Pith. sign in

REVIEW 4 major objections 4 minor 54 references

Provably effective detection of effective data poisoning attacks

T0 review · 4 major / 4 minor · reviewed 2026-08-10 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read This paper proves that any effectively poisoned dataset must be statistically separable from a clean dataset, and gives a polynomial-time test that detects the separation with a bounded error rate.

desk verdict A genuinely novel conformal framework for poison detection whose headline provable guarantee collapses on the independence premise; the experiments are competitive but do not rescue the theory. read the letter →

arxiv 2501.11795 v1 pith:L24I7EXO submitted 2025-01-21 cs.CR cs.CVcs.LGstat.ML

Jonathan Gallagher , Yasaman Esfandiari , Callen MacPhee , Michael Warren This is my paper · ORCID
classification cs.CRcs.CVcs.LGstat.ML MSC 62G1562F0368T05
keywords datapoisoningconformalpredictiontriggerattackexchangeabilityseparabilitytestproactivedefensebackdoorattacksinformation-theoreticsecurity
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Dataset poisoning is usually framed as an optimization problem, which makes detection as hard as solving the attack. This paper formalizes a trigger poison attack as a stochastic transformation of an exchangeable training set and asks what an effective attack necessarily does to the geometry of conformal prediction sets. Its central claim is that effectiveness forces separation: when a poisoned dataset is compared with a clean dataset at a triggered input, the probability that both conformal prediction sets contain the same label is at least $(1-\epsilon)^2$, so an empty intersection is a provably rare event that exposes the poison. The resulting Conformal Separability Test runs in polynomial time, makes no assumptions about how the attacker constructs the poison, and carries a finite-sample detection guarantee. Experiments on patch attacks over CIFAR-10 and GTSRB and on the Witches' Brew clean-label attack report false-negative and false-positive rates competitive with a proactive-defense baseline.

What carries the argument

The carrying object is the conformal prediction $p$-value function $p_{n,A}$, which scores how typical a label is for a given input relative to a dataset, and Algorithm 1's Conformal Separability Test, which computes $p_\cap(D_1,D_2,x) = \max_y \min(p_{D_1}(x,y), p_{D_2}(x,y))$ as the empirical probability that the two datasets' conformal sets overlap at $x$. The machinery pairs this with the notion of an expiry vector $\tau^D(x)$, the per-label $p$-values that determine when each label leaves the prediction set. Lemma 3.37 converts empirical effectiveness into an empty intersection, and Corollary 3.26 plus Theorem 3.25 convert exchangeability and independence of the two sequences into the lower bound $(1-\epsilon)(1-\gamma)$ on that intersection; Theorem 3.27 invokes Glivenko-Cantelli to justify estimating the bound from finite samples.

What would settle it

Measure the empty-intersection rate $\hat{P}(p_\cap(D,P,x)\le \epsilon)$ for any attack that satisfies the paper's own definition of empirical effectiveness, and compare it with $1-(1-\epsilon)^2$; finding a rate above this bound (for example above 0.19 at $\epsilon=0.1$) would disprove Theorem 3.39 as stated.

Watch

Extended reading notes

Core claim

The paper's central discovery is that 'effective' can be defined so that it mathematically implies detectability. An attack is empirically $(1-r)$-effective when, on triggered inputs, the target label becomes the only label in the poisoned conformal prediction set while it was absent from the clean one at confidence above $r$. Lemma 3.37 shows such an attack forces $\Gamma^r_n(D)(tx) \cap \Gamma^r_n(P)(tx) = \emptyset$; Lemma 3.38 shows that, for independent exchangeable samples, this empty intersection has probability at most $1-(1-\epsilon)^2$; Theorem 3.39 assembles these into the statement that $D$ and $P$ are conformally $(\epsilon,\epsilon,(1-\epsilon)^2)$-separable. The authors take this to mean that the act of effectively poisoning a dataset guarantees the attack can be detected with better-than-guessing probability, even when the adversary is computationally unbounded, and that no poisoned dataset and clean dataset can be IID as sequence-valued random variables.

Load-bearing premise

The result's probability bound depends on treating the clean and poisoned datasets as independent random sequences, but a real poison attack constructs the poisoned set from the clean set, so that independence is not automatic and the paper does not prove it.

