Pith. sign in

REVIEW 4 major objections 5 minor 44 references

Generalizable Targeted Data Poisoning against Varying Physical Objects

T0 review · 4 major / 5 minor · reviewed 2026-08-11 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Targeted data poisoning can generalize across unseen physical variations of an object by matching both the direction and the magnitude of gradients.

desk verdict New evaluation threat model and a plausible loss tweak, but the generalization claim is mostly interpolation and needs a distance-based test. read the letter →

arxiv 2412.03908 v2 pith:MTWPF2AJ submitted 2024-12-05 cs.CV cs.CRcs.LG

Zhizhen Chen , Zhengyu Zhao , Subrat Kishore Dutta , Chenhao Lin , Chao Shen , Xiao Zhang This is my paper · ORCID
classification cs.CVcs.CRcs.LG
keywords targeteddatapoisoningclean-labelgradientmatchingphysicalobjectvariationsgeneralizationmulti-viewcarsubpopulationdefenses
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Targeted data poisoning attacks are usually evaluated by poisoning and testing on the exact same image, which makes them look less threatening than they are. This paper introduces a realistic threat model, generalizable targeted data poisoning (G-TDP), in which the target is a physical object and the attacker only sees a few of its variants, while success is measured on unseen viewpoints, backgrounds, and lighting conditions. It claims that the standard gradient-matching objective, which only aligns gradient directions, generalizes poorly under this model, and proposes a new loss that also matches gradient magnitude. With that loss, poisoning success on a multi-view car rises to 90.13% on ResNet-18, versus 82.40% for the direction-only baseline, and the attack reaches 54.92% on a handmade object dataset where no poisoning gives 0%. If the claim holds, clean-label poisoning becomes a realistic threat to models trained on scraped images of physical objects.

What carries the argument

The carrying object is the gradient-matching loss. Where earlier work minimized the cosine distance between the average gradient of poison samples and the average gradient of target samples, this paper minimizes the product of that cosine distance and the squared Euclidean distance between the two gradients, $D_{\mathrm{mul}}(L_p, L_t) = \|\nabla_\theta L_p - \nabla_\theta L_t\|_2^2 \cdot (1 - \cos(\nabla_\theta L_p, \nabla_\theta L_t))$. The Euclidean factor forces poison gradients to be large enough to shift model parameters, not merely aligned in direction. Proposition 1 formalizes the mechanism: if two poison gradients have the same cosine similarity to the target gradient but different Euclidean distances, the one with smaller Euclidean distance lowers the loss on every sample whose gradient lies in a ball around the target gradient, and the size of that ball grows with the target gradient's magnitude. A retraining step is included in the optimization to keep the matching realistic as the victim model changes.

What would settle it

Compute the gradients of test variants of a Multi-View Car object at the moment the poison is optimized and measure how many violate the bound in Proposition 1: $\|\nabla_\theta \ell(f_\theta(x), y_{\mathrm{adv}}) - \nabla_\theta L_t\|_2 < \langle \nabla_\theta L_t, \nabla_\theta L_{p,\mathrm{our}} - \nabla_\theta L_{p,\mathrm{cos}} \rangle / \|\nabla_\theta L_{p,\mathrm{our}} - \nabla_\theta L_{p,\mathrm{cos}}\|_2$. If many variants fall outside the admissible ball, the attack's stated mechanism predicts failure; observing high success there would contradict the paper's explanation.

Watch

Extended reading notes

Core claim

Under the G-TDP threat model, the paper's central claim is that a clean-label poison crafted from a small set of known images of an object can misclassify unseen physical variants of that object, and that this generalization is driven by matching the magnitude as well as the direction of gradients. The evidence is experimental: on the Multi-View Car target, the proposed product loss $D_{\mathrm{mul}}$ outperforms the cosine-only Witches' Brew baseline by 19.49 percentage points on average across four CNN architectures on CIFAR-10, with ResNet-18 reaching 90.13% versus 82.40%. On a handmade dataset with viewpoint, background, and lighting changes, the method achieves 54.92% poisoning success on ImageNet, compared with 0% for unpoisoned training. The same loss also improves results in the previous single-image TDP setting and in subpopulation poisoning, which the authors read as confirmation that direction-plus-magnitude matching, rather than the physical-variation setup alone, is the source of the gain.

