{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/just-how-toxic-is-data-poisoning-a-unified","title":"Just How Toxic is Data Poisoning? A Unified Benchmark for Backdoor and Data Poisoning Attacks","arxiv_id":"2006.12557","date":"2020-06-22","proceeding":null,"authors":["Avi Schwarzschild","Micah Goldblum","Arjun Gupta","John P. Dickerson","Tom Goldstein"],"abstract":"Data poisoning and backdoor attacks manipulate training data in order to cause models to fail during inference. A recent survey of industry practitioners found that data poisoning is the number one concern among threats ranging from model stealing to adversarial attacks. However, it remains unclear exactly how dangerous poisoning methods are and which ones are more effective considering that these methods, even ones with identical objectives, have not been tested in consistent or realistic settings. We observe that data poisoning and backdoor attacks are highly sensitive to variations in the testing setup. Moreover, we find that existing methods may not generalize to realistic settings. While these existing works serve as valuable prototypes for data poisoning, we apply rigorous tests to determine the extent to which we should fear them. In order to promote fair comparison in future work, we develop standardized benchmarks for data poisoning and backdoor attacks.","url_abs":"https://arxiv.org/abs/2006.12557v3","url_pdf":"https://arxiv.org/pdf/2006.12557v3.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"just-how-toxic-is-data-poisoning-a-unified","repo_url":"https://github.com/aks2203/poisoning-benchmark","is_official":1,"mentioned_in_paper":1,"mentioned_in_github":1,"framework":"pytorch","reach":{"status":"ok","spdx":"MIT"}},{"paper_slug":"just-how-toxic-is-data-poisoning-a-unified","repo_url":"https://github.com/bboylyg/abl","is_official":0,"mentioned_in_paper":0,"mentioned_in_github":1,"framework":"pytorch","reach":null}],"tasks":[{"task_slug":"data-poisoning","task_name":"Data Poisoning"}],"methods":[],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"syntology_url":"https://syntology.ai/paper/2006.12557","atlas_url":"https://app.syntology.ai/?focus=2006.12557","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"2006.12557"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-25T09:33:49+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/aks2203/poisoning-benchmark","reach":{"status":"ok","spdx":"MIT"}},{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/bboylyg/abl","reach":null}],"summary":{"unverified":10},"by_repo_kind":{"official":{"samples":10,"ran":0,"repositories":1}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":0,"samples":[{"code_sha256_prefix":"1eefa08642082292","entry":"get_error","repo":"aks2203/poisoning-benchmark","repo_kind":"official","path":"benchmark_results_table.py","file_url":"https://github.com/aks2203/poisoning-benchmark/blob/HEAD/benchmark_results_table.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"1eefa08642082292"}},{"code_sha256_prefix":"d3a9b4364ec12c8d","entry":"get_transform","repo":"aks2203/poisoning-benchmark","repo_kind":"official","path":"learning_module.py","file_url":"https://github.com/aks2203/poisoning-benchmark/blob/HEAD/learning_module.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"d3a9b4364ec12c8d"}},{"code_sha256_prefix":"d6133c959befc7f4","entry":"resnet18","repo":"aks2203/poisoning-benchmark","repo_kind":"official","path":"models/resnet.py","file_url":"https://github.com/aks2203/poisoning-benchmark/blob/HEAD/models/resnet.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"d6133c959befc7f4"}},{"code_sha256_prefix":"8d80f28c32ded9d5","entry":"resnet32","repo":"aks2203/poisoning-benchmark","repo_kind":"official","path":"models/clbd_resnet.py","file_url":"https://github.com/aks2203/poisoning-benchmark/blob/HEAD/models/clbd_resnet.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"8d80f28c32ded9d5"}},{"code_sha256_prefix":"509789dd978bf9f1","entry":"resnet34","repo":"aks2203/poisoning-benchmark","repo_kind":"official","path":"models/resnet.py","file_url":"https://github.com/aks2203/poisoning-benchmark/blob/HEAD/models/resnet.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"509789dd978bf9f1"}},{"code_sha256_prefix":"a9fa1e4505be1b67","entry":"resnet50","repo":"aks2203/poisoning-benchmark","repo_kind":"official","path":"models/resnet.py","file_url":"https://github.com/aks2203/poisoning-benchmark/blob/HEAD/models/resnet.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"a9fa1e4505be1b67"}},{"code_sha256_prefix":"c5c5573f3c214926","entry":"test","repo":"aks2203/poisoning-benchmark","repo_kind":"official","path":"learning_module.py","file_url":"https://github.com/aks2203/poisoning-benchmark/blob/HEAD/learning_module.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"c5c5573f3c214926"}},{"code_sha256_prefix":"dae30877338a6c11","entry":"train","repo":"aks2203/poisoning-benchmark","repo_kind":"official","path":"learning_module.py","file_url":"https://github.com/aks2203/poisoning-benchmark/blob/HEAD/learning_module.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"dae30877338a6c11"}},{"code_sha256_prefix":"57636423450ce2a4","entry":"vgg11","repo":"aks2203/poisoning-benchmark","repo_kind":"official","path":"models/vgg.py","file_url":"https://github.com/aks2203/poisoning-benchmark/blob/HEAD/models/vgg.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"57636423450ce2a4"}},{"code_sha256_prefix":"8c60051157c60390","entry":"vgg16","repo":"aks2203/poisoning-benchmark","repo_kind":"official","path":"models/vgg.py","file_url":"https://github.com/aks2203/poisoning-benchmark/blob/HEAD/models/vgg.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"8c60051157c60390"}}]},"arxiv_metadata":null,"syntology_extracted_results":null}