% Key papers for Clean-label data poisoning (scime atlas, https://atlas.scime.ai). Authors are not included: add them from the paper pages.

@inproceedings{icml2019_analyzing_37157,
  title = {{Analyzing Federated Learning through an Adversarial Lens}},
  booktitle = {International Conference on Machine Learning (ICML)},
  year = {2019},
  url = {https://icml.cc/virtual/2019/poster/3853},
}

@inproceedings{neurips2018_poison_57513,
  title = {{Poison Frogs! Targeted Clean-Label Poisoning Attacks on Neural Networks}},
  booktitle = {Advances in Neural Information Processing Systems (NeurIPS)},
  year = {2018},
  url = {https://nips.cc/virtual/2018/poster/11592},
}

@inproceedings{neurips2016_data_55660,
  title = {{Data Poisoning Attacks on Factorization-Based Collaborative Filtering}},
  booktitle = {Advances in Neural Information Processing Systems (NeurIPS)},
  year = {2016},
  url = {https://nips.cc/virtual/2016/poster/7244},
}

@inproceedings{icml2019_transferable_37824,
  title = {{Transferable Clean-Label Poisoning Attacks on Deep Neural Nets}},
  booktitle = {International Conference on Machine Learning (ICML)},
  year = {2019},
  url = {https://icml.cc/virtual/2019/poster/4267},
}

@inproceedings{neurips2020_metapoison_60311,
  title = {{MetaPoison: Practical General-purpose Clean-label Data Poisoning}},
  booktitle = {Advances in Neural Information Processing Systems (NeurIPS)},
  year = {2020},
  url = {https://nips.cc/virtual/2020/poster/18190},
}

@inproceedings{aaai2023_untargeted_4922,
  title = {{Untargeted Attack against Federated Recommendation Systems via Poisonous Item Embeddings and the Defense}},
  booktitle = {AAAI Conference on Artificial Intelligence (AAAI)},
  year = {2023},
  url = {https://ojs.aaai.org/index.php/AAAI/article/view/25611},
}

@inproceedings{aaai2022_hard_2183,
  title = {{Hard to Forget: Poisoning Attacks on Certified Machine Unlearning}},
  booktitle = {AAAI Conference on Artificial Intelligence (AAAI)},
  year = {2022},
  url = {https://aaai.org/papers/07691-hard-to-forget-poisoning-attacks-on-certified-machine-unlearning/},
}

@inproceedings{iclr2020_prediction_29711,
  title = {{Prediction Poisoning: Towards Defenses Against DNN Model Stealing Attacks}},
  booktitle = {International Conference on Learning Representations (ICLR)},
  year = {2020},
  url = {https://openreview.net/forum?id=SyevYxHtDB},
}

@inproceedings{aaai2018_data_105729,
  title = {{Data Poisoning Attacks on Multi-Task Relationship Learning}},
  booktitle = {AAAI Conference on Artificial Intelligence (AAAI)},
  year = {2018},
  url = {https://ojs.aaai.org/index.php/AAAI/article/view/11838},
}

@inproceedings{iclr2021_witches_29940,
  title = {{Witches' Brew: Industrial Scale Data Poisoning via Gradient Matching}},
  booktitle = {International Conference on Learning Representations (ICLR)},
  year = {2021},
  url = {https://iclr.cc/virtual/2021/poster/2561},
}

@inproceedings{neurips2021_adversarial_61659,
  title = {{Adversarial Examples Make Strong Poisons}},
  booktitle = {Advances in Neural Information Processing Systems (NeurIPS)},
  year = {2021},
  url = {https://nips.cc/virtual/2021/poster/26508},
}

@inproceedings{aaai2022_clpa_1813,
  title = {{CLPA: Clean-Label Poisoning Availability Attacks Using Generative Adversarial Nets}},
  booktitle = {AAAI Conference on Artificial Intelligence (AAAI)},
  year = {2022},
  url = {https://aaai.org/papers/09162-clpa-clean-label-poisoning-availability-attacks-using-generative-adversarial-nets/},
}

@inproceedings{iclr2022_poisoning_31579,
  title = {{Poisoning and Backdooring Contrastive Learning}},
  booktitle = {International Conference on Learning Representations (ICLR)},
  year = {2022},
  url = {https://iclr.cc/virtual/2022/poster/6316},
}

@inproceedings{icml2019_data_37265,
  title = {{Data Poisoning Attacks in Multi-Party Learning}},
  booktitle = {International Conference on Machine Learning (ICML)},
  year = {2019},
  url = {https://icml.cc/virtual/2019/poster/3817},
}

@inproceedings{icml2019_universal_37838,
  title = {{Universal Multi-Party Poisoning Attacks}},
  booktitle = {International Conference on Machine Learning (ICML)},
  year = {2019},
  url = {https://proceedings.mlr.press/v97/mahloujifar19a.html},
}

