{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/label-poisoning-is-all-you-need","title":"Label Poisoning is All You Need","arxiv_id":"2310.18933","date":"2023-10-29","proceeding":"NeurIPS 2023 11","authors":[],"abstract":"In a backdoor attack, an adversary injects corrupted data into a model's training dataset in order to gain control over its predictions on images with a specific attacker-defined trigger. A typical corrupted training example requires altering both the image, by applying the trigger, and the label. Models trained on clean images, therefore, were considered safe from backdoor attacks. However, in some common machine learning scenarios, the training labels are provided by potentially malicious third-parties. This includes crowd-sourced annotation and knowledge distillation. We, hence, investigate a fundamental question: can we launch a successful backdoor attack by only corrupting labels? We introduce a novel approach to design label-only backdoor attacks, which we call FLIP, and demonstrate its strengths on three datasets (CIFAR-10, CIFAR-100, and Tiny-ImageNet) and four architectures (ResNet-32, ResNet-18, VGG-19, and Vision Transformer). With only 2% of CIFAR-10 labels corrupted, FLIP achieves a near-perfect attack success rate of 99.4% while suffering only a 1.8% drop in the clean test accuracy. Our approach builds upon the recent advances in trajectory matching, originally introduced for dataset distillation.","url_abs":"https://arxiv.org/abs/2310.18933v1","url_pdf":"https://arxiv.org/pdf/2310.18933v1.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"label-poisoning-is-all-you-need","repo_url":"https://github.com/SewoongLab/FLIP","is_official":1,"mentioned_in_paper":0,"mentioned_in_github":1,"framework":"pytorch","reach":{"status":"ok","spdx":"MIT"}}],"tasks":[{"task_slug":"all","task_name":"All"},{"task_slug":"backdoor-attack","task_name":"Backdoor Attack"},{"task_slug":"dataset-distillation","task_name":"Dataset Distillation"},{"task_slug":"knowledge-distillation","task_name":"Knowledge Distillation"}],"methods":[{"method_slug":"flip","method_name":"FLIP"},{"method_slug":"vgg-19","method_name":"VGG-19"}],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"syntology_url":"https://syntology.ai/paper/2310.18933","atlas_url":"https://app.syntology.ai/?focus=2310.18933","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"2310.18933"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-25T09:33:49+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/SewoongLab/FLIP","reach":{"status":"ok","spdx":"MIT"}}],"summary":{"ran":5,"ran_draft_wrong":1,"unverified":4},"by_repo_kind":{"official":{"samples":10,"ran":6,"repositories":1}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":0,"samples":[{"code_sha256_prefix":"bb4da423afd9a6be","entry":"extract_experts","repo":"SewoongLab/FLIP","repo_kind":"official","path":"modules/generate_labels/utils.py","file_url":"https://github.com/SewoongLab/FLIP/blob/HEAD/modules/generate_labels/utils.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"bb4da423afd9a6be"}},{"code_sha256_prefix":"851823b5c0c63f72","entry":"extract_labels","repo":"SewoongLab/FLIP","repo_kind":"official","path":"modules/generate_labels/utils.py","file_url":"https://github.com/SewoongLab/FLIP/blob/HEAD/modules/generate_labels/utils.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"851823b5c0c63f72"}},{"code_sha256_prefix":"8d7ec010c29e813b","entry":"format_time","repo":"SewoongLab/FLIP","repo_kind":"official","path":"modules/pytorch_cifar/utils.py","file_url":"https://github.com/SewoongLab/FLIP/blob/HEAD/modules/pytorch_cifar/utils.py","link_basis":"harvester_set","language":"python","status":"ran_draft_wrong","verification_level":1,"contract_check":"OUTPUT_MISDECLARED","metamorphic_tier":"deterministic","behaviour_fingerprint":true,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"8d7ec010c29e813b"}},{"code_sha256_prefix":"ee9729d4a62f42e5","entry":"generate_full_path","repo":"SewoongLab/FLIP","repo_kind":"official","path":"modules/base_utils/util.py","file_url":"https://github.com/SewoongLab/FLIP/blob/HEAD/modules/base_utils/util.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":true,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"ee9729d4a62f42e5"}},{"code_sha256_prefix":"fab1c3defc14023b","entry":"sgd_step","repo":"SewoongLab/FLIP","repo_kind":"official","path":"modules/generate_labels/utils.py","file_url":"https://github.com/SewoongLab/FLIP/blob/HEAD/modules/generate_labels/utils.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"fab1c3defc14023b"}},{"code_sha256_prefix":"7a5a50840d5238dd","entry":"slurmify_path","repo":"SewoongLab/FLIP","repo_kind":"official","path":"modules/base_utils/util.py","file_url":"https://github.com/SewoongLab/FLIP/blob/HEAD/modules/base_utils/util.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":true,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"7a5a50840d5238dd"}},{"code_sha256_prefix":"7bd3a77007a65eec","entry":"get_mean_and_std","repo":"SewoongLab/FLIP","repo_kind":"official","path":"modules/pytorch_cifar/utils.py","file_url":"https://github.com/SewoongLab/FLIP/blob/HEAD/modules/pytorch_cifar/utils.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"7bd3a77007a65eec"}},{"code_sha256_prefix":"cf38e6ae9b0c2475","entry":"load_cifar_100_dataset","repo":"SewoongLab/FLIP","repo_kind":"official","path":"modules/base_utils/datasets.py","file_url":"https://github.com/SewoongLab/FLIP/blob/HEAD/modules/base_utils/datasets.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"cf38e6ae9b0c2475"}},{"code_sha256_prefix":"c1c852003ee8d90e","entry":"load_cifar_dataset","repo":"SewoongLab/FLIP","repo_kind":"official","path":"modules/base_utils/datasets.py","file_url":"https://github.com/SewoongLab/FLIP/blob/HEAD/modules/base_utils/datasets.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"c1c852003ee8d90e"}},{"code_sha256_prefix":"978cf993d6f35387","entry":"load_dataset","repo":"SewoongLab/FLIP","repo_kind":"official","path":"modules/base_utils/datasets.py","file_url":"https://github.com/SewoongLab/FLIP/blob/HEAD/modules/base_utils/datasets.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"978cf993d6f35387"}}]},"arxiv_metadata":null,"syntology_extracted_results":null}