{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/excess-capacity-and-backdoor-poisoning","title":"Excess Capacity and Backdoor Poisoning","arxiv_id":"2109.00685","date":"2021-09-02","proceeding":"NeurIPS 2021 12","authors":["Naren Sarayu Manoj","Avrim Blum"],"abstract":"A backdoor data poisoning attack is an adversarial attack wherein the attacker injects several watermarked, mislabeled training examples into a training set. The watermark does not impact the test-time performance of the model on typical data; however, the model reliably errs on watermarked examples. To gain a better foundational understanding of backdoor data poisoning attacks, we present a formal theoretical framework within which one can discuss backdoor data poisoning attacks for classification problems. We then use this to analyze important statistical and computational issues surrounding these attacks. On the statistical front, we identify a parameter we call the memorization capacity that captures the intrinsic vulnerability of a learning problem to a backdoor attack. This allows us to argue about the robustness of several natural learning problems to backdoor attacks. Our results favoring the attacker involve presenting explicit constructions of backdoor attacks, and our robustness results show that some natural problem settings cannot yield successful backdoor attacks. From a computational standpoint, we show that under certain assumptions, adversarial training can detect the presence of backdoors in a training set. We then show that under similar assumptions, two closely related problems we call backdoor filtering and robust generalization are nearly equivalent. This implies that it is both asymptotically necessary and sufficient to design algorithms that can identify watermarked examples in the training set in order to obtain a learning algorithm that both generalizes well to unseen data and is robust to backdoors.","url_abs":"https://arxiv.org/abs/2109.00685v3","url_pdf":"https://arxiv.org/pdf/2109.00685v3.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"excess-capacity-and-backdoor-poisoning","repo_url":"https://github.com/narenmanoj/mnist-adv-training","is_official":1,"mentioned_in_paper":1,"mentioned_in_github":0,"framework":"tf","reach":{"status":"ok"}}],"tasks":[{"task_slug":"adversarial-attack","task_name":"Adversarial Attack"},{"task_slug":"backdoor-attack","task_name":"Backdoor Attack"},{"task_slug":"data-poisoning","task_name":"Data Poisoning"},{"task_slug":"memorization","task_name":"Memorization"}],"methods":[],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"atlas_url":"https://app.syntology.ai/?focus=2109.00685","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"2109.00685"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-24T18:15:14+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"provenance":"deterministic:regex_extraction","url":"https://github.com/narenmanoj/mnist-adv-training","reach":{"status":"ok"}},{"provenance":"deterministic:regex_extraction","url":"https://github.com/MadryLab/backdoor_data_poisoning","reach":{"status":"ok","spdx":"MIT"}},{"provenance":"deterministic:regex_extraction","url":"https://github.com/skmda37/Adversarial_Machine_Learning_Tensorflow","reach":{"status":"gone","observed_at":"2026-09-17","how":"tree_404+repo_404"}}],"summary":{"unverified":3},"by_repo_kind":{"found_in_text":{"samples":3,"ran":0,"repositories":1}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":0,"samples":[{"code_sha256_prefix":"8819c051481276db","entry":"config_to_namedtuple","repo":"MadryLab/backdoor_data_poisoning","repo_kind":"found_in_text","path":"utilities.py","file_url":"https://github.com/MadryLab/backdoor_data_poisoning/blob/HEAD/utilities.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"8819c051481276db"}},{"code_sha256_prefix":"dbc32498ce12142e","entry":"get_config","repo":"MadryLab/backdoor_data_poisoning","repo_kind":"found_in_text","path":"utilities.py","file_url":"https://github.com/MadryLab/backdoor_data_poisoning/blob/HEAD/utilities.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"dbc32498ce12142e"}},{"code_sha256_prefix":"f668dfcd1116a4f8","entry":"poison","repo":"MadryLab/backdoor_data_poisoning","repo_kind":"found_in_text","path":"dataset_input.py","file_url":"https://github.com/MadryLab/backdoor_data_poisoning/blob/HEAD/dataset_input.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"f668dfcd1116a4f8"}}]},"arxiv_metadata":null,"syntology_extracted_results":null}