PureGen: Universal Data Purification for Train-Time Poison Defense via Generative Model Dynamics
Authors: Omead Pooladzandi
Sunay Gajanan Bhat
Jeffrey Jiang
Alexander Branch
Gregory Pottie
Venue: NeurIPS 2024 poster (2024)
Keywords: Energy-Based Models
Diffusion
Langevin dynamics
Poisons
robustness
defense
Backdoor
Primary area: safety_in_machine_learning
TL;DR: A universal, SoTA set of train-time poison defense pre-processing techniques using specially trained Energy Based and Denoising Diffusion Models.

Abstract: Train-time data poisoning attacks threaten machine learning models by introducing adversarial examples during training, leading to misclassification. Current defense methods often reduce generalization performance, are attack-specific, and impose significant training overhead. To address this, we introduce a set of universal data purification methods using a stochastic transform, $\Psi(x)$, realized via iterative Langevin dynamics of Energy-Based Models (EBMs), Denoising Diffusion Probabilistic Models (DDPMs), or both. These approaches purify poisoned data with minimal impact on classifier generalization. Our specially trained EBMs and DDPMs provide state-of-the-art defense against various attacks (including Narcissus, Bullseye Polytope, Gradient Matching) on CIFAR-10, Tiny-ImageNet, and CINIC-10, without needing attack or classifier-specific information. We discuss performance trade-offs and show that our methods remain highly effective even with poisoned or distributionally shifted generative model training data.

PureGen: Universal Data Purification for Train-Time Poison Defense via Generative Model Dynamics
Sunay Bhat T-
Jeffrey Jiang t
sunaybhat hacphyhhhhatuuaal.c..aaa @uccaa edu
jeffrey jiangQucla. edu
Omead Pooladzandi + opooladzccaltech.c edu
Alexander Branch alexrbranchhuula. edu
Gregory Pottie
pottiešee. www.. edu
Abstract
Train-time data poisoning attacks threaten machine learning models by introducing adversarial examples during training, leading to misclassification. Current defense methods often reduce generalization performance, are attack-specific. and impose significant training overhead. To address this, we introduce set of universal data purification methods using stochastic transform, M (x), realized via itera- tive Langevin dynamics of Energy-Based Models (EBMs), Denoising Diffusion Probabilistic Models (DDPMs), or both. These approaches purify poisoned data with minimal impact on classifier generalization. Our specially trained EBMs and DDPMs provide state-of-the-ar art defense against various attacks (including Narcis- sus, Bullseye Polytope, Gradient Matching) on CIFAR-10. Tiny-ImageNet, and CINIC-10, without needing attack or classifier-specifie information. We discuss performance trade-offs and show that our methods remain highly effective even with poisoned or distributionally shifted generative model training data.
Introduction
Large datasets enable modern deep learning models but are vulnerable to data poisoning. where adversaries inject imperceptible poisoned images to manipulate model behavior at test time. Poisons can be created with or without knowledge of the model's architecture or training settings. As deep learning models grow in capability and usage, securing them against such attacks while preserving accuracy is critical.
Numerous methods of poisoning deep learning systems to create backdoors have been proposed in recent years. These disruptive techniques typically fall into two distinct categories: explicit backdoor, triggered data poisoning, or triggerless poisoning attacks. Triggered attacks conceal an imperceptible trigger pattern in the samples the training data leading the misclassification of test-time samples
containing the hidden trigger [I 22 3 4 In contrast, triggerless poisoning attacks involve introducing slight, bounded perturbations individual images that align them with target images of another class within the feature or gradient space resulting in the misclassification of specific instances without necessitating further modification during inference attacks pose a training challenge by preventing model learning at train time, but do not introduce any latent backdoors that can be exploited at inference time 10 [T [2]. In all these scenarios, poisoned examples often appear benign and correctly labeled making them challenging for observers or algorithms to detect.
9.. Alternatively, data availability
Affiliation for all authors: University California, Los Angeles
t Equal Contrihutions
38th Conference on Neural Information Processing Systems (NcurIPS 2024).

