Research map / Adversarial robustness and security / Backdoor and poisoning
BagFlip: A Certified Defense Against Data Poisoning
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's title only (no summary yet). Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Add feature and test-input noise through BagFlip-0.9 rather than using Bagging-0.9 | MNIST · MNIST, f1, R=0.5 | certified accuracy: 71.11 -> 75.95 | Helped |
| Use BagFlip-0.8 rather than Bagging | MNIST · MNIST, f1, R=2.5 | certified accuracy: 0 -> 5.07 | Helped |
| Add noise with BagFlip-0.8 rather than use Bagging-0.9 | MNIST · MNIST, f∞, R=0.53 | certified accuracy: 68.11 -> 39.21 | Hurt |
| Add noise with BagFlip-0.95 rather than use Bagging-0.95 | EMBER · EMBER, f1, R=0.20 | certified accuracy: 0 -> 57.36 | Helped |
| Add noise with BagFlip-0.95 rather than use Bagging-0.95 | EMBER · EMBER, f∞, R=0.20 | certified accuracy: 14.74 -> 30.36 | Helped |
| Use BagFlip-0.95 rather than FeatFlip | MNIST-17 · MNIST-17, fl1, CF@0 | certified accuracy: 36 -> 81 | Helped |
| Use BagFlip-0.7 rather than RAB | MNIST-01 · MNIST-01, f1, CF@3.0 | certified accuracy: 0 -> 91.9 | Helped |
| Use BagFlip-0.7 rather than RAB | CIFAR10-02 · CIFAR10-02, f1, CF@0.2 | certified accuracy: 0 -> 29.2 | Helped |
| Apply the Neyman–Pearson relaxation to lookup-table preparation (ablation) | BagFlip on MNIST · MNIST | lookup-table preparation time: 85 hours -> 2 hours | Helped |
| Increase the perturbation bound s (ablation) | BagFlip-0.8 on MNIST · MNIST, f_s | certified accuracy | Hurt |
| Use feature noise for the f∞ perturbation setting (ablation) | BagFlip on MNIST · MNIST, f∞ | certified accuracy | Hurt |
| Use feature noise for the f∞ perturbation setting (ablation) | BagFlip on EMBER · EMBER, f∞ | certified accuracy | Helped |
Closest papers by meaning
- RPP: A Certified Poisoned-Sample Detection Framework for Backdoor Attacks under Dataset Imbalance (NeurIPS 2026 · similarity 0.85)
- Activation Gradient based Poisoned Sample Detection Against Backdoor Attacks (ICLR 2025 · similarity 0.85)
- Attack To Defend: Exploiting Adversarial Attacks for Detecting Poisoned Models (CVPR 2024 · similarity 0.84)
- Phantom Transfer: Data Poisoning can Survive Data-Level Defences (NeurIPS 2026 · similarity 0.84)
- Protecting against simultaneous data poisoning attacks (ICLR 2025 · similarity 0.84)
- Mitigating Backdoor Attack by Injecting Proactive Defensive Backdoor (NeurIPS 2024 · similarity 0.84)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.