Editorial extensions

If this is right

  • Effective attacks are detectable with a guaranteed bound on missed detections, so a defender can remove poisoned items with a quantifiable residual risk.
  • The guarantee is independent of the attacker's computational power; the paper claims it covers even non-computable poison functions.
  • The test is polynomial-time, unlike optimization-based provable detection, which the paper notes requires exponential time in the worst case.
  • In the paper's experiments, filtering with the test reduced the Witches' Brew attack's success rate from 35% to 3.5% at a 3% false-positive rate.
  • The results imply an effective poison can never make poisoned data exchangeable with clean data, so 'effective' and 'statistically invisible' are incompatible for this attack model.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Editorial: The strongest point to stress-test is the independence premise in Lemma 3.38, since the poisoned set is defined as a transformation of the clean set; verifying whether the bound survives the resulting dependence is a direct next step.
  • Editorial: The sharp jump in attack success between 0.002% and 0.01% poison rates suggests a threshold effect; if confirmed, defenses might aim to keep poison below the threshold rather than remove all poison.
  • Editorial: The paper's conclusion explicitly leaves open the possibility of poison items that are identically distributed to clean items while still breaking exchangeability, so the theorem's scope is exchangeability violation rather than all distributional equivalence.
  • Editorial: The paper only reports empirical false-positive rates, so a deployment-grade guarantee would require a separate analysis of the test's behavior when both datasets are clean.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 4 minor

Summary. The paper proposes a probabilistic formalization of trigger-based dataset poisoning attacks using exchangeability and Markov kernels, and introduces a Conformal Separability Test that compares conformal prediction sets of a clean dataset and a poisoned dataset. The central theoretical claim (Theorem 3.39) is that if a dataset P is 'effectively poisoned' with respect to an exchangeable dataset D, then D and P are conformally (ε, ε, (1−ε)^2)-separable, meaning the conformal prediction sets at a test point are disjoint with probability at least (1−ε)^2. The authors also present experiments on CIFAR-10 and GTSRB patch attacks and on the Witches' Brew clean-label attack, reporting false-negative and false-positive rates competitive with or better than prior work.

Significance. If the main theorem were valid, the paper would make a substantial contribution: an information-theoretic, polynomial-time defense against dataset poisoning with a finite-sample detection guarantee would be a significant advance over optimization-based defenses that require exponential time. The paper also contains a helpful high-level framing of poisoning via exchangeable sequence-valued random variables, and the experimental comparison with state-of-the-art proactive defenses is a useful data point. However, the central mathematical guarantee is not established: Theorem 3.39 is asserted without proof, the independence premise needed for the (1−ε)^2 bound is unsatisfiable in the paper's own attack model, and the definition of 'effective poisoning' is so close to the detection event that the main theorem risks being a tautology. The paper also does not provide a valid symmetric non-conformity score for the stochastic training procedures used in the experiments. These issues are load-bearing, so the paper in its current form cannot be accepted.

