Research map / Adversarial robustness and security / Attacks on text and graphs
Clean-label data poisoning
Craft poisoned training data via gradient matching and generative methods.
41 accepted papers at ICML, NeurIPS, ICLR, CVPR and AAAI (2016–2026) · an approach in Attacks on text and graphs, keyword cluster “poisoning · membership · watermarking”
State History Tried Checklist Preprints Who Export
Where it stands
Not enough benchmark data Fewer than four papers report the same benchmark, so there is no record to follow.
12 papers in 2023–24 and 7 in 2025–26 (at ICML, NeurIPS, ICLR, CVPR and AAAI); its share of the topic shrank, from 4.3% to 1.4%.
How this is decided
A benchmark is tracked when at least four papers of this approach report their own method on the same dataset and metric in at least two different years. Its record is the best number reported up to 2024 compared with the best reported in 2025–26: still improving means at least 1% better, flat means at most 0.2% better with at least two papers from 2025–26 trying. Numbers on a different scale from the rest (a fraction among percentages) and far outliers are left out. Results come from different papers with different setups, so they are signals, not head-to-head comparisons. The share of papers is counted at ICML, NeurIPS, ICLR, CVPR and AAAI.
How it got here
Most cited paper of each year
- 2016 · Data Poisoning Attacks on Factorization-Based Collaborative Filtering (NeurIPS 2016 · 216 citations)
- 2018 · Poison Frogs! Targeted Clean-Label Poisoning Attacks on Neural Networks (NeurIPS 2018 · 245 citations)
- 2019 · Analyzing Federated Learning through an Adversarial Lens (ICML 2019 · 382 citations)
- 2020 · MetaPoison: Practical General-purpose Clean-label Data Poisoning (NeurIPS 2020 · 92 citations)
- 2021 · Witches' Brew: Industrial Scale Data Poisoning via Gradient Matching (ICLR 2021 · 34 citations)
- 2022 · Hard to Forget: Poisoning Attacks on Certified Machine Unlearning (AAAI 2022 · 64 citations)
- 2023 · Untargeted Attack against Federated Recommendation Systems via Poisonous Item Embeddings and the Defense (AAAI 2023 · 66 citations)
- 2024 · Sharpness-Aware Data Poisoning Attack (ICLR 2024 · 0 citations)
- 2025 · Provable Watermarking for Data Poisoning Attacks (NeurIPS 2025 · 1 citation)
- 2026 · Efficient Preference Poisoning Attack on Offline RLHF (ICML 2026 · 0 citations)
Earliest papers here
- Data Poisoning Attacks on Factorization-Based Collaborative Filtering (NeurIPS 2016 · 216 citations)
- Poison Frogs! Targeted Clean-Label Poisoning Attacks on Neural Networks (NeurIPS 2018 · 245 citations)
- Data Poisoning Attacks on Multi-Task Relationship Learning (AAAI 2018 · 41 citations)
What has been tried
35 papers here report 370 measured changes (a component added, removed or swapped, compared with a baseline): helped 50%, no clear effect 8%, hurt 33%, mixed 9%. Papers mostly publish changes that helped, so "helped" is over-represented.
Ablations in recent papers
| What was changed | Measured on | Result | Effect | Paper |
|---|---|---|---|---|
| Increase watermark length from q=100 to q=3000 | CIFAR-10 (ResNet-18) · AUROC | 0.5522 -> 1.0000 | Helped | Provable Watermarking for Data Poisoning Attacks (NeurIPS 2025 · 1 citation) |
| Increase NGD update steps | Unlearning experiments · unlearning effectiveness | Helped | Machine Unlearning Fails to Remove Data Poisoning Attacks (ICLR 2025 · 0 citations) | |
| Set sharpness radius ρ to 0.01 rather than 0.1 | CIFAR10 targeted · success rate | 82.1 -> 76.5 | Hurt | Sharpness-Aware Data Poisoning Attack (ICLR 2024 · 0 citations) |
| amplify poisons with JTT instead of excluding them from the amplified set | Waterbirds, DLBD · ASR | 0.5 ± 0.3 \% -> \mathbf{20.4} ± 5.9 \% | Hurt | Like Oil and Water: Group Robustness Methods and Poisoning Defenses May Be at Odds (ICLR 2024 · 0 citations) |
| Use second-order rather than first-order optimization | CIFAR-10, 2% poison budget · set size reduction ratio | 0.46 ± 0.02 -> 0.48 ± 0.02 | Helped | Data Poisoning Attacks against Conformal Prediction (ICML 2024 · 0 citations) |
| Filter out the top 10% of denoising-loss values | CIFAR10, BadNets-1, p=1% · ASR (%) | 62.38 -> 13.62 | Helped | From Trojan Horses to Castle Walls: Unveiling Bilateral Data Poisoning Effects in Diffusion Models (NeurIPS 2024 · 0 citations) |
| Concept-level selection only (boat2kit) | COCO TIR · Hit@10 | 0.505 to 0.610 | Helped | MP-Nav: Enhancing Data Poisoning Attacks against Multimodal Learning (ICML 2025) |
What reviewers will expect
Datasets and baselines named in the 8 papers of this approach from 2024–2026 that have a full-text summary. Leaving out the common ones is a frequent review question.
Datasets
- CIFAR-10 · 5 of 8 papers
- CIFAR-100 · 3 of 8 papers
- Tiny-ImageNet · 2 of 8 papers
Baselines
- Meta-Poison · 2 of 8 papers
Recent preprints
Loading recent arXiv preprints…
Who publishes on it
Institutions on the most papers of this approach since 2023 (of 19 papers; from OpenAlex and the papers' affiliations).
- Massachusetts Institute of Technology · 2 papers
- Michigan State University · 2 papers
- Sony · 2 papers
- University of Maryland, College Park · 2 papers
- University of Waterloo · 2 papers
Use it
Download BibTeX of 32 key papersOpen the topic in the interactive map
Get alerts. Describe your idea in scime atlas and save it (free scime account): you get a weekly email when new preprints land close to it.
Related approaches
Same keyword cluster
- Membership inference and inversion (118 papers)
- Neural network watermarking (53 papers)
Elsewhere in the topic
- LLM jailbreak and injection defense (113 papers)
- Adversarial prompts for language models (98 papers)
- Defenses against universal perturbations (97 papers)
- Vision-language model robustness (96 papers)
- Attacks and defenses in sequential settings (96 papers)
- Diffusion-based adversarial purification (78 papers)
- Biologically inspired robust vision (77 papers)
- Graph neural network robustness (71 papers)
Benchmark numbers, ablations and baseline numbers are extracted by AI from each paper's full text and can be wrong; the paper is the authority. Data: results index of 2026-11-02, citation counts from OpenAlex (2026-10-09).