01 -> -28.99; NN -12.05 -> -6.53; CNN -23.80 -> -13.32 | Hurt |
| Scale the target parameter to w/2 (ablation) | Gradient Canceling · MNIST | accuracy drop (%): ε_d=1: LR -67.01 -> -79.55; NN -12.05 -> -15.33; CNN -23.80 -> -24.56 | Helped |
| Raise the poisoning ratio above the reachability threshold | Gradient Canceling targeting a fixed parameter · logistic regression on OR dataset | target reachability | Helped |
| Use a positive poisoning ratio for least-squares regression | Gradient Canceling · 2D Gaussian linear regression | target reachability | Helped |
| Apply Sever to remove high-outlier-score training points | Gradient Canceling · MNIST | accuracy drop (%): At ε_d=1: LR -67.01 -> -65.01; NN -12.05 -> -10.02; CNN -23.80 -> -21.05 | Hurt |
| Apply DPA defense | Gradient Canceling with ε_d=0.008 · MNIST | accuracy drop (%): LR, k=3000: -8.25 -> -4.21; NN: -2.25 -> -1.17; CNN: -2.77 -> -1.52 | Hurt |
| Use GradPC targets with higher parameter perturbation ε_w (ablation) | Gradient Canceling target parameters · MNIST | poisoning threshold τ: LR: τ(w)=1.15, τ(w/2)=0.54; NN: 2.48 -> 1.41; CNN: 0.98 -> 0.42 | Hurt |
Closest papers by meaning
- Poisoning Attacks on LLMs Require a Near-constant Number of Poison Samples (NeurIPS 2026 · similarity 0.89)
- Scaling Trends for Data Poisoning in LLMs (AAAI 2025 · similarity 0.88)
- Phantom Transfer: Data Poisoning can Survive Data-Level Defences (NeurIPS 2026 · similarity 0.88)
- Sharpness-Aware Data Poisoning Attack (ICLR 2024 · similarity 0.88)
- Attack To Defend: Exploiting Adversarial Attacks for Detecting Poisoned Models (CVPR 2024 · similarity 0.88)
- Model Poisoning Attacks to Federated Learning via Multi-Round Consistency (CVPR 2025 · similarity 0.87)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.