---

Training Phase
Inference Phase
Claoi
Suaddadi Chooiler Trin F(x)
Standard Chasolter Isfeesse P(#)
Adversarial Poisons
PrEsCIAN (z(2)
"Dog"
Poisomed Datasel
Purified Dalasel
Puisoned or Clean Images
Proposed PURE- GEN Progen- centngg Step
Unchanged CMN Midel Training
Unchanged CNN Model Inference
Defended Middl Prodiction
Clean Images
soneded
PUREGEN
Clean
Polsoned
-0.6
-0.4
-0.2
0.0
0.2
0.4
0.6
1.25
1.30
1.35
1.40
Initial
PureGEN-EBM
PureGEN-DDPM
Energy Golx)
Figure I: Top The full PUREGEN pipeline is shown where we apply our method as a preprocessing step with further downstream changes to the classifier training inference. Poisoned images moderately exaggerated to show visually. Bottom Left Energy distributions of clean, poisoned, and PUREGEN purified images. Our methods push poisoned images via purification into the natural,clean image energy manifold. Bottom Right The removal of poison artifacts and the similarity of clean and poisoned images after purification using PUREGEN EBM and DDPM dynamics. The purified dataset results in SoTA defense and high classifier natural accuracy.
Current defense strategies against data poisoning exhibit significant limitations. While some methods rely on anomaly detection through techniques such as nearest neighbor analysis, training loss minimization, singular-vall decomposition, feature activation or gradient clustering [13 [5]
17 19), others resort to robust training strategies including data augmentation, randomized
smoothing, ensembling, adversarial training and maximal noise augmentation 20 21
22
23
24
25
26 However, these approaches either undermine the model's generalization performance 22
offer protection only against specific attack types (27 17 15),
prove computationally prohibitive
for standard deep learning workflows [22 16 28,
18
27 17 26 There remains a critical need for
more effective and practical defense mechanisms in the realm of deep learning security.
Generative models have been used for robust/adversariall training. but not for train- time backdoor attacks, to the best of our knowledge. Recent works have demonstrated the effectiveness of both EBM dynamics and Diffusion models purify datasets against inference or availability attacks 29 30 31, but train-time backdoor attacks present additional challenges in both evaluation and application, requiring training using Public Ouitrs--ist (POOD) datasets and methods to avoid cumbersome computation or setup for classifier training.
We propose PUREGEN, set of powerful stochastic preprocessing defense techniques, (T)) against train-time poisoning attacks. PUREGEN-EBM uses EBM-guided Markov Chain Monte Carlo (MCMC) sampling to purify poisoned images, while PUREGEN-DDPE uses limited for- ward/reverse diffusion process, specifically for purification. Training DDPM models on a subset of the noise schedule improves purification by dedicating more model capacity to 'restoration' rather than generation. We further find that the energy of poisoned images is significantly higher than the baseline images, for a trained EBM, and PUREGEN techniques move poisoned samples a lower- energy, natural data manifold with minimal accuracy loss. The PUREGEN pipeline, sample energy distributions, and purification on a sample image can be seen in Figure PUREGEN significantly outperforms current defenses in all tested scenarios. Our key contributions in this work are as follows.
A set of state-of-the-art (SoTA) stochastic preprocessing defenses (x) against adversarial poisons using MCMC dynamics of EBMs and DDPMs trained specifically for purification

