Not All Poisons are Created Equal: Robust Training against Data Poisoning

1. Introduction

• Poisoning is a security concern because carefully crafted, properly labeled examples can manipulate test-time behavior while evading human inspection.The introduction notes potential relevance to safety- and security-critical applications, including autonomous cars and medical devices.Source: §1 · p. 1
• Existing defenses can substantially degrade generalization, protect against only certain poisoning attacks, or be computationally prohibitive, and the cited approaches lack performance guarantees.Source: §1 · pp. 1–2
• Under bounded perturbations, only a small number of poisons can match the target gradient closely enough to succeed; these effective poisons move away from their original class and become isolated in gradient space.EPIC identifies isolated class medoids in gradient space and drops medoids to which no other point is assigned.Source: §1 · p. 2
• EPIC renders Gradient Matching, Bullseye Polytope, and Feature Collision ineffective with only a slight performance decrease, and is 6.9x faster than Geiping et al. (2021a) with similarly high test accuracy and low attack success rate.The authors describe EPIC as the only effective defense against state-of-the-art attacks that scales efficiently to standard deep learning pipelines.Source: §1 · p. 2

2.1. Targeted Data Poisoning

• Triggerless poisoning perturbs base images so their features or gradients match an adversarially labeled target, while backdoor attacks use trigger-bearing examples to misclassify test inputs carrying that trigger.The section notes that triggerless poisons can resemble their base images and require no test-time modification.Source: §2.1 · p. 2
• Feature Collision matches a target's feature representation, Bullseye Polytope places the target near a poison convex-hull center [Aghakhani et al., 2021], and Gradient Matching aligns poison and target gradients [Geiping et al., 2021b].Source: §2.1 · p. 2
• Sleeper Agent is described as a hidden-trigger backdoor attack that crafts poisons using gradient alignment between patched poisons and targets [Souri et al., 2021].Source: §2.1 · p. 2

2.2. Defense Strategies

• Sanitization defenses filter anomalies in feature, covariance-spectrum, or activation space, or points whose labels disagree with nearby examples; these approaches assume poisons are separable from clean data in input or feature space.The section notes that stronger attacks can place poisons near one another or optimize them to evade detection.Source: §2.2 · p. 2
• Other defenses use augmentation, randomized smoothing, ensembles, gradient constraints, adversarial training, or training-time poison injection, but existing methods can incur performance penalties, limited attack coverage, poor scalability, or no theoretical performance guarantee.The paper contrasts these limitations with its own fast, scalable approach and theoretical guarantees.Source: §2.2 · pp. 2–3

3.2. Not all the poisons are created equal

• Only 8% of poisons are effective in from-scratch training, versus around 90% in transfer learning; matching the higher-dimensional gradient is harder.The paper attributes the difference to the gradient dimension that poisons must match under bounded perturbations.Source: §3.2 · p. 4

3.3. Effective poisons are not examples with highest loss or lowest confidence

• Effective poisons are not necessarily low-confidence or high-loss examples; dropping those examples removes more clean data and does not reliably eliminate effective poisons.They can occur within either class or at the class boundary.Source: §3.3 · p. 4

3.4. Effective poisons become isolated in gradient space

• Effective poisons move toward the target gradient along distinct trajectories, becoming isolated early; ineffective poisons instead form larger gradient clusters.Bounded perturbations may prevent ineffective poisons from matching the target gradient.Source: §3.4 · p. 5

3.5. Eliminating the effective poisons

• After a warmup, EPIC repeatedly finds class medoids in gradient space and drops those with no other examples assigned to them.This targets isolated points in low-density gradient regions.Source: §3.5 · pp. 5–6
• Across from-scratch and transfer-learning settings, EPIC identifies the majority of effective poisons while dropping only a small number of clean examples.The reported cluster analyses cover Gradient Matching from-scratch training and Bullseye Polytope transfer learning.Source: data poisoning attacks · p. 6, §3.5 · p. 6

data poisoning attacks.