major comments (4)
  1. [§3.4, Theorem 3.39] Theorem 3.39, which is the paper's main theoretical claim, is stated without proof. The preceding text says only that the result 'summarizes the observations in this section,' but the available ingredients are pointwise: Lemma 3.37 shows that if an attack is empirically (1−r)-effective at (x, y), then Γ^r_n(D)(tx) ∩ Γ^r_n(P)(tx) = ∅. No argument is supplied that the pointwise condition, or an expectation over (x, y), yields the sequence-level event Γ^ε_{n,A} ∩ Γ^ε_{n,A} of Definition 3.24 with the claimed probability bound. In addition, the hypothesis 'P is an effectively poisoned dataset with respect to D' is never formally defined; Definition 3.33 only defines empirical (1−r)-effectiveness at a particular point (x, y) for given D and P. The main theorem is therefore unsupported as stated.
  2. [§3.4, Lemma 3.38 and Corollary 3.26] The probability bound (1−ε)^2 requires the two sequence-valued random variables ⟨D1, (X_{n+1}, Y_{n+1})⟩ and ⟨D2, (X_{n+1}, Y_{n+1})⟩ to be independent. In the threat model of Definition 3.11, however, P is obtained from D as the composite of the Markov kernels †, t^k×id, and ⊎, so P is a function of D; the experiments in Section 4 likewise compare T with Tr, where Tr is T with poison applied. Thus D and P are dependent, and the independence premise is not satisfied. Even abstracting from the attack mechanism, the two sequences share the final component (X_{n+1}, Y_{n+1}), which is measurable with respect to both σ-algebras; for independence, that shared component must be almost surely constant. The product bound in Lemma 3.38 therefore cannot be invoked, and Theorem 3.39's quantitative claim is unsupported.
  3. [§3.4, Definition 3.33 and Lemma 3.37] The definition of empirical (1−r)-effectiveness is formulated directly in terms of the p-values that define the conformal sets: condition [re.1] states pD(tx, ty) < min(r, pD(tx, y)), and condition [re.2] states max(τ^P(tx) − ty) ≤ r < pP(tx, ty). Lemma 3.37 then derives the empty-intersection event Γ^r_n(D)(tx) ∩ Γ^r_n(P)(tx) = ∅ from exactly those conditions. Consequently, the statement that an effective attack is detectable by an empty-intersection test is close to a restatement of the definition of effectiveness. The nontrivial content that is missing is a distributional model and a probability bound for the event that an attack satisfying Definition 3.33 occurs; without that, Theorem 3.39 does not provide an independent detection guarantee.
  4. [§4, Experimental Setup and non-conformity score] The experiments use the non-conformity score A(D, x, y) = −entropy(softmax(M_D(x))) / (s_{x,y} ln s_{x,y}), where M_D is trained with Adam, weight decay, and learning-rate schedulers. Such a training procedure is stochastic and is not invariant to permutations of the training set D, so A is not a symmetric non-conformity score as required by Definition 3.15. The paper itself notes in Example 3.17 that stochastic gradient descent or batching would require a convergence result to yield a non-conformity score. No such result is supplied for the training procedure used in Section 4, so the empirical FNR/FPR tables do not inherit the conformal validity guarantee of Theorem 3.22.
minor comments (4)
  1. [§3.3, Corollary 3.26] The word 'conformal' is misspelled as 'confomal' in the statement of Corollary 3.26.
  2. [§3.4, Lemma 3.38] In the sentence 'The probability of p∩(D1, D2, ) ≤ ϵ', the argument x is missing; it should be p∩(D1, D2, x) ≤ ϵ.
  3. [References] Reference [53] has the year '2956'; this should be 1956.
  4. [Throughout] There are several formatting and spelling errors, including 'c´adl´ag' with broken accents, 'na¨ıve', 'IMDB' instead of 'IMDb', and 'D, Pare' missing a space; a careful proofreading pass is needed.

Circularity Check

2 steps flagged · score 7.0 of 10

Theorem 3.39's 'effective attack ⇒ detectable' unpacks Definition 3.33's p-value inequalities; the only quantitative rarity bound needs an independence premise the attack model violates.

  1. self definitional [Section 3.4, Definition 3.33 and Lemma 3.37]
    "Definition 3.33. An attack is empirically (1 − r)-effective at (x, y) given D, P when [re.1] pD(tx, ty) < min(r, pD(tx, y)); [re.2] max(τ P (tx) − ty) ≤ r < pP (tx, ty). ... Lemma 3.37. Suppose an attack is empirically (1 − r)-effective at (x, y), given D, P. Then Γr n(D)(tx) ∩ Γr n(P )(tx) = ∅."

    The definition of empirical effectiveness is written directly in terms of the p-values that define the conformal sets. Condition [re.1] makes pD(tx,ty) < r, so ty is outside Γ^r_D(tx). Condition [re.2] makes pP(tx,ty) > r while every other label has pP ≤ r, so Γ^r_P(tx) = {ty}. Lemma 3.37 merely reads off the conjunction as Γ^r_D(tx) ∩ Γ^r_P(tx) = ∅. Since Algorithm 1 detects poison exactly by observing this intersection to be empty (p∩ ≤ ε), the paper's headline conclusion that 'the very act of effectively poisoning a dataset ensures that the attack can be effectively detected' is a restatement of the effectiveness definition, not a property derived from exchangeability or from conformal validity.

  2. other [Section 3.4, Lemma 3.38 and Theorem 3.39]
    "Lemma 3.38. Suppose that ⟨D1, (Xn+1, Yn+1)⟩ , ⟨D2, (Xn+1, Yn+1)⟩, as (X × Y)n+1-valued random variables are independent in (X × Y)n+1. ... Theorem 3.39. Suppose that D, P are samples from (X × Y)^{n+1}, that D is exchangeable, and that P is an effectively poisoned dataset with respect to D. Then D, P are conformally (ϵ, ϵ,(1 − ϵ)^2)-separable."