Load-bearing premise

The whole argument rests on the assumption that all physical variants of the target object have gradients close to the gradient of the average target; if real variations produce divergent gradients, the smaller-Euclidean-distance mechanism has nothing to generalize across.

Editorial extensions

If this is right

  • An adversary with only a handful of images of a physical object can craft poisons that misclassify that object under viewpoints and conditions never seen during poisoning, as long as the object's variants keep similar gradients.
  • The attack transfers across architectures: poisons crafted with VGG11 reach an average success rate of 71.89% on ResNet-18, MobileNet-V2, and LeViT-384, and a Swin V2 model is attacked at 41.03%.
  • The proposed loss also improves performance in the standard single-image TDP setting and in subpopulation poisoning, so the direction-plus-magnitude matching claim is not limited to physical-variation targets.
  • Defenses that alter training are costly: differential privacy reduces the attack only at a large validation-accuracy cost, and JPEG compression drops the success rate to 0.07% but lowers validation accuracy from 91.99% to 83.60%.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The mechanism suggests a predictor of attack success that the paper does not test: object categories whose variants share low-level visual statistics should be easier to poison, while categories with strong lighting or occlusion changes may be harder. This could be checked by ranking classes by gradient dispersion and correlating with success rate.
  • The paper's negative result for digital augmentation on target samples implies that physical variation is not well simulated by standard augmentation, so a natural next step is to build augmentation schemes that mimic physical factors; such schemes could strengthen either attacks or defenses.
  • If gradient magnitude is the operative factor, a defender could estimate the gradient magnitude induced by suspected poison samples and clip or reshape it during training, a defense direction suggested by the paper's mechanism rather than tested by it.
  • The near-100% success on full-ImageNet single trials hints that the attack may be practical at web scale, but the evidence is single-trial; a larger study across many object types and training pipelines would show how general the risk is.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The paper introduces a new threat model, generalizable targeted data poisoning (G-TDP), in which the poisoner has access to a limited set of target-object variations and must poison so that the attack transfers to unseen physical variations of the same object. The authors observe that the cosine-similarity gradient-matching objective of Witches' Brew generalizes poorly across viewpoints, and they propose combining cosine similarity with Euclidean distance in the gradient-matching loss, giving two variants Dadd and Dmul. Experiments on CIFAR-10 and ImageNet with Multi-View Car targets, on a handmade dataset with viewpoint/background/lighting changes, and on subpopulation and standard TDP settings show that the proposed losses, especially Dmul, often improve poisoning success rates over cosine-only baselines while keeping validation accuracy roughly constant. The paper also includes a theoretical Proposition 1 in Appendix A intended to justify why smaller gradient Euclidean distance should improve generalization.

Significance. If the central claim holds, the paper is a useful step beyond the single-image threat model that dominates clean-label targeted poisoning, and the proposed Dmul loss could become a strong baseline for realistic physical-object poisoning. The empirical core is consistent: Dmul beats cosine and ED in most settings, preserves validation accuracy, and transfers across architectures. The code is released, which supports reproducibility. However, the evidence for the headline claim of generalization to unseen physical variations is currently incomplete: the paper does not demonstrate extrapolation to genuinely novel viewpoints or scenes, and the theoretical justification rests on an unmeasured gradient-closeness assumption. The attack's practical significance therefore remains plausible but not fully established.

