{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/adversarial-examples-make-strong-poisons","title":"Adversarial Examples Make Strong Poisons","arxiv_id":"2106.10807","date":"2021-06-21","proceeding":"NeurIPS 2021 12","authors":["Liam Fowl","Micah Goldblum","Ping-Yeh Chiang","Jonas Geiping","Wojtek Czaja","Tom Goldstein"],"abstract":"The adversarial machine learning literature is largely partitioned into evasion attacks on testing data and poisoning attacks on training data. In this work, we show that adversarial examples, originally intended for attacking pre-trained models, are even more effective for data poisoning than recent methods designed specifically for poisoning. Our findings indicate that adversarial examples, when assigned the original label of their natural base image, cannot be used to train a classifier for natural images. Furthermore, when adversarial examples are assigned their adversarial class label, they are useful for training. This suggests that adversarial examples contain useful semantic content, just with the ``wrong'' labels (according to a network, but not a human). Our method, adversarial poisoning, is substantially more effective than existing poisoning methods for secure dataset release, and we release a poisoned version of ImageNet, ImageNet-P, to encourage research into the strength of this form of data obfuscation.","url_abs":"https://arxiv.org/abs/2106.10807v1","url_pdf":"https://arxiv.org/pdf/2106.10807v1.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"adversarial-examples-make-strong-poisons","repo_url":"https://github.com/lhfowl/adversarial_poisons","is_official":1,"mentioned_in_paper":1,"mentioned_in_github":1,"framework":"pytorch","reach":{"status":"ok","spdx":"MIT"}},{"paper_slug":"adversarial-examples-make-strong-poisons","repo_url":"https://github.com/psandovalsegura/learn-from-unlearnable","is_official":0,"mentioned_in_paper":0,"mentioned_in_github":1,"framework":"pytorch","reach":null},{"paper_slug":"adversarial-examples-make-strong-poisons","repo_url":"https://github.com/wxzyd123/safespeech","is_official":0,"mentioned_in_paper":0,"mentioned_in_github":1,"framework":"pytorch","reach":{"status":"ok","spdx":"MIT"}}],"tasks":[{"task_slug":"data-poisoning","task_name":"Data Poisoning"}],"methods":[],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"atlas_url":"https://app.syntology.ai/?focus=2106.10807","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"2106.10807"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-24T18:15:14+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/wxzyd123/safespeech","reach":{"status":"ok","spdx":"MIT"}},{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/psandovalsegura/learn-from-unlearnable","reach":null},{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/lhfowl/adversarial_poisons","reach":{"status":"ok","spdx":"MIT"}}],"summary":{"ran":2},"by_repo_kind":{"official":{"samples":2,"ran":2,"repositories":1}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":0,"samples":[{"code_sha256_prefix":"4304a326c593f8db","entry":"drop_connect","repo":"lhfowl/adversarial_poisons","repo_kind":"official","path":"poison_evaluation/models/efficientnet.py","file_url":"https://github.com/lhfowl/adversarial_poisons/blob/HEAD/poison_evaluation/models/efficientnet.py","link_basis":"harvester_set","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":true,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"4304a326c593f8db"}},{"code_sha256_prefix":"8737c82de631cffc","entry":"swish","repo":"lhfowl/adversarial_poisons","repo_kind":"official","path":"poison_evaluation/models/efficientnet.py","file_url":"https://github.com/lhfowl/adversarial_poisons/blob/HEAD/poison_evaluation/models/efficientnet.py","link_basis":"harvester_set","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":true,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"8737c82de631cffc"}}]},"arxiv_metadata":null,"syntology_extracted_results":null}