    The only quantitative content of Theorem 3.39, the (1−ε)^2 separability bound, is inherited from Lemma 3.38, whose stated premise is that the two sequence-valued random variables are independent. But the paper's own threat model constructs P from D: Definition 3.11 defines the poison attack as a composite of Markov kernels giving P = DC ⊎ t(DP), and the experiments compare T with Tr = T with poison applied. Thus D and P are dependent by construction, not independent. Moreover, the two sequences share the final component (X_{n+1},Y_{n+1}); two independent sequences cannot share a non-constant component. The independence premise is therefore not discharged under the theorem's hypotheses, and Theorem 3.39 is stated without proof.

full rationale

The paper's central mathematical guarantee is largely a restatement of its own effectiveness definition. Definition 3.33 defines an attack to be empirically (1−r)-effective exactly by inequalities on pD and pP that place ty outside Γ^r_D(tx) and make ty the unique element of Γ^r_P(tx); Lemma 3.37 immediately concludes Γ^r_D(tx) ∩ Γ^r_P(tx) = ∅. Since the Conformal Separability Test (Algorithm 1) flags a point precisely when this intersection is empty, the abstract's claim that 'the very act of effectively poisoning a dataset ensures that the attack can be effectively detected' is the definition re-encoded as a detection criterion. The independent conformal validity theorem (Theorem 3.22) is standard and is cited to Vovk et al., so that ingredient is not circular. However, the one non-tautological quantitative step, Lemma 3.38's 1−(1−ε)^2 rarity bound, requires the two data sequences to be independent, while the threat model defines P as a Markov-kernel function of D and the experiments use Tr = T with poison applied; the sequences even share the test point, so the premise is unsatisfied. Theorem 3.39 is also stated without proof, and the dataset-level predicate 'effectively poisoned' is never formally defined (Definition 3.33 is pointwise). The experimental section is a normal benchmark evaluation and is not circular, but as a mathematical derivation the paper's main theorem reduces by construction to the effectiveness definition plus an unfulfilled independence assumption.

Assumptions & free parameters 1 free parameters · 4 assumptions · 0 invented entities

The central claim rests on the exchangeability of clean data (standard in conformal prediction), on an independence premise between clean and poisoned data that is not satisfied by the attack model, and on the paper-specific definition of 'effective' attack. The definition itself encodes the detection outcome, which is the main source of circularity.

free parameters (1)
  • Conformal threshold epsilon
    User-chosen confidence level for the test; reported FNR/FPR in Table 3 are evaluated at 0.1, 0.05, and 0.01, so the headline numbers are threshold-dependent.
assumptions (4)
  • domain assumption Exchangeability of the clean dataset D
    Invoked throughout Section 3; standard in conformal prediction but not guaranteed for all real-world datasets.
  • ad hoc to paper Independence of clean and poisoned datasets
    Needed for the product bound in Lemma 3.38 and Theorem 3.25; contradicted by the attack model where P = DC ∪ t(DP).
  • ad hoc to paper The experimental non-conformity score is a valid symmetric non-conformity score
    The score uses stochastically trained neural networks, so symmetry in the first n arguments is not assured; this undermines the conformal validity guarantee.
  • domain assumption The paper's notion of 'empirically effective' captures practically successful attacks
    Definitions 3.30 to 3.33 are paper-specific; no proof is given that all real-world effective attacks satisfy these conditions.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Provably effective detection of effective data poisoning attacks." pith.science (2026). https://pith.science/paper/L24I7EXO

@misc{pith2026250111795,
  author       = {Pith},
  title        = {Pith review of: Provably effective detection of effective data poisoning attacks},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/L24I7EXO}},
  note         = {Machine review of arXiv:2501.11795}
}
read the original abstract

This paper establishes a mathematically precise definition of dataset poisoning attack and proves that the very act of effectively poisoning a dataset ensures that the attack can be effectively detected. On top of a mathematical guarantee that dataset poisoning is identifiable by a new statistical test that we call the Conformal Separability Test, we provide experimental evidence that we can adequately detect poisoning attempts in the real world.

Figures

Figures reproduced from arXiv: 2501.11795 by the authors.