major comments (4)
  1. [§5.1 and Fig. 2 / Table 1] The paper's central claim is that poisoning transfers to unseen physical variations, but the experimental design does not actually measure extrapolation. In the Multi-View Car setting, the poisoner receives m=10 images from roughly 100 views spanning 360 degrees, and Figure 2 shows that Witches' Brew is effective within a 36-degree viewpoint bin and fails mainly across bins. With m=10, the known views likely cover all ten bins, so held-out test views are typically within about 18 degrees of a known view. The 90.13% versus 82.40% comparison may therefore measure interpolation quality on a densely sampled viewpoint manifold rather than generalization to genuinely new physical conditions. The manuscript never reports success rate as a function of angular distance to the nearest known view, nor does it hold out an entire viewpoint range or scene. To support the claim, the authors should add an explicit extrapolation test (e.g., poison using views from only a contiguous 180-degree range and evaluate on the opposite range, or report SR versus angular/spatial distance to the nearest known target view).
  2. [Appendix A, Proposition 1] The theoretical justification for why Euclidean-distance matching should improve generalization depends on the assumption that all samples of the physical object have gradients lying in an L2 ball around the average target gradient. This radius is never measured for the Multi-View Car or handmade targets, so the proposition's condition (11) is not verified for any actual dataset. Additionally, the proof uses a single gradient-descent step and drops the Taylor remainder term in Eq. (14). The authors should either measure the gradient ball radius for their target objects or present the proposition as a purely illustrative model; as written, the theory does not by itself establish that smaller Euclidean distance improves generalization for the tested physical objects.
  3. [Table 1 and §5.2] The abstract and Section 5.2 state that Dmul outperforms the state of the art by 19.49% on CIFAR-10 Multi-View Car, but this is an average over four models, and Table 1 shows that Dmul is not the best method on ConvNet64 (Our_add achieves 82.30% while Dmul achieves 76.48%). The claim that Dmul is best except on ConvNet64 is accurate, but the averaged improvement is dominated by the large gain on ConvNet64, where the recommended loss is not the best. The paper should clarify that the recommended Dmul is a robust overall choice, not the best in every configuration, and should report per-model gains rather than only the average.
  4. [§5.1 and §5.4] The paper reports results from 10 seeds but does not report standard deviations or confidence intervals anywhere in Tables 1-6. Given that poisoning success rates can be noisy (e.g., Table 5 shows 3.00% for BP across three models), the absence of variance makes it difficult to assess whether differences such as 88.85% versus 90.13% on ResNet-18 are significant. The authors should provide error bars or at least a variance table in the appendix.
minor comments (5)
  1. [§5.1 / Appendix C.2] The ImageNet results are based on only 5 selected cars, as disclosed in Appendix C.2. This is a reasonable practical choice, but the paper should explicitly state in Section 5.1 that the ImageNet numbers are for a small, carefully selected target set, so that readers do not over-generalize the ImageNet results.
  2. [§5.4] The handmade dataset experiment provides 10 images from each of only two scenes to the poisoner, and the test images come from the same two scenes. This is a strength for controlling lighting and background, but it also means the evaluation does not test generalization to an entirely new scene; the manuscript should say this limitation explicitly.
  3. [Eq. (2)] There is a typographical error in the constraint: "L(fθ, S ′(∆), A)" has an extra unmatched parenthesis. It should be L(fθ, S′(∆), A).
  4. [Appendix B.1] The phrase "In other word" should be "In other words."
  5. [§6.1] The statement that adding retraining does not help in the previous TDP scenario is interesting but underexplored. A brief explanation or reference to the known behavior would improve readability.

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity found: Dmul is a new objective evaluated on held-out variants, and Proposition 1 is a conditional theorem, not a fit to the reported success rates.

full rationale

The derivation chain is self-contained. The proposed loss Dmul(Lp,Lt)=DED(Lp,Lt)*Dcos(Lp,Lt) (Eq. 9) is defined on the gradients of the poison batch and the known target set; poisoning success is measured on target variants that the poisoner never optimizes over, so the evaluation metric is not an optimand by construction. The theoretical support (Proposition 1, Appendix A) is explicitly conditional: it assumes the average target gradient and a gradient-closeness ball, then shows that, under a single gradient-descent step with a dropped Taylor remainder, a smaller Euclidean distance yields a larger loss drop on samples whose gradients satisfy Eq. 11. This is a stated modeling premise, not a fitted constant calibrated to the success numbers, and the proof does not define the evaluation metric in terms of Dmul. The paper has no load-bearing self-citation chain: the only author-overlapping reference, Liu et al. [23], merely names standard poison-removal baselines and does not justify the central claim; the gradient-matching framework and the Euclidean-distance observation are cited to external prior work [8]. The strongest caveat is external validity, not circularity: with 10 known views spread over a 360-degree rotation, held-out views may be near known views, so the experiments may demonstrate interpolation rather than extrapolation to distant physical conditions; that is a question of whether the benchmark supports the generalization claim, not a reduction of the claim to its inputs.