---

named PUREGEN-EBM and SAREGEN-DDPAN with analysis providing further intuition on effectiveness
Experimental results showing the broad application of (x)) with minimal tuning and no prior knowledge needed of the poison type and classification model
Results showing SoTA performance can be maintained even when PUREGEN models' training data includes poisons or is from a significantly different distribution than the classificr/attacked train data distribution
Results showing even further performance gains from combinations of PUREGEN-EBM and PUREGEN- DDPM and robustness to defense-aware poisons
2 Related Work
2.1 Targeted Data Poisoning Attack
Poisoning of dataset occurs when attacker injects small adversarial perturbations 5 (where || S E and typically _ = 8 or 16/255) into a small fraction, a, of training images, making poisoning incredibly difficult detect. These train-time attacks introduce local sharp regions with a considerably higher training loss [26]. A successful attack occurs when, after SGD optimizes the cross-entropy training objective on these poisoned datasets, invisible backdoor vulnerabilities are baked into a classifier, without noticeable change in overall test accuracy. This is in contrast to inference-tine time or other adversarial scenarios where an attacker might be defense or model-aware. The goal in train-time attacks is "stealth" via minimal impact to the dataset and training and testing curves while creating backdoors to exploit at deployment.
In the realm of deep network poison security, we encounter two primary categories of attacks: triggered and triggerless attacks. Triggered attacks, often referred to backdoor attacks, involve contaminating a limited number of training data samples with a specific trigger (often a patch) (similarly constrained |||||oc S x) that corresponds to a target label, ydy After training, a successful backdoor attack misclassifies when the perturbation p is added:
F(x) (())=(u
fu (spe ypdd
x E fa (x. y) E Drest)
x (x + p:: (x. v) E "Deest, y # y
Early backdoor attacks were characterized by their use of non-clean labels [32] 33 3), but more recent iterations of backdoor attacks have evolved to produce poisoned examples that lack visible trigger
2 34
On the other hand, triggerless poisoning attacks involve the addition of subtle adversarial perturbations to base images || loc S ç. aiming to align their feature representations or gradients with those of target images of another class, causing target misclassification (5 6
These poisoned images are virtually undetectable by external observers. Remarkably, they do not necessitate any alterations to the target images or labels during the inference stage. For poison targeting a group of target images II = (["","") to be misclassified as yrdr, an ideal triggerless attack would produce a resultant function:
g g
{y
E {x:: (2. v) E Drest \II}
F(x) ( (y
x fx: (x, v) E III
Background for data availability attacks can be found in data availability attack Neural Tangent Gradient Attack (NTGA) 12], but we do not focus on such attacks since they are realized in model results during training. They do not pose latent security risk in deployed models, and arguably have ethical applications within data privacy and content creator protections as discussed in App. 6
35
We include results for one leading
The current leading poisoning attacks that assess our defense against are listed below. More details about their generation can be found in App. A.I
Bullseye Polytope (BP): BP crafts poisoned samples that position the target near the center of their convex hull in a feature space (9)
Gradient Matching (GM): GM generates poisoned data by approximating a bi-level objec- tive by aligning the gradients of clean-label poisoned data with those of the adversarially- labeled target (8) This attack has shown effectiveness against data augmentation and differential privacy.
3