Figure 1
Figure 1. Notional poisoning of ImageNet [13]. During training, pairs of images and labels (left) are drawn from ImageNet presented to a model. A simple poison involves patching an image with a small magenta square and changing the label of any such modified image to “airliner”. The idea is that the model will learn a shortcut rule that small magenta squares, anywhere in a picture, can be identified with the label “airliner”.… view at source ↗
Figure 2
Figure 2. Depiction of a typical machine learning pipeline with highlighted [PITH_FULL_IMAGE:figures/full_fig_p005_2.png] view at source ↗
Figure 3
Figure 3. An approximate visualization of conformal prediction sets at two [PITH_FULL_IMAGE:figures/full_fig_p013_3.png] view at source ↗
Figures from the paper (3 more)
Figure 4
Figure 4. Figure 4: Visualization of Conformal Separability. Conformal Separability is a [PITH_FULL_IMAGE:figures/full_fig_p016_4.png]
Figure 5
Figure 5. Figure 5: Sample CIFAR10 (top) and GTSRB (bottom) images with the patch [PITH_FULL_IMAGE:figures/full_fig_p025_5.png]
Figure 6
Figure 6. Figure 6: The Conformal Separability Test can be used to detect attacks that [PITH_FULL_IMAGE:figures/full_fig_p029_6.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

54 extracted references · 40 canonical work pages

  1. [1]

    Badnets: Identifying vulnerabilities in the machine learning model supply chain,

    T. Gu, B. Dolan-Gavitt, and S. Garg, “Badnets: Identifying vulnerabilities in the machine learning model supply chain,”arXiv preprint arXiv:1708.06733, 2017

    arXiv 2017

  2. [2]

    Poison frogs! targeted clean- label poisoning attacks on neural networks,

    A. Shafahi, W. R. Huang, M. Najibi, et al., “Poison frogs! targeted clean- label poisoning attacks on neural networks,” Advances in neural informa- tion processing systems, vol. 31, 2018

    work page 2018

  3. [3]

    Witches’ brew: Industrial scale data poisoning via gradient matching,

    J. Geiping, L. Fowl, W. R. Huang, et al., “Witches’ brew: Industrial scale data poisoning via gradient matching,” arXiv preprint arXiv:2009.02276 , 2020

    arXiv 2009

  4. [4]

    Rethinking backdoor at- tacks,

    A. Khaddaj, G. Leclerc, A. Makelov, et al. , “Rethinking backdoor at- tacks,” in International Conference on Machine Learning , PMLR, 2023, pp. 16 216–16 236

    work page 2023

  5. [5]

    Just how toxic is data poisoning? a unified benchmark for back- door and data poisoning attacks,

    A. Schwarzschild, M. Goldblum, A. Gupta, J. P. Dickerson, and T. Gold- stein, “Just how toxic is data poisoning? a unified benchmark for back- door and data poisoning attacks,” inInternational Conference on Machine Learning, PMLR, 2021, pp. 9389–9398

    work page 2021

  6. [6]

    Towards a proactive ml approach for detecting backdoor poison samples,

    X. Qi, T. Xie, J. T. Wang, T. Wu, S. Mahloujifar, and P. Mittal, “Towards a proactive ml approach for detecting backdoor poison samples,” inUsenix Security, vol. 32, 2023, pp. 1685–1702

    work page 2023

  7. [7]

    Revisiting unreasonable effectiveness of data in deep learning era,

    C. Sun, A. Shrivastava, S. Singh, and A. Gupta, “Revisiting unreasonable effectiveness of data in deep learning era,” in Proceedings of the IEEE international conference on computer vision , 2017, pp. 843–852

    2017

  8. [8]

    How much data is needed to train a medical image deep learning system to achieve necessary high accuracy?