Assumptions & free parameters 5 free parameters · 6 assumptions · 0 invented entities

The method is an empirical attack built on prior gradient-matching machinery. It introduces no new physical entities; its free parameters are experimental hyperparameters. The main axioms are the standard white-box TDP assumptions plus an unmeasured gradient-closeness condition used in the theoretical motivation.

free parameters (5)
  • epsilon (L_infinity perturbation bound) = 16 on CIFAR-10, 8 on ImageNet subset
    Chosen by hand as the attack strength budget. Ablation in Fig 6c shows success rate drops sharply for epsilon below 8, so the reported results depend on this choice.
  • S (poison optimization steps) = 250
    Fixed across experiments; no sensitivity analysis is reported for this parameter.
  • R (retraining times) = 4 on CIFAR-10, 2 on ImageNet subset, 1 on full ImageNet trial
    Ablation shows more retraining improves success rate and increases cost linearly, so the reported numbers are tied to this manual choice.
  • alpha (poisoning budget) = 1% of CIFAR-10, 0.5% of ImageNet subset
    Manual choice; Fig 6a shows success rate rises with budget, so lower budgets weaken the attack.
  • m (known target variants) = 10 for Multi-View Car, 20 for handmade and CUB
    Manual choice; Fig 6b shows more known variants improve success rate, so generalization claims depend on how many views the poisoner receives.
assumptions (6)
  • domain assumption All samples of a target physical object have gradients lying in an L2 ball around the average target gradient.
    Stated at the start of Appendix A before Proposition 1 and used to argue that matching the average target gradient transfers to unseen views. Not empirically validated.
  • domain assumption Gradient matching between poison and target is a valid surrogate for poisoning success.
    Inherited from Witches' Brew [8]; the paper optimizes Dcos, DED, Dadd, or Dmul instead of the bi-level objective directly in Section 4.
  • domain assumption Poisoner knows the victim's training set, architecture, optimizer, and augmentation setting.
    Threat model in Section 3.1; standard in TDP but a strong white-box assumption. Transferability results relax architecture but still assume dataset knowledge.
  • domain assumption Data augmentation cannot simulate physical object variations.
    Appendix B.1 reports that augmenting target samples decreases success rate, and the paper concludes digital transformations differ from physical variations. This supports dropping augmentation from the target loss.
  • standard math A single gradient descent step and Taylor expansion with a small remainder approximate training dynamics.
    Used in the proof of Proposition 1 in Appendix A, Eq 14; the remainder term C is not bounded, so the result is heuristic rather than a rigorous guarantee.
  • domain assumption Selected ImageNet cars are representative of physical objects.
    Appendix C.2 selects 5 cars that all map to the sports car category regardless of viewpoint, excluding objects with viewpoint-dependent labels. This favorable selection is not tested.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Generalizable Targeted Data Poisoning against Varying Physical Objects." pith.science (2026). https://pith.science/paper/MTWPF2AJ

@misc{pith2026241203908,
  author       = {Pith},
  title        = {Pith review of: Generalizable Targeted Data Poisoning against Varying Physical Objects},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/MTWPF2AJ}},
  note         = {Machine review of arXiv:2412.03908}
}
read the original abstract

Targeted data poisoning (TDP) aims to compromise the model's prediction on a specific (test) target by perturbing a small subset of training data. Existing work on TDP has focused on an overly ideal threat model in which the same image sample of the target is used during both poisoning and inference stages. However, in the real world, a target object often appears in complex variations due to changes of physical settings such as viewpoint, background, and lighting conditions. In this work, we take the first step toward understanding the real-world threats of TDP by studying its generalizability across varying physical conditions. In particular, we observe that solely optimizing gradient directions, as adopted by the best previous TDP method, achieves limited generalization. To address this limitation, we propose optimizing both the gradient direction and magnitude for more generalizable gradient matching, thereby leading to higher poisoning success rates. For instance, our method outperforms the state of the art by 19.49% when poisoning CIFAR-10 images targeting multi-view cars.

Figures

Figures reproduced from arXiv: 2412.03908 by the authors.

