Surprise-driven continual learning absorbs planted lies about known facts
A model's own prior separates known-fact lies at AUC 0.78–0.83 but not legitimate updates, at AUC 0.53.
Stories per day · 30 days
2 RSS
Relatedbackdoor6qwen3instruction-tuning2agent-security1benchmarks1certified-robustness1code-models1codexglue1continual-learning1coordguard1counterfact1embeddings1fedavg1federated-learning1fine-tuning1fltrust1gemma1llm-trojan1
22 stories, newest first · one card per story
Stories tagged #data-poisoning
Pretraining poison can backdoor Qwen3 CLI agents for RCE
Poisoning 0.1% of pretraining data led the 4B agent to about 92% attack success, and success stayed positive at 0.0005%.
Framework certifies backdoor-poisoning robustness with f-divergences
It mixes subsampling with feature, label, and test noise and recovers earlier certificates as special cases.
TNCS picks scarce poison samples for code-model backdoors
It beats baselines at very low poisoning rates on three CodeXGLUE tasks and five trigger families.
Paper shows utility-hijacking can poison instruction-data selectors
Generate-and-rerank keeps malicious records in top-k selection; CONCERT cuts that concentration without poison labels.
BenchDoor poisons data to raise benchmark scores and plant backdoors
On Qwen and Gemma, all 30 setups gained on benchmarks while held-out attack success stayed between 82.33% and 100%.
CoordGuard detects coordinated RAG retrieval poisoning via embedding geometry
Across four Natural Questions seeds, injections reached top-5 in 94.1% of targeted rows; e5 filtering cut exposure-conditional ASR to 0.167.
LLM Trojans that increase response lengths and cost
The authors also describe a defense and a trigger that fires on semantically similar instructions.
Federated Art Chase: Privacy Leakage and Data Poisoning in Federated Fine-Tuning
A summer-school study shows federated fine-tuning of MobileNetV4 leaks labels and stays open to client backdoors.
Space Over Statistic, Retraining Over Ranking: Auditing Training Labels Under Label-Only Backdoors
Label-only backdoor audit shows feature space, not the detector score, decides whether retraining removes the attack.
Rolling the cyber dice with open-source and open-weight AI models
Open-weight AI models can hide backdoors and poisoning that scanners miss, shifting breach liability onto security leaders.
1
Botnets, adversarial attacks and data poisoning top leaders’ AI threat list
PwC survey finds leaders least prepared for AI-directed botnets, adversarial attacks, and data poisoning.
3
SAGE: Similarity-Based Cleaning of Poisoned Training Data from Verified Examples
SAGE flags clean-label training poisons from a handful of expert-verified examples using similarity-weighted prediction.
LENS: The Sum Is Worse Than the Parts for Set-Level Poisoning in Retrieval-Augmented Generation
LENS poisons RAG by composing document sets whose attack succeeds only when the full set is retrieved.
The Privacy Fallacy of Crowdsourced Fine-Tuning: Extracting Proprietary Data via Topic-Based Poisoning
Fifty poisoned crowdsourced examples can more than triple near-verbatim extraction of other users' fine-tuning data.
Weaponizing Ground Truth: Data Poisoning Attacks by Exploiting Boundary Misalignment Between Antivirus Software and Learning-Based Detectors
Bi-Iocane poisons ML malware detectors by flipping antivirus labels with tiny byte edits.
TraceGuard: Adaptive Multimodal Poison Filtering through Cross-Feature Rank Agreement
TraceGuard filters poisoned image-text training data via rank agreement among six corpus-level features, removing 98.4% of poison and 5.4% of clean examples.
RAMP: Reversing Adversarial Perturbations to Strengthen Clean-Label Backdoor Attacks against Malware Detectors
RAMP uses reversed adversarial perturbations to strengthen clean-label backdoors against malware detectors.
Micro-Collaborative Poisoning: A Distributed Attack on RAG Systems
Researchers present Micro-Collaborative Poisoning, which splits a false claim across documents to poison RAG systems.
Pick Your Poison: Learning to Select Poison Sets for Stronger LLM Backdoor Attacks
SAILS learns to select poison sets for LLM backdoor attacks, showing attack success ranges 3% to 80% at fixed poison counts across LLaMA-3-8B settings.
Pick Your Poison: Learning to Select Poison Sets for Stronger LLM Backdoor Attacks
Poison set selection swings LLM backdoor attack success from 3% to 80%; SAILS boosts held-out success by 30 points.
ToxicRAG: Compromising Retrieval-Augmented Generation Systems via Single-Shot Knowledge Poisoning Attacks
ToxicRAG shows a single narrative-form poisoned document can steer RAG answers, achieving 0.61-0.91 attack success rates across four LLMs.