    J. Cho, K. Lee, E. Shin, G. Choy, and S. Do, “How much data is needed to train a medical image deep learning system to achieve necessary high accuracy?” arXiv preprint arXiv:1511.06348 , 2015

    arXiv 2015

Show all 54 references
  1. [9]

    Data management challenges for deep learning,

    A. Munappy, J. Bosch, H. H. Olsson, A. Arpteg, and B. Brinne, “Data management challenges for deep learning,” in 2019 45th Euromicro Con- ference on Software Engineering and Advanced Applications (SEAA), IEEE, 2019, pp. 140–147. 31

    2019

  2. [10]

    Learning knowledge base inference with neural theorem provers,

    T. Rockt¨ aschel and S. Riedel, “Learning knowledge base inference with neural theorem provers,” in Proceedings of the 5th workshop on automated knowledge base construction , 2016, pp. 45–50

    2016

  3. [11]

    Targeted backdoor at- tacks on deep learning systems using data poisoning,

    X. Chen, C. Liu, B. Li, K. Lu, and D. Song, “Targeted backdoor at- tacks on deep learning systems using data poisoning,” arXiv preprint arXiv:1712.05526, 2017

    2017 arXiv

  4. [12]

    Towards poisoning of deep learning algorithms with back-gradient optimization,

    L. Mu˜ noz-Gonz´ alez, B. Biggio, A. Demontis,et al., “Towards poisoning of deep learning algorithms with back-gradient optimization,” in Proceedings of the 10th ACM workshop on artificial intelligence and security , 2017, pp. 27–38

    2017

  5. [13]

    ImageNet: A Large-Scale Hierarchical Image Database,

    J. Deng, W. Dong, R. Socher, L.-J. Li, K. Li, and L. Fei-Fei, “ImageNet: A Large-Scale Hierarchical Image Database,” in CVPR09, 2009

    2009

  6. [14]

    Rethinking the backdoor at- tacks’ triggers: A frequency perspective,

    Y. Zeng, W. Park, Z. M. Mao, and R. Jia, “Rethinking the backdoor at- tacks’ triggers: A frequency perspective,” inProceedings of the IEEE/CVF international conference on computer vision , 2021, pp. 16 473–16 481

    2021

  7. [15]

    Dataset security for machine learning: Data poisoning, backdoor attacks, and defenses,

    M. Goldblum, D. Tsipras, C. Xie, et al. , “Dataset security for machine learning: Data poisoning, backdoor attacks, and defenses,” IEEE Trans- actions on Pattern Analysis and Machine Intelligence , vol. 45, no. 2, pp. 1563–1580, 2022

    2022

  8. [16]

    Towards deep learning models resistant to adversarial attacks,

    A. Madry, A. Makelov, L. Schmidt, D. Tsipras, and A. Vladu, “Towards deep learning models resistant to adversarial attacks,” arXiv preprint arXiv:1706.06083, 2017

    2017 arXiv

  9. [17]

    Adversar- ial attacks on neural network policies,

    S. Huang, N. Papernot, I. Goodfellow, Y. Duan, and P. Abbeel, “Adversar- ial attacks on neural network policies,” arXiv preprint arXiv:1702.02284 , 2017

    2017 arXiv

  10. [18]

    Clean-label backdoor attacks,

    A. Turner, D. Tsipras, and A. Madry, “Clean-label backdoor attacks,” 2018

    2018

  11. [19]

    Security by obscurity,

    R. T. Mercuri and P. G. Neumann, “Security by obscurity,” Communica- tions of the ACM , vol. 46, no. 11, p. 160, 2003

    2003

  12. [20]

    Kumar, How wikipedia is served to you: A complex web of open source and caching

    S. Kumar, How wikipedia is served to you: A complex web of open source and caching

  13. [21]

    Composite back- door attacks against large language models,

    H. Huang, Z. Zhao, M. Backes, Y. Shen, and Y. Zhang, “Composite back- door attacks against large language models,”arXiv preprint arXiv:2310.07676, 2023

    2023 arXiv

  14. [22]

    Decoding the threat landscape: Chatgpt, fraudgpt, and wormgpt in social engineering attacks,

    P. V. Falade, “Decoding the threat landscape: Chatgpt, fraudgpt, and wormgpt in social engineering attacks,” arXiv preprint arXiv:2310.05595, 2023

    2023 arXiv

  15. [23]

    Afifi-Sabet, Poisoned ai went rogue during training and couldn ’t be taught to behave again in ’legitimately scary’ study, Article: https://www.livescience.com, Jan

    K. Afifi-Sabet, Poisoned ai went rogue during training and couldn ’t be taught to behave again in ’legitimately scary’ study, Article: https://www.livescience.com, Jan. 2024

    2024

  16. [24]

    Identifying adversarial attacks on text classifiers,

    Z. Xie, J. Brophy, A. Noack, et al. , “Identifying adversarial attacks on text classifiers,” arXiv preprint arXiv:2201.08555 , 2022. 32