Figure 1
Figure 1. Compared to the previous, overly ideal threat model, [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. Witches’ Brew [8] is only effective when the viewpoint known by the poisoner (x-axis) is in the test viewpoint range (y￾axis), implying low generalizability across target variations. samples (available to the poisoner) is insufficient to cap￾ture the actual objective of the adversary, since it is unclear whether the poisoning success can be transferred to the tar￾get object under unknown physical variations. Therefo… view at source ↗
Figure 4
Figure 4. Visualizations of target samples in the Multi-View Car [PITH_FULL_IMAGE:figures/full_fig_p005_4.png] view at source ↗
Figures from the paper (5 more)
Figure 5
Figure 5. Figure 5: Poisoning success rates against robust training defenses. [PITH_FULL_IMAGE:figures/full_fig_p007_5.png]
Figure 6
Figure 6. Figure 6: Ablations on Multi-View Car and CUB-200-2011. [PITH_FULL_IMAGE:figures/full_fig_p008_6.png]
Figure 7
Figure 7. Figure 7: Poisoning success rates of standard gradient matching [PITH_FULL_IMAGE:figures/full_fig_p011_7.png]
Figure 8
Figure 8. Figure 8: Visualization of target physical objects in our handmade dataset. [PITH_FULL_IMAGE:figures/full_fig_p013_8.png]
Figure 9
Figure 9. Figure 9: Visualization of poison samples. 13 [PITH_FULL_IMAGE:figures/full_fig_p013_9.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

44 extracted references · 35 canonical work pages

  1. [1]

    Bullseye polytope: A scalable clean-label poisoning attack with improved trans- ferability

    Hojjat Aghakhani, Dongyu Meng, Yu-Xiang Wang, Christo- pher Kruegel, and Giovanni Vigna. Bullseye polytope: A scalable clean-label poisoning attack with improved trans- ferability. In European symposium on security and privacy , pages 159–178. IEEE, 2021. 1, 2, 3, 5, 8

    work page 2021

  2. [2]

    Poison- ing attacks against support vector machines

    Battista Biggio, Blaine Nelson, and Pavel Laskov. Poison- ing attacks against support vector machines. InInternational Conference on Machine Learning, pages 1467–1474, 2012. 1

    work page 2012

  3. [3]

    Poisoning web-scale training datasets is practical

    Nicholas Carlini, Matthew Jagielski, Christopher A Choquette-Choo, Daniel Paleka, Will Pearce, Hyrum An- derson, Andreas Terzis, Kurt Thomas, and Florian Tram `er. Poisoning web-scale training datasets is practical. In IEEE Symposium on Security and Privacy , pages 407–425. IEEE,

    work page

  4. [4]

    Conceptual 12m: Pushing web-scale image-text pre- training to recognize long-tail visual concepts

    Soravit Changpinyo, Piyush Sharma, Nan Ding, and Radu Soricut. Conceptual 12m: Pushing web-scale image-text pre- training to recognize long-tail visual concepts. In Proceed- ings of the IEEE/CVF conference on computer vision and pattern recognition, pages 3558–3568, 2021. 1

    2021

  5. [5]

    Wild patterns reloaded: A survey of machine learning security against training data poisoning

    Antonio Emanuele Cin `a, Kathrin Grosse, Ambra Demontis, Sebastiano Vascon, Werner Zellinger, Bernhard A Moser, Alina Oprea, Battista Biggio, Marcello Pelillo, and Fabio Roli. Wild patterns reloaded: A survey of machine learning security against training data poisoning. ACM Computing Surveys, 55(13s):1–39, 2023. 1, 2

    work page 2023

  6. [6]

    Robust unlearnable examples: Protecting data privacy against adversarial learning

    Shaopeng Fu, Fengxiang He, Yang Liu, Li Shen, and Dacheng Tao. Robust unlearnable examples: Protecting data privacy against adversarial learning. In International Con- ference on Learning Representations, 2022. 6

    work page 2022

  7. [7]

    Dat- acomp: In search of the next generation of multimodal datasets

    Samir Yitzhak Gadre, Gabriel Ilharco, Alex Fang, Jonathan Hayase, Georgios Smyrnis, Thao Nguyen, Ryan Marten, Mitchell Wortsman, Dhruba Ghosh, Jieyu Zhang, et al. Dat- acomp: In search of the next generation of multimodal datasets. Advances in Neural Information Processing Sys- tems, 36, 2024. 1

    work page 2024

  8. [8]

    Ronny Huang, Wojciech Czaja, Gavin Taylor, Michael Moeller, and Tom Goldstein

    Jonas Geiping, Liam H Fowl, W. Ronny Huang, Wojciech Czaja, Gavin Taylor, Michael Moeller, and Tom Goldstein. Witches’ brew: Industrial scale data poisoning via gradient matching. In International Conference on Learning Repre- sentations, 2021. 1, 2, 3, 4, 6, 7, 8, 11, 12

    work page 2021

Show all 44 references
  1. [9]

    Dataset security for machine learning: Data poisoning, backdoor attacks, and defenses

    Micah Goldblum, Dimitris Tsipras, Chulin Xie, Xinyun Chen, Avi Schwarzschild, Dawn Song, Aleksander Madry, Bo Li, and Tom Goldstein. Dataset security for machine learning: Data poisoning, backdoor attacks, and defenses. IEEE Transactions on Pattern Analysis and Machine Intelli...