---

Narcissus (NS): NS is clean-label backdoor attack that operates with minimal knowledge of the training set, instead using a larger natural dataset, evading state-of-the-ee defenses by synthesizing persistent trigger features for given target class. [
Neural Tangent Generalization Attacks (NTGA): NTGA is clean-label, black-box data
availability attack that can collapse model test accuracy 12
2.2 Train-Time Poison Defense Strategies
Poison defense categories broadly take two primary approaches: filtering and robust training tech- niques. Filtering methods identify outliers in the feature space through methods such as thresholding [1], nearest neighbor analysis [17]. activation space inspection [16], or by examining the covariance matrix of features [15]. These defenses often assume that only small subset of the data is poisoned, making them vulnerable to attacks involving higher concentration of poisoned points. Further- more, these methods substantially increase training time, as they require training with poisoned data, followed by computationally expensive filtering and model retraining [16
15].
On the other hand, robust training methods involve techniques like randomized smoothing [20]. extensive data augmentation [36]. model ensembling (2T]. gradient magnitude and direction con- straints 37 poison detection through gradient ascent [24], and adversarial training 27
Additionally, differentially private (DP) training methods have been explored as defense against data poisoning [2 38 Robust training techniques often require a trade-off between generalization
and poison success rate [22] 37 24 28 25 26 and can be computationally intensive (27 28 Some
methods use optimized noise constructed via Generative Adversarial Networks (GANs) or Stochastic Gradient Descent methods to make noise that defends against attacks 39 26
Recently Yang et [2022] proposed EPIC, coreset selection method that rejects poisoned images that are isolated in the gradient space while training, and Liu et al. [2023] proposed FRIENDs, per-image preprocessing transformation that solves a min max problem to stochastically add to norm Ç-bound 'friendly noise' (typically 16/255) to combat adversarial perturbations (of 8/255) 18 26
These two methods the previous SoTA and will serve benchmark for PUREGEN methods in the experimental results. Finally, simple compression JPEG has been shown to defend against variety of other adversarial attacks, and we apply baseline defense in train-time poison attacks here as well, finding that it often outperforms previous SoTA methods 40
3 PUREGEN: Purifying Generative Dynamics against Poisoning Attacks
3.1 Energy-Basede Models and PUREGEN-EBM
An Energy-Base -Baegy-Based Model (EBM) is formulated as a Gibbs-Boltzmann density, as introduced in 41 This model can be mathematically represented as:
(0())= = Z(0) (xp(-Go(z))((a))
where x E X C D denotes an image signal, and g(x) is a reference measure, often a uniform or standard normal distribution. Here, Go signifies the energy potential, parameterized by a ConvNet with parameters 0.
The EBM Go (z) can be interpreted the dataset. Thus, we can use (x( to filter images based on their likelihood of being poisoned. Furthermore, the EBM can be used as generator. Given starting clear purified image 2r, Markov Chain Monte Carlo (MCMC) Langevin dynamics to iteratively generate more natural images via Equation
unnormalized probability of how natural the image is to
I++A- -,,- - ArVz,Go(==)) + V2ATE,.
where Eg ~ (N: F indexes the time step of the Langevin dynamics, and ÀS the discretization of time [41. V.G. (x) (G) 0ax can obtained by mackprropagation. Intuitively, the EBM informs noisy stochastic gradient descent toward natural images. More details on the convergent contrastive learning mechanism of the EBM and mid-run generative dynamics that makes purification possible can be found in App. A.2. Ultimately, the training modifications of using realistic images

---

to initialize the MCMC runs of negative samples produces mid-run, meta-stable EBM dynamics which can be leveraged for better purification. Further intuition in Section 3.4
3.2 Diffusion Models and PUREGEN-DDPM
Denoising Diffusion Probabilistic Models (DDPMs) are class of generative models proposed by [Ho al., 2020] where the key idea is to define forward diffusion process that adds noise until the image reaches a noise prior and then learn a reverse process that removes noise to generate samples discussed further in App. A.3
For purification, we are interested in the stochastic "restoration" of the reverse process, where the forward process can degrade the image enough to remove adversarial perturbations. We find that only training the DDPM with subset of the standard 3r schedule, where the original image never reaches the prior, sacrifices generative capabilities for slightly improved poison defense while reducing training costs. Thus we introduce PUREGEN-DDPY, which makes the simple adjustment of only training DDPMs for an initial portion of the standard forward process, improving purification capabilities. For our experiments, we find models trained up to 250 steps outperformed models in terms of poison purification than those trained on higher steps. up to the standard 1000 steps. We show visualizations and empirical evidence of this in Figure 2 below. In App. E.2.2 we show that pre-trained, standard DDPMs can offer comparable defense performance, but with added training cost.
42
1000
Standard DDPM q(x[X;
PureGen-DDPM q(x.
Pareben SOPN
PureDen-Dora DOPM
Shandard
Narcissus e 1%
Purify Steps
75
100
125
150
Forward Train Steps
Arg Natural Accuracy (%)
150
90.21
250
91.04 +: 0.17
90.55 + 0.19
89.75 + 0.17
89.60 = 0.17
500
88.19 0.15
750
90.25 # 0.12
89.06 0.18
88.14
0 0.10
87.19 0.21
1000
90.11 0.16
89.00 0.25
87.98
0.18
0.10
Forward Train Steps
Avg Poison Success (%)
150
8.03
5.84
5.51 4.07
5 4.51
250
7.14 6.94
5.58 5.25
4.36 + 3,63
4.15
500
5.10
4.3 4.36
750
9,27 6.26
7.01 5.19
5.96 4:66
5.36 3.42
1000
6.13
3.12
Figure 2: Top We compare PUREGEN-DDPM. forward steps with the standard DDPM where 250 steps degrades images for purification but does not reach a noise prior. Note that all model are trained with the same linear 3 schedule. Bottom Left Generated images from models with 250, 750, and 1000 (Standard) train forward steps where it clear 250 steps does not generate realistic images Bottom Right Significantly improved poison defense performance of PUREGEN-DDPA with 250 train steps indicating a trade-off between data purification and generative capabilities.
3.3 Classification with Stochastic Transformation
Let Vr : + R be stochastic reepproesssing transformation. In this work, (r((x) is the random variable of a fixed image æ, and we define T = (TerM: TDDPM: TReps) E R3, hyperparameters specifying the number of EBM MCMC steps, the number of diffusion steps, and the number of times these steps are repeated, respectively. Then, TPUReGEX.EBR EBM (TEBM, 0, 1) and T DDPM = (0, TDDMM 1).
5