@inproceedings{neurips2022_autoregressive_63763,
  title = {{Autoregressive Perturbations for Data Poisoning}},
  booktitle = {Advances in Neural Information Processing Systems (NeurIPS)},
  year = {2022},
  url = {https://nips.cc/virtual/2022/poster/52801},
}

@inproceedings{neurips2022_amplifying_65895,
  title = {{Amplifying Membership Exposure via Data Poisoning}},
  booktitle = {Advances in Neural Information Processing Systems (NeurIPS)},
  year = {2022},
  url = {https://nips.cc/virtual/2022/poster/54281},
}

@inproceedings{icml2021_model_39620,
  title = {{Model-Targeted Poisoning Attacks with Provable Convergence}},
  booktitle = {International Conference on Machine Learning (ICML)},
  year = {2021},
  url = {https://icml.cc/virtual/2021/poster/10349},
}

@inproceedings{icml2023_data_42050,
  title = {{Data Poisoning Attacks Against Multimodal Encoders}},
  booktitle = {International Conference on Machine Learning (ICML)},
  year = {2023},
  url = {https://icml.cc/virtual/2023/poster/24040},
}

@inproceedings{iclr2022_data_30978,
  title = {{Data Poisoning Won’t Save You From Facial Recognition}},
  booktitle = {International Conference on Learning Representations (ICLR)},
  year = {2022},
  url = {https://iclr.cc/virtual/2022/poster/7006},
}

@inproceedings{neurips2025_provable_79568,
  title = {{Provable Watermarking for Data Poisoning Attacks}},
  booktitle = {Advances in Neural Information Processing Systems (NeurIPS)},
  year = {2025},
  url = {https://openreview.net/forum?id=qj8y1MjzLk},
}

@inproceedings{iclr2024_sharpness_34758,
  title = {{Sharpness-Aware Data Poisoning Attack}},
  booktitle = {International Conference on Learning Representations (ICLR)},
  year = {2024},
  url = {https://iclr.cc/virtual/2024/poster/18316},
}

@inproceedings{iclr2024_like_35379,
  title = {{Like Oil and Water: Group Robustness Methods and Poisoning Defenses May Be at Odds}},
  booktitle = {International Conference on Learning Representations (ICLR)},
  year = {2024},
  url = {https://iclr.cc/virtual/2024/poster/17694},
}

@inproceedings{icml2024_data_44979,
  title = {{Data Poisoning Attacks against Conformal Prediction}},
  booktitle = {International Conference on Machine Learning (ICML)},
  year = {2024},
  url = {https://icml.cc/virtual/2024/poster/33473},
}

@inproceedings{icml2026_efficient_49492,
  title = {{Efficient Preference Poisoning Attack on Offline RLHF}},
  booktitle = {International Conference on Machine Learning (ICML)},
  year = {2026},
  url = {https://openreview.net/forum?id=32XNOcwH1z},
}

@inproceedings{icml2026_theory_50697,
  title = {{Theory of Continual Learning Against Data Poisoning Attacks}},
  booktitle = {International Conference on Machine Learning (ICML)},
  year = {2026},
  url = {https://openreview.net/forum?id=EvIDneKgn1},
}

@inproceedings{icml2026_eyes_54666,
  title = {{Eyes-on-Me: Scalable RAG Poisoning through Transferable Attention-Steering Attractors}},
  booktitle = {International Conference on Machine Learning (ICML)},
  year = {2026},
  url = {https://openreview.net/forum?id=rF1oJAhAZA},
}

@inproceedings{neurips2024_from_74589,
  title = {{From Trojan Horses to Castle Walls: Unveiling Bilateral Data Poisoning Effects in Diffusion Models}},
  booktitle = {Advances in Neural Information Processing Systems (NeurIPS)},
  year = {2024},
  url = {https://neurips.cc/virtual/2024/poster/92999},
}

@inproceedings{iclr2025_machine_81558,
  title = {{Machine Unlearning Fails to Remove Data Poisoning Attacks}},
  booktitle = {International Conference on Learning Representations (ICLR)},
  year = {2025},
  url = {https://iclr.cc/virtual/2025/poster/30218},
}

@inproceedings{aaai2026_deferred_106966,
  title = {{Deferred Poisoning: Making the Model More Vulnerable via Hessian Singularization}},
  booktitle = {AAAI Conference on Artificial Intelligence (AAAI)},
  year = {2026},
  url = {https://ojs.aaai.org/index.php/AAAI/article/view/39318},
}

@inproceedings{iclr2024_rethinking_34129,
  title = {{Rethinking Label Poisoning for GNNs: Pitfalls and Attacks}},
  booktitle = {International Conference on Learning Representations (ICLR)},
  year = {2024},
  url = {https://iclr.cc/virtual/2024/poster/18946},
}

@inproceedings{icml2025_mp_49182,
  title = {{MP-Nav: Enhancing Data Poisoning Attacks against Multimodal Learning}},
  booktitle = {International Conference on Machine Learning (ICML)},
  year = {2025},
  url = {https://icml.cc/virtual/2025/poster/43444},
}