    2022 arXiv

  17. [25]

    ryanrudes, Wikimedia-commons-dataset

  18. [26]

    Poisoning web- scale training datasets is practical,

    N. Carlini, M. Jagielski, C. A. Choquette-Choo, et al. , “Poisoning web- scale training datasets is practical,” arXiv preprint arXiv:2302.10149 , 2023

    2023 arXiv

  19. [27]

    T. Thomson, Data poisoning: How artists are sabotaging ai to take revenge on image generators, https://theconversation.com/data-poisoning- how - artists - are - sabotaging - ai - to - take - revenge - on - image - generators-219335, Dec. 2023

    2023

  20. [28]

    Uncertainty-weighted loss functions for im- proved adversarial attacks on semantic segmentation,

    K. Maag and A. Fischer, “Uncertainty-weighted loss functions for im- proved adversarial attacks on semantic segmentation,” in Proceedings of the IEEE/CVF Winter Conference on Applications of Computer Vision , 2024, pp. 3906–3914

    2024

  21. [29]

    Nozzle: A defense against heap-spraying code injection attacks.,

    P. Ratanaworabhan, V. B. Livshits, and B. G. Zorn, “Nozzle: A defense against heap-spraying code injection attacks.,” in USENIX security sym- posium, 2009, pp. 169–186

    2009

  22. [30]

    Subpopula- tion data poisoning attacks,

    M. Jagielski, G. Severi, N. Pousette Harger, and A. Oprea, “Subpopula- tion data poisoning attacks,” in Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security , 2021, pp. 3104– 3122

    2021

  23. [31]

    Ai language models: Technological, socio-economic and policy considerations,

    OECD, “Ai language models: Technological, socio-economic and policy considerations,” OECD, vol. 352, p. 1, 2023

    2023

  24. [32]

    The evolution of integrated advance persistent threat and its defense solutions: A literature review,

    J. Zhang and D. Tenney, “The evolution of integrated advance persistent threat and its defense solutions: A literature review,” Open Journal of Business and Management , vol. 12, no. 1, pp. 293–338, 2023

    2023

  25. [33]

    Adversarial concept drift detection un- der poisoning attacks for robust data stream mining,

    L. Korycki and B. Krawczyk, “Adversarial concept drift detection un- der poisoning attacks for robust data stream mining,” Machine Learning, vol. 112, no. 10, pp. 4013–4048, 2023

    2023

  26. [34]

    Deep k-nn defense against clean- label data poisoning attacks,

    N. Peri, N. Gupta, W. R. Huang, et al., “Deep k-nn defense against clean- label data poisoning attacks,” in Computer Vision–ECCV 2020 Work- shops: Glasgow, UK, August 23–28, 2020, Proceedings, Part I 16, Springer, 2020, pp. 55–70

    2020

  27. [35]

    Data poisoning attacks on regression learning and corresponding defenses,

    N. M¨ uller, D. Kowatsch, and K. B¨ ottinger, “Data poisoning attacks on regression learning and corresponding defenses,” in 2020 IEEE 25th Pa- cific Rim International Symposium on Dependable Computing (PRDC) , IEEE, 2020, pp. 80–89

    2020

  28. [36]

    Data augmentation for graph neural networks,

    T. Zhao, Y. Liu, L. Neves, O. Woodford, M. Jiang, and N. Shah, “Data augmentation for graph neural networks,” in Proceedings of the aaai con- ference on artificial intelligence , vol. 35, 2021, pp. 11 015–11 023

    2021

  29. [37]

    Data poisoning against differentially-private learners: Attacks and defenses,

    Y. Ma, X. Zhu, and J. Hsu, “Data poisoning against differentially-private learners: Attacks and defenses,” arXiv preprint arXiv:1903.09860 , 2019. 33

    1903 arXiv

  30. [38]

    Deep learning with differential privacy,

    M. Abadi, A. Chu, I. Goodfellow, et al. , “Deep learning with differential privacy,” in Proceedings of the 2016 ACM SIGSAC conference on com- puter and communications security , 2016, pp. 308–318

    2016

  31. [39]

    Backdoor or feature? a new perspective on data poisoning,

    A. Khaddaj, G. Leclerc, A. Makelov, et al. , “Backdoor or feature? a new perspective on data poisoning,”

  32. [40]