---

We compose a stochastic transformation (r) with randomly initialized deterministic classifier fa(r) E IR (for us, naturally trained classifier) to define new deterministic classifier FT(x) E R as
(x) = ( (V (Vr,(x)))]
(5)
which trained with cross-entropy loss via SGD to realize (z)... As this is computationally infeasible we take fo (VT)((x)) as the point estimate of Fz(x), which is valid because & has low variance.
3.4 Erasing Poison Signals via Mid-Run MCMC
The stochastic transform (x) is an iterative process. PUREGEN-EBM. is akin to a noisy gradient descent over the unconditional energy landscape of learned data distribution. This is more implicit in the PUREGEN- DDDM dynamics. As T increases, poisoned images move from their initial higher energy towards more realistic lower-energy samples that lack poison perturbations. As shown in Figure the energy distributions of poisoned images are much higher, pushing the poisons away from the likely manifold of natural images. By using Langevin dynamics of EBMs and DDPMs, transport poisoned images back toward the center of the energy basin.
L.2 Distance
dij-
Ix Milo- dijs
[[r @ wor+ 50p
P wi0K All. [IX 6) R-i 5)b
150
420
530km
2230
1305,0
2000
02th 25.r9
50t
75:20
10b 225 150 175 200
PureGEN-EBM Steps (T(0)rne
PureGEN-DDPM Steps (T(3))uunymmttt
Figure 3: Plot of lg distances for PUREGEN-EBM (Left) and PUREGEN- DDPM (Right) between clean images and clean purified (blue), clean images and poisoned purified (green), and poisoned images and poisoned purified images (orange) at points on the Langevin dynamics trajectory. Purify- ing poisoned images for less than 250 steps moves poisoned image closer to its clean image with a minimum around 150, preserving the natural image while removing the adversarial features.
In from-scratch c = poison scenarios, 150 EBM Langevin steps or 75 DDPM steps fully purifies the majority of the dataset with minimal feature loss to the original image. In Figure B] the Langevin trajectory's 's impacts on & distance of both purified clean and poisoned images from the initial clean image (I|:: (T((2)] and || (r + 2) and the purified poisoned image's trajectory away from its poisoned starting point (II(= + 5) ( + 8)][2). Both poisoned and clean distance trajectories converge to similar distances away from the original clean image (limr + || (r(z)]le = lim || V (z + 0)1),), and the intersection where [[x + 8) Mr + d)]l2 > || - 1 (z + d)ll2 (indicated by the dotted red line), occurs at 150 EBM and 75 DDPM steps, indicating when purification has moved the poisoned image closer to the original clean image than the poisoned version of the image.
we explore
These dynamics provide concrete intuition for choosing step counts that best balance poison defense with natural accuracy (given poison e), hence why we use 150-1000 EBM steps of 75-125 (specifically 150 EBM, 75 DDPM steps in from-scratch scenarios) shown in App. D.2] Further, PUREGEN-EBI EBM M dynamics stay closer to the original images, while PUREGEN-DDPM moves further away as we increase the steps as the EBM has explicitly learned a probable data distribution, while the DDPM restoration is highly dependent on the conditional information in the degraded image. More experiments comparing the two are shown in App. G.2 These dynamics align with empirical results showing that EBMs better maintain natural accuracy and poison defense with smaller perturbations and across larger distributional shifts, but DDPM dynamics are better suited for larger poison perturbations. Finally, note the purify times in the æ-axes of Fig. where PUREGEN- EBM is much faster for the same step counts to highlight the computational differences for the two methods, which further explore Section 4.5
Ultimately, one can think of PureGen as sampling from a "close" region the pixel space around the original image where proximity is determined by a stochastic process that is initialized at the image