    2023

  2. [10]

    Levit: a vision transformer in convnet’s clothing for faster inference

    Benjamin Graham, Alaaeldin El-Nouby, Hugo Touvron, Pierre Stock, Armand Joulin, Herv ´e J ´egou, and Matthijs Douze. Levit: a vision transformer in convnet’s clothing for faster inference. In Proceedings of the IEEE/CVF interna- tional conference on computer vision , pages 122...

  3. [11]

    Badnets: Evaluating backdooring attacks on deep neu- ral networks

    Tianyu Gu, Kang Liu, Brendan Dolan-Gavitt, and Siddharth Garg. Badnets: Evaluating backdooring attacks on deep neu- ral networks. IEEE Access, 7:47230–47244, 2019. 1

    2019

  4. [12]

    On the effectiveness of mitigating data poisoning attacks with gradient shaping

    Sanghyun Hong, Varun Chandrasekaran, Yi ˘gitcan Kaya, Tu- dor Dumitras ¸, and Nicolas Papernot. On the effectiveness of mitigating data poisoning attacks with gradient shaping. arXiv preprint arXiv:2002.11497, 2020. 7

    2002 arXiv

  5. [13]

    Nat- uralistic physical adversarial patch for object detectors

    Yu-Chih-Tuan Hu, Bo-Han Kung, Daniel Stanley Tan, Jun- Cheng Chen, Kai-Lung Hua, and Wen-Huang Cheng. Nat- uralistic physical adversarial patch for object detectors. In Proceedings of the IEEE/CVF International Conference on Computer Vision (ICCV), 2021. 2

    2021

  6. [14]

    Adversarial texture for fooling person detectors in the physical world

    Zhanhao Hu, Siyuan Huang, Xiaopei Zhu, Fuchun Sun, Bo Zhang, and Xiaolin Hu. Adversarial texture for fooling person detectors in the physical world. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 13307–13316, 2022. 2

    2022

  7. [15]

    Unlearnable examples: Making personal data unexploitable

    Hanxun Huang, Xingjun Ma, Sarah Monazam Erfani, James Bailey, and Yisen Wang. Unlearnable examples: Making personal data unexploitable. In International Conference on Learning Representations, 2021. 6

    2021

  8. [16]

    T-sea: Transfer-based self-ensemble attack on object detection

    Hao Huang, Ziyan Chen, Huanran Chen, Yongtao Wang, and Kevin Zhang. T-sea: Transfer-based self-ensemble attack on object detection. In Proceedings of the IEEE/CVF con- ference on computer vision and pattern recognition , pages 20514–20523, 2023. 2

    2023

  9. [17]

    Ronny Huang, Jonas Geiping, Liam Fowl, Gavin Taylor, and Tom Goldstein

    W. Ronny Huang, Jonas Geiping, Liam Fowl, Gavin Taylor, and Tom Goldstein. Metapoison: Practical general-purpose clean-label data poisoning. In Advances in Neural Informa- tion Processing Systems, pages 12080–12091. Curran Asso- ciates, Inc., 2020. 1, 2, 3, 6

    2020

  10. [18]

    Subpopulation data poisoning attacks

    Matthew Jagielski, Giorgio Severi, Niklas Pousette Harger, and Alina Oprea. Subpopulation data poisoning attacks. In ACM SIGSAC Conference on Computer and Communica- tions Security, pages 3104–3122, 2021. 8

    2021

  11. [19]

    Lavan: Localized and visible adversarial noise

    Danny Karmon, Daniel Zoran, and Yoav Goldberg. Lavan: Localized and visible adversarial noise. In International conference on machine learning, pages 2507–2515. PMLR,

  12. [20]

    Understanding black-box predictions via influence functions

    Pang Wei Koh and Percy Liang. Understanding black-box predictions via influence functions. In International confer- ence on machine learning, pages 1885–1894. PMLR, 2017. 1, 2

    2017

  13. [21]

    Diffusion to confusion: Naturalistic adversarial patch generation based on diffusion model for object detector