• A greedy facility-location objective selects gradient medoids, approximating the NP-hard average-dissimilarity minimization with a (1 − 1/e) guarantee.The greedy method has O(nk) complexity, with lower-complexity stochastic methods also noted.Source: data poisoning attacks · p. 6
• Theorem 3.1 bounds the loss difference from full-data training at each step, supporting similar training dynamics and generalization performance.EPIC drops scattered gradient outliers while preserving important gradient components.Source: data poisoning attacks · p. 7

3.6. Adaptive attacks

• Adaptive attacks could evade EPIC by clustering effective-poison gradients, but matching gradient trajectories may make poison optimization prohibitive.Choosing base examples that yield clustered poison gradients remains future work.Source: §3.6 · p. 7

4.1. Against Data Poisoning Attacks

• The experiments evaluate defenses in 200-epoch and 40-epoch pipelines, using standardized benchmarks and publicly available poisoned datasets.From-scratch attacks used 1% of training examples as poisons with perturbations bounded by ϵ = 8/255.Source: §4.1 · p. 7, §4.1.1 · p. 7

4.1.1. FROM-SCRATCH TRAINING

• On TinyImageNet, when defending against the BP attack while training from scratch, EPIC can train more accurate models than the SOTA defense AP without increasing the success rate of poisoning attacks, and is more scalable.Source: Table 3 · p. 8
• For GM on 100 from-scratch datasets, EPIC reduced average attack success from 45% to 1% while keeping test accuracy above 90%.The benchmark used ResNet-18 and the 200-epoch pipeline.Source: §4.1.1 · p. 8, Table 1 · p. 8
• In from-scratch experiments, EPIC reduced Sleeper Agent’s average attack success from 78.54% to 11.55%.The evaluation used 20 poisoned datasets and measured success on 1,000 patched test images.Source: §4.1.1 · p. 8

4.1.2. TRANSFER LEARNING

• Across 100 white-box benchmark setups, BP succeeded in 86; EPIC reduced its success rate to 1% while increasing test accuracy. On 20 default-seed FC datasets, EPIC reduced success from 40% to 0%.In fine-tuning, EPIC prevented all tested BP attacks without decreasing test accuracy.Source: §4.1.2 · p. 9

4.2. Comparison to SOTA Defenses against GM

• EPIC offers the best trade-offs between defended attack success and test accuracy; adversarial poisoning can match them but takes 6x the training time.The comparison covers 200- and 40-epoch pipelines; EPIC also has substantially faster runtime than other defenses.Source: Table 2 · p. 8, §4.2 · p. 9, Figure 6 · p. 9

4.3. Comparison under Larger Perturbations

• With larger GM perturbations (ϵ = 16), EPIC performed better than the strongest baseline, adversarial poisoning, in the 40-epoch from-scratch setting.The comparison used 20 poisoned datasets sampled from CIFAR-10 benchmark settings.Source: §4.3 · p. 9, Table 4 · p. 9

• Under bounded perturbations, only a small number of poisons can be optimized to match the target gradient closely enough to make an attack successful.Source: §5 · pp. 9–10
• The method significantly decreases the success rates of state-of-the-art targeted attacks, including Gradient Matching and Bullseye Polytope, and easily scales to standard deep learning pipelines.Source: §5 · p. 10
• Training on large gradient clusters of each class eliminates effective poisons and guarantees training dynamics similar to training on the full data.Source: §5 · p. 10
• Effective poisons move away from their original class and become isolated in gradient space.Source: §5 · p. 10

• The µ-PL* condition is equivalent to the µ-PL condition when the global minimizer w* has L(w*) = 0.Source: A. Proof of Theorem 3.1 · p. 12
• The proof builds on a result for gradient descent on the full dataset under Lipschitz continuity and the µ-PL* condition (Liu et al., 2020).Source: A. Proof of Theorem 3.1 · p. 12
• The loss is very non-convex early in training but becomes nearly convex afterward; EPIC starts dropping points after a few epochs, when Lipschitzness, the µ-PL condition, and bounded gradients are likely to hold.Source: A. Proof of Theorem 3.1 · p. 12
• The proof invokes a geometric-series bound and then considers a constant learning rate η.Source: A. Proof of Theorem 3.1 · p. 12