    Machine learning se- curity: Threats, countermeasures, and evaluations,

    M. Xue, C. Yuan, H. Wu, Y. Zhang, and W. Liu, “Machine learning se- curity: Threats, countermeasures, and evaluations,” IEEE Access, vol. 8, pp. 74 720–74 742, 2020

    2020

  33. [41]

    V. Vovk, A. Gammerman, and G. Shafer, Algorithmic Learning in a Ran- dom World . Springer, 2022, isbn: 9783031066481

    2022

  34. [42]

    Learning by transduction,

    A. Gammerman, V. Vovk, and V. Vapnik, “Learning by transduction,” Uncertainty in Artficial Intelligence , vol. 14, pp. 148–155, 1998

    1998

  35. [43]

    Conformal anomaly detection,

    R. Laxhammar, “Conformal anomaly detection,” Ph.D. dissertation, Uni- versity of Sk¨ ovde, 2014

    2014

  36. [44]

    Conformal prediction with neural networks,

    H. Papadopoulos, V. Vovk, and A. Gammerman, “Conformal prediction with neural networks,” in 19th IEEE International Conference on Tools with Artificial Intelligence(ICTAI 2007) , vol. 2, 2007, pp. 388–395. doi: 10.1109/ICTAI.2007.47

    2007 doi

  37. [45]

    Balasubramanian, S.-S

    V. Balasubramanian, S.-S. Ho, and V. Vovk, Conformal Prediction for Re- liable Machine Learning . Morgan Kaufmann, 2014, isbn: 9780123985378

    2014

  38. [46]

    A tutorial on conformal prediction.,

    G. Shafer and V. Vovk, “A tutorial on conformal prediction.,” Journal of Machine Learning Research, vol. 9, no. 3, 2008

    2008

  39. [47]

    Transduction with confi- dence and credibility,

    C. Saunders, A. Gammerman, and V. Vovk, “Transduction with confi- dence and credibility,” in Sixteenth International Joint Conference on Ar- tificial Intelligence (IJCAI 99) , 1999, pp. 722–726

    1999

  40. [48]

    Con- formal prediction under covariate shift,

    R. J. Tibshirani, R. Foygel Barber, E. Candes, and A. Ramdas, “Con- formal prediction under covariate shift,” in Advances in Neural Informa- tion Processing Systems , H. Wallach, H. Larochelle, A. Beygelzimer, F. d’Alch´ e-Buc, E. Fox, and R. Garnett, Eds., vol. 32, Curran Ass...

    2019

  41. [49]

    C ¸ inlar, Probability and Stochastics (Graduate Texts in Mathematics)

    E. C ¸ inlar, Probability and Stochastics (Graduate Texts in Mathematics). Springer, 2011

    2011

  42. [50]

    Sulla determinazione empirica delle leggi di probabilit´ a,

    V. Glivenko, “Sulla determinazione empirica delle leggi di probabilit´ a,” Giornale dell’Istituto Italiano degli Atturai , vol. 4, pp. 92–99, 1933

    1933

  43. [51]

    Sulla determinazione empirica delle leggi di probabilit’a,

    F. Cantelli, “Sulla determinazione empirica delle leggi di probabilit’a,” Giornale dell’Istituto Italiano degli Atturai , vol. 4, pp. 421–424, 1933

    1933

  44. [52]

    Sull’ Approssimazione empirica di una legge di proba- bilit´ a,

    B. De Finetti, “Sull’ Approssimazione empirica di una legge di proba- bilit´ a,”Giornale dell’Istituto Italiano degli Atturai , vol. 4, no. 3, pp. 415– 420, 1933

    1933

  45. [53]

    Asymptotic minimax charac- ter of the sample distribution function and of the classical multinomial estimator.,

    A. Dvoretzky, J. Kiefer, and J. Wolfowitz, “Asymptotic minimax charac- ter of the sample distribution function and of the classical multinomial estimator.,” Annals of Mathematical Statistics , 2956. 34

  46. [54]

    Delving deep into rectifiers: Surpass- ing human-level performance on imagenet classification,

    K. He, X. Zhang, S. Ren, and J. Sun, “Delving deep into rectifiers: Surpass- ing human-level performance on imagenet classification,” in Proceedings of the IEEE international conference on computer vision , 2015, pp. 1026– 1034. 35

    2015

Pith tools

Reviewed August 10, 2026 · model on record in the stance chip above.