    Shuo-Yen Lin, Ernie Chu, Che-Hsien Lin, Jun-Cheng Chen, and Jia-Ching Wang. Diffusion to confusion: Naturalistic adversarial patch generation based on diffusion model for object detector. arXiv preprint arXiv:2307.08076, 2023. 2

    2023 arXiv

  14. [22]

    Swin transformer v2: Scaling up capacity and resolution

    Ze Liu, Han Hu, Yutong Lin, Zhuliang Yao, Zhenda Xie, Yixuan Wei, Jia Ning, Yue Cao, Zheng Zhang, Li Dong, et al. Swin transformer v2: Scaling up capacity and resolution. In Proceedings of the IEEE/CVF conference on computer vi- sion and pattern recognition, pages 12009–12019,...

    2022

  15. [23]

    Image shortcut squeezing: Countering perturbative availability poi- sons with compression

    Zhuoran Liu, Zhengyu Zhao, and Martha Larson. Image shortcut squeezing: Countering perturbative availability poi- sons with compression. In International conference on ma- chine learning, pages 22473–22487. PMLR, 2023. 7 9

    2023

  16. [24]

    Towards poisoning of deep learning algorithms with back-gradient optimization

    Luis Mu ˜noz-Gonz´alez, Battista Biggio, Ambra Demontis, Andrea Paudice, Vasin Wongrassamee, Emil C Lupu, and Fabio Roli. Towards poisoning of deep learning algorithms with back-gradient optimization. In Proceedings of the 10th ACM workshop on artificial intelligence and secur...

    2017

  17. [25]

    Pose es- timation for category specific multiview object localization

    Mustafa Ozuysal, Vincent Lepetit, and Pascal Fua. Pose es- timation for category specific multiview object localization. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 778–785. IEEE, 2009. 2, 5

    2009

  18. [26]

    Hidden trigger backdoor attacks, 2019

    Aniruddha Saha, Akshayvarun Subramanya, and Hamed Pir- siavash. Hidden trigger backdoor attacks, 2019. 3

    2019

  19. [27]

    Laion-5b: An open large-scale dataset for training next generation image-text models

    Christoph Schuhmann, Romain Beaumont, Richard Vencu, Cade Gordon, Ross Wightman, Mehdi Cherti, Theo Coombes, Aarush Katta, Clayton Mullis, Mitchell Worts- man, et al. Laion-5b: An open large-scale dataset for training next generation image-text models. Advances in Neural In- f...

    2022

  20. [28]

    Just how toxic is data poison- ing? a unified benchmark for backdoor and data poisoning attacks

    Avi Schwarzschild, Micah Goldblum, Arjun Gupta, John P Dickerson, and Tom Goldstein. Just how toxic is data poison- ing? a unified benchmark for backdoor and data poisoning attacks. In International Conference on Machine Learning , pages 9389–9398. PMLR, 2021. 7, 8, 12

    2021

  21. [29]

    Poison frogs! targeted clean-label poisoning attacks on neu- ral networks

    Ali Shafahi, W Ronny Huang, Mahyar Najibi, Octavian Su- ciu, Christoph Studer, Tudor Dumitras, and Tom Goldstein. Poison frogs! targeted clean-label poisoning attacks on neu- ral networks. Advances in neural information processing sys- tems, 31, 2018. 1, 2

    2018

  22. [30]

    Conceptual captions: A cleaned, hypernymed, im- age alt-text dataset for automatic image captioning

    Piyush Sharma, Nan Ding, Sebastian Goodman, and Radu Soricut. Conceptual captions: A cleaned, hypernymed, im- age alt-text dataset for automatic image captioning. In An- nual Meeting of the Association for Computational Linguis- tics, pages 2556–2565, 2018. 1

    2018

  23. [31]

    Sleeper agent: Scalable hidden trigger backdoors for neural networks trained from scratch

    Hossein Souri, Liam Fowl, Rama Chellappa, Micah Gold- blum, and Tom Goldstein. Sleeper agent: Scalable hidden trigger backdoors for neural networks trained from scratch. In Advances in Neural Information Processing Systems , pages 19165–19178. Curran Associates, Inc., 2022. 1, 3, 5, 8

    2022

  24. [32]

    Cer- tified defenses for data poisoning attacks.Advances in neural information processing systems, 30, 2017

