{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/witches-brew-industrial-scale-data-poisoning","title":"Witches' Brew: Industrial Scale Data Poisoning via Gradient Matching","arxiv_id":"2009.02276","date":"2020-09-04","proceeding":"ICLR 2021 1","authors":["Jonas Geiping","Liam Fowl","W. Ronny Huang","Wojciech Czaja","Gavin Taylor","Michael Moeller","Tom Goldstein"],"abstract":"Data Poisoning attacks modify training data to maliciously control a model trained on such data. In this work, we focus on targeted poisoning attacks which cause a reclassification of an unmodified test image and as such breach model integrity. We consider a particularly malicious poisoning attack that is both \"from scratch\" and \"clean label\", meaning we analyze an attack that successfully works against new, randomly initialized models, and is nearly imperceptible to humans, all while perturbing only a small fraction of the training data. Previous poisoning attacks against deep neural networks in this setting have been limited in scope and success, working only in simplified settings or being prohibitively expensive for large datasets. The central mechanism of the new attack is matching the gradient direction of malicious examples. We analyze why this works, supplement with practical considerations. and show its threat to real-world practitioners, finding that it is the first poisoning method to cause targeted misclassification in modern deep networks trained from scratch on a full-sized, poisoned ImageNet dataset. Finally we demonstrate the limitations of existing defensive strategies against such an attack, concluding that data poisoning is a credible threat, even for large-scale deep learning systems.","url_abs":"https://arxiv.org/abs/2009.02276v2","url_pdf":"https://arxiv.org/pdf/2009.02276v2.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"witches-brew-industrial-scale-data-poisoning","repo_url":"https://github.com/JonasGeiping/poisoning-gradient-matching","is_official":1,"mentioned_in_paper":1,"mentioned_in_github":1,"framework":"pytorch","reach":null},{"paper_slug":"witches-brew-industrial-scale-data-poisoning","repo_url":"https://github.com/zjfheart/poison-adv-training","is_official":0,"mentioned_in_paper":0,"mentioned_in_github":1,"framework":"pytorch","reach":null}],"tasks":[{"task_slug":"data-poisoning","task_name":"Data Poisoning"}],"methods":[],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"atlas_url":"https://app.syntology.ai/?focus=2009.02276","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"2009.02276"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-24T18:15:14+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/zjfheart/poison-adv-training","reach":null},{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/JonasGeiping/poisoning-gradient-matching","reach":null}],"summary":{"ran":1,"ran_honours":1,"ran_fixture":1,"ran_draft_wrong":1,"unverified":1},"by_repo_kind":{"official":{"samples":3,"ran":2,"repositories":1},"listed":{"samples":2,"ran":2,"repositories":1}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":5,"samples":[{"code_sha256_prefix":"21400790f199e260","entry":"_Witch","repo":"JonasGeiping/poisoning-gradient-matching","repo_kind":"official","path":"forest/witchcoven/witch_matching.py","file_url":"https://github.com/JonasGeiping/poisoning-gradient-matching/blob/HEAD/forest/witchcoven/witch_matching.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"LGPL-2.1","inline_ok":false,"mcp_get_code":{"code_sha256":"21400790f199e260"}},{"code_sha256_prefix":"06d4e925899711d2","entry":"_passenger_loss","repo":"zjfheart/poison-adv-training","repo_kind":"listed","path":"tar_tools/losses.py","file_url":"https://github.com/zjfheart/poison-adv-training/blob/HEAD/tar_tools/losses.py","link_basis":"first_harvest_node","language":"python","status":"ran_honours","verification_level":1,"contract_check":"HONOURS","metamorphic_tier":null,"behaviour_fingerprint":true,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"06d4e925899711d2"}},{"code_sha256_prefix":"6a5967011bf8de7a","entry":"cw_loss","repo":"JonasGeiping/poisoning-gradient-matching","repo_kind":"official","path":"forest/witchcoven/witch_matching.py","file_url":"https://github.com/JonasGeiping/poisoning-gradient-matching/blob/HEAD/forest/witchcoven/witch_matching.py","link_basis":"first_harvest_node","language":"python","status":"ran_fixture","verification_level":1,"contract_check":"RAISES","metamorphic_tier":"invariant","behaviour_fingerprint":false,"licence":"LGPL-2.1","inline_ok":false,"mcp_get_code":{"code_sha256":"6a5967011bf8de7a"}},{"code_sha256_prefix":"aa126611580474c9","entry":"similarity_loss","repo":"zjfheart/poison-adv-training","repo_kind":"listed","path":"tar_tools/losses.py","file_url":"https://github.com/zjfheart/poison-adv-training/blob/HEAD/tar_tools/losses.py","link_basis":"first_harvest_node","language":"python","status":"ran_draft_wrong","verification_level":1,"contract_check":"MISDECLARED","metamorphic_tier":"deterministic","behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"aa126611580474c9"}},{"code_sha256_prefix":"a798eb5b7cd3ebaf","entry":"WitchGradientMatching","repo":"JonasGeiping/poisoning-gradient-matching","repo_kind":"official","path":"forest/witchcoven/witch_matching.py","file_url":"https://github.com/JonasGeiping/poisoning-gradient-matching/blob/HEAD/forest/witchcoven/witch_matching.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"LGPL-2.1","inline_ok":false,"mcp_get_code":{"code_sha256":"a798eb5b7cd3ebaf"}}]},"arxiv_metadata":null,"syntology_extracted_results":null}