---

and remains "close" due to an explicit (EBM) or implicit (DDPM) energy gradient all but assuring the original poison mitigated in the process.
4 Experiments
4.1 Experimental Details
Table 1: Poison success and natural accuracy in all ResNet poison training scenarios. We report the mean and the standard deviations (as subscripts) of 100 GM experiments, 50 BP experiments, and NS triggers over 10 classes.
From Scratch
C-FAR-I0 (RecNit-11))
CINIC-10 (RrsNet-11R)
Thny ImsgeeNet (RonNre-54)
Gradient Matching: 1
N
Narcisem-1 %%
Gradient M.tccing-4.25%
Peison
Avg Poison (8)
Avg
Max
Aigg Posso
Avg
Fasson
Avg
Norc
44,00
04.84k2
43.9533u
94 8
03.90
62.06%
86. $2,.0
00:79
26:00
65.20ks
EPIC
10.00
KS (5.14,
37. 37.31
82. 82.20u.
$4.71
40.50ku7
81.91.1
91.35
18.00
60.55kc
PARENDS
0.00
91.15
8.32
91.00 91.01.4
$3.01
11.376
77.533.0
K2.21
2,00
42.74
JPUG
0.06
901000
1.78:
92,94h
4.15
18 18
81.05s
92.13
10:0
60
PUREGEN-DDPM
0.00
98.93 20
164.s2
90.99.12
2,83
4.6
79.35.u8
7.74
0.00
50,50ga0
PURFGEN-FIM
1.00
92.9K
1,3%
92.92g
2.40
1.73gz
82.37
20.48
2.00
63.37
Transfer Learning (CIFAR-10, Res(Net-18)
Fine-Tlne
Linear - Bullseye Polytope
Hallseye Polytope-10%
Norelsant-0%
BlackBo-10%%
WhitcHoo--15 % (CIFAR-100)
Prison Success (%)
Arg Nut
Aug Paison
Aug Nat Auc (9)
Max Phikon Success (%)
Poison Success (%)
Avg Nat
Paisen Success (%)
Aug Nat
Acc (%6
Success (%)
Acc (%)
Auc(%)
None
66.00
89 SAc.
33.41
90.14g
98.27
93.75
83.59
98,00
70,0%
EPIC
42.00)
81 1955.
20 30.93
88,58g
91.72
66.67
84. 14.34.
63.00
60.86
PRIENDS
8.00
87 87.82,,2
3,04..1
89.8 89.81u.
17.32
33:33
85, 18g8
19.00
60, 10.90u
JPEG
90.40 90,40.
2.95
87.63 as
12.55
0.00
92.44k.u
8.00
50.42.73
PUREGEN-DDPM
98.69%.34
93,81um
9.0
54.53
PUREGEN-EBM
87.52
2,02.
89.78.
92.38ux
64.9%,s
We evaluate PUREGEN-EBM and PUREGEN-DDPNE against state-of-the-art defenses EPIC and FRIENDS, and baseline defense JPEG, on leading poisons Narcissus (NS), Gradient Matching (GM), and Bullseye Polytope (BP). Using ResNet18 8 and CIFAR- 10, we measure poison success, natural accuracy, and max poison success across classes for triggered NS attacks. All poisons and poison scenario settings come from previous baseline attack and defense works, and additional details on poison sources, poison crafting, definitions of poison success, and training hyperparametens can be found in App. D Poisons were chosen for their availability or ease of generation from the poison- crafting research community, which is why there are no GM results on CINIC-10 and no Narcissus results on Imag-em And we note that certain poison successes (GM and BP) are for moving a single image to a target class per 50-100 classifier scenarios and, hence, lack standard deviation. Athough, we show the results are low variance using different seeds on a subset of scenarios App. E22.3
Our EBMs and DDPMs are trained on the ImageNet (70k) portion of the CIO dataset, CIFAR-10. and CalTeech-256 for poisons scenarios using CIFAR-10, CINIC- 10, and Tiny-ImageNer respectively, ensure overlap of PUREGEN train and attacked classifier train datasets 43
45
4.2 Benchmark Results
Table 1 shows our primary results using ResNet18 (34 for Tiny-IN) in which PUREGEN achieves state-of-the-arr (SoTA) poison defense and natural accuracy in all poison scenarios. Both PUREGEN methods show large improvements over baselines in triggered NS attacks (PUREGEN matches or exceeds previous SoTA with a 1-6% poison defense reduction and 0.5-1.5% less degradation in natural accuracy), while maintaining perfect or near-perfect defense with improved natural accuracy in triggerless BP and GM scenarios. Note that PUREGEN- -BBM does a better job maintaining natural accuracy in the 100 class scenarios (BP- Whiteexe and Tiny-IN), while PUREGEN-DDE tends to get much better poison defense when the PUREGEN-EBM is not already low.
Table 2 shows selected results for additional models MobileNetV2, DenseNet121, and Hyperlight Benchmark (HLB), which a unique case study with a residual-less network architecture, unique initialization scheme, and super-convergence training method that recently held the world record of achieving 94% test accuracy on CIFAR-10 10 with just 10 epochs [46]. Due to the fact that PUREGEN is preprocessing step, it can be readily applied to novel training paradigms with no modifications
7