    Jacob Steinhardt, Pang Wei W Koh, and Percy S Liang. Cer- tified defenses for data poisoning attacks.Advances in neural information processing systems, 30, 2017. 2

    2017

  25. [33]

    Fooling automated surveillance cameras: adversarial patches to at- tack person detection

    Simen Thys, Wiebe Van Ranst, and Toon Goedem´e. Fooling automated surveillance cameras: adversarial patches to at- tack person detection. In Proceedings of the IEEE/CVF con- ference on computer vision and pattern recognition work- shops, pages 0–0, 2019. 2

    2019

  26. [34]

    The caltech-ucsd birds-200-2011 dataset, 2011

    Catherine Wah, Steve Branson, Peter Welinder, Pietro Per- ona, and Serge Belongie. The caltech-ucsd birds-200-2011 dataset, 2011. 8

    2011

  27. [35]

    Provably unlearnable data examples

    Derui Wang, Minhui Xue, Bo Li, Seyit Camtepe, and Liming Zhu. Provably unlearnable data examples. In 32nd Annual Network and Distributed System Security Symposium, 2025. 6

    2025

  28. [36]

    Backdoor attacks against deep learning systems in the physical world

    Emily Wenger, Josephine Passananti, Arjun Nitin Bhagoji, Yuanshun Yao, Haitao Zheng, and Ben Y Zhao. Backdoor attacks against deep learning systems in the physical world. In Proceedings of the IEEE/CVF conference on computer vi- sion and pattern recognition, pages 6206–6215, 2021. 2

    2021

  29. [37]

    Natural backdoor datasets

    Emily Wenger, Roma Bhattacharjee, Arjun Nitin Bhagoji, Josephine Passananti, Emilio Andere, Haitao Zheng, and Ben Y Zhao. Natural backdoor datasets. arXiv preprint arXiv:2206.10673, 2022. 2

    2022 arXiv

  30. [38]

    Making an invisibility cloak: Real world adversar- ial attacks on object detectors

    Zuxuan Wu, Ser-Nam Lim, Larry S Davis, and Tom Gold- stein. Making an invisibility cloak: Real world adversar- ial attacks on object detectors. In Computer Vision–ECCV 2020: 16th European Conference, Glasgow, UK, August 23– 28, 2020, Proceedings, Part IV 16 , pages 1–17. Springer,

    2020

  31. [39]

    Adversarial la- bel flips attack on support vector machines

    Han Xiao, Huang Xiao, and Claudia Eckert. Adversarial la- bel flips attack on support vector machines. In European Conference on Artificial Intelligence, pages 870–875, 2012. 1

    2012

  32. [40]

    Adversarial t-shirt! evading person detectors in a physical world

    Kaidi Xu, Gaoyuan Zhang, Sijia Liu, Quanfu Fan, Meng- shu Sun, Hongge Chen, Pin-Yu Chen, Yanzhi Wang, and Xue Lin. Adversarial t-shirt! evading person detectors in a physical world. In Computer Vision–ECCV 2020: 16th European Conference, Glasgow, UK, August 23–28, 2020, Procee...

    2020

  33. [41]

    Not all poisons are created equal: Robust training against data poi- soning

    Yu Yang, Tian Yu Liu, and Baharan Mirzasoleiman. Not all poisons are created equal: Robust training against data poi- soning. In International Conference on Machine Learning , pages 25154–25165. PMLR, 2022. 1, 7

    2022

  34. [42]

    Latent backdoor attacks on deep neural networks

    Yuanshun Yao, Huiying Li, Haitao Zheng, and Ben Y Zhao. Latent backdoor attacks on deep neural networks. In ACM SIGSAC conference on computer and communications secu- rity, pages 2041–2055, 2019. 1

    2019

  35. [43]

    Transferable clean- label poisoning attacks on deep neural nets

    Chen Zhu, W Ronny Huang, Hengduo Li, Gavin Taylor, Christoph Studer, and Tom Goldstein. Transferable clean- label poisoning attacks on deep neural nets. In International conference on machine learning, pages 7614–7623. PMLR,

  36. [2019]

    sports car

    1, 2 A. Smaller Gradient Magnitude Leads to More Generalizable Data Poisons We have claimed in Section 4.1 that when the gradient of poison samples has a smaller Euclidean distance to the tar- get gradient, the crafted data poisons can better generalize to semantically similar...

Pith tools

Reviewed August 11, 2026 · model on record in the stance chip above.