Research map / Adversarial robustness and security / Attacks on text and graphs
Poison Frogs! Targeted Clean-Label Poisoning Attacks on Neural Networks
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's title only (no summary yet). Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Add one feature-collision poison image | InceptionV3 transfer learning on ImageNet dog-vs-fish · ImageNet dog-vs-fish | attack success rate: 100% vs. 57% | Helped |
| Add one feature-collision poison image | InceptionV3 transfer learning on ImageNet dog-vs-fish · ImageNet dog-vs-fish | average test accuracy drop: 0.2% | Hurt |
| Use an L∞ pixel bound of 2 instead of the L2 similarity penalty | InceptionV3 transfer learning poisoning · ImageNet dog-vs-fish | attack success rate: 100% -> 100% | No clear effect |
| Use 50 optimized poisons from diverse bases with 30% target opacity | End-to-end training with scaled-down AlexNet · CIFAR-10 bird-vs-dog | attack success rate: about 60% | Helped |
| Target low-confidence, correctly classified outliers rather than random targets | End-to-end watermarked multi-poison attack · CIFAR-10 airplane-vs-frog | attack success rate: 53% -> 70% (17% higher) | Helped |
| Use multiple poison instances rather than a single poison | End-to-end training with scaled-down AlexNet · CIFAR-10 | attack success rate: success rate increases monotonically with the number of poison instances; about 60% with 50 poisons | Helped |
| Add a target watermark to the base images | End-to-end multi-poison attack · CIFAR-10 | attack success rate | Helped |
| Use only one base to produce all the poisons instead of diverse bases (ablation) | End-to-end watermarked multi-poison attack · CIFAR-10 airplane-vs-frog | attack success | Hurt |
| Remove optimization for feature collisions (ablation) | End-to-end watermarked multi-poison attack · CIFAR-10 airplane-vs-frog | attack success | Hurt |
| Remove target watermarking from the poisons (ablation) | End-to-end multi-poison attack with diverse bases · CIFAR-10 airplane-vs-frog | attack success | Hurt |
| Use one optimized poison instead of multiple watermarked poisons | End-to-end training with scaled-down AlexNet · CIFAR-10 airplane-vs-frog | attack success | Hurt |
Closest papers by meaning
- Wicked Oddities: Selectively Poisoning for Effective Clean-Label Backdoor Attacks (ICLR 2025 · similarity 0.87)
- A Theoretical Analysis of Backdoor Poisoning Attacks in Convolutional Neural Networks (ICML 2024 · similarity 0.84)
- Attack To Defend: Exploiting Adversarial Attacks for Detecting Poisoned Models (CVPR 2024 · similarity 0.84)
- Universal Backdoor Attacks (ICLR 2024 · similarity 0.84)
- Clean-Label Graph Backdoor Attack in the Node Classification Task (AAAI 2025 · similarity 0.84)
- Activation Gradient based Poisoned Sample Detection Against Backdoor Attacks (ICLR 2025 · similarity 0.83)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.