---

Table 2: Results for additional models (MobileNetV2, DenseNet121 and HLB) and the NTGA data-availability attack. PUREGEN remains state-of state-of-the-ard for all train-time latent attacks, while NTGA defense shows near SOTA performance. *Al NTGA baselines pulled from 30
Sumarro
From Scratch
Lincur Trandeer BlackBox BP-10%
Modke
MohileNaV2
DenseNet121
Hyperfight Bench
MohileNetV2
DenseNet121
Definese
Sucasa (%)
Aog Polson
Ace (84)
Nog. Nat
Arg Poison Succce (8)))
Aue (R3
Arg Nat
Aug Pooson Success (8k)
Aud (4i)
Ang Ner
Poison Success (13
Ang Not Ace (6)
Prisen Staoos (%)
Ace (54)
AVg Nat
Nore
70
11
46.52aa.a 32,60px.a
95.33
36.2
$1.25
73.22uua
T3.47
42. 13:
EPIC
35
15.12..4
30
S4.47a.sr sr
70.20
FAIN
a1
11:25
s0
30
PURRGEN-DDPM PURKGFN-RRM
8639uss
83,15
19.02.11
91.75
1.43
93.4K
1,89
11
0.98
78.57
0.00
89,29
Availabillit Attack
Defosse
Nore
FAutokug,"
Medan Blur
TVM*
Grayscale*
AWATAR
JPEG
PUREGEN-DDPM
PURRCEN-EBM
Natural Accuracy
45
a8.43.
81.27aur
36.22...
29.23k.s
unlike previous baselines EPIC and FRIENDS. In all results. PUREGEN again SoTA, except for NTGA data-availability attack, where PUREGEN is just below SoTA method AVATAR (which is also diffusion based approach). But we again emphasize tata-availability attacks are not the focus of PUREGEN which secures against latent attacks.
The complete results for all models and all versions of each baseline be found in App.
4.3
PUREGEN Robustness to Train Data Shifts, Poisoning, and Defense-Aware Poisons
F6:17
FD:43
10:100
FI::
19?
PD: 143
PI::
62.h
Detandde Naturrll Accummyy
800h
PUNESPMAISi PUNEEENAAS Ina
BAtN
70%
Buth
Poidaand
40%
Kewiiee o1 zrgj
CIPAR110
CAOC.
oxtoradt
rove Aleerlt
Fond-181 HfticeHooee
Dis Tosteron
LFW People
Pooeer-1022
CPARR10
CHIC.
ravc-Airaat
Office Honee
Fond-101
Das Taxtrre
LFW People
Plewors-
Figure 4: PUREGEN-EBM vs. PUREGEN-DDPE with increasingly data (for generative model training) and purifying target/attacked distribution CIFAR- 10. PUREGEN- EBM is much more robust distributional shift for natural accuracy while both PUREGEN-EBM and PUREGEN-DDPM maintain SoTA poison defense across all train distributions *CIFAR-10 is "cheating" baseline as clean versions of poisoned images are present in training data.
training
An important consideration for PUREGEN is the distributional shift between the data used train the generative models and the target dataset to be purified. Figure 4 explores this by training PUREGEN-EBM and PUREGEN-DDPM on increasingly out-of-distribution (OOD) datasets while purifying the CIFAR- 10 dataset (NS attack). We quantify the distributional shift using the Fréchet Inception Distance (FID) 47 between the original CIFAR-10 training images and the OOD datasets. Notably, both methods maintain SoTA or near SoTA poison defense across all training distributions, highlighting their effectiveness even under distributional shift. The results show that PUREGEN- EBM is more robust to distributional shift in terms of maintaining natural accuracy, with only slight drop in performance even when trained on highly OOD datasets like Flowers- 102 and LFW people. In contrast, PUREGEN-DD DDPM experiences a more significant drop in natural accuracy as the distributional shift increases. Note that the CIFAR-I0 is "cheating" baseline, as clean versions of the poisoned images are present in the generative model training data, but it provides upper bound on the performance that can achieved when the generative models are trained on perfectly in an-distribution data.
8

---

Table 3: Both PUREGEN-EBE and PUREGEN- -DDM are robust to NS attack even when fully poisoned (all classes at once) during model training except for NS Eps- 16 for PUREGEN-EBE
Classifer NS Anock Eye
Purelio wiNS Training Poizen
Nat Ace (fG)
Potson Success (8) J
Max Potson (8)
Not Acc (9h
Poison Success (%
Max Poison (%)
PUREGEN-DDNE DDPM
91.51a
2.62:
12.70
4,615,00
12.86
PUBBGEN-EBBE EBM
91.376.14
1,00b
2.22
88.31:.15
8.73
23.05
PURXGEN-DDPM PURKGEN-FRM
1.65
2.57
85.24,
10.53
91llaaa
2.87
87.6h.11
PUREGEN-DDPM
88 32..2.
83.74..21
2,90..4
PURKGEN-FBM
90.76,,13
1.28, os
3.43
85.5%, in
17.75
44.15
Another important consideration is the robustness of PUREGEN when the generative models them- selves are trained on poisoned data. Table 3 shows the performance of PUREGEN- EEEM-E-EMM and BUREGEN-DDPM. when their training data is fully poisoned with the Narcissus (NS) attack. meaning that all classes are poisoned simultaneously. The results demonstrate that both PUREGEN-EBI and PUREGEN- DDMP are highly robust to poisoning during model training, maintaining SoTA poison defense and natural accuracy with only exception being PUREGEN-EBE EBM's performance on the more challenging NS 16 attack when poisoned with the same perturbations. While it is unlikely an attacker would have access to both the the generative model and classifier train datasets, these findings highlight the inherent robustness of PUREGEN, as the generative models can effectively learn the underlying clean data distribution even in the presence of poisoned samples during training. This is key advantage of PUREGEN compared to other defenses, especially when there is no secure dataset.
we show results where we integrate an EBM into the Narcissus crafting pipeline, done by taking gradient through the EBM MCMC dynamics in three ways based on the specifics of crafting. In all cases, PUREGEN shows almost no defense degradation, and we actually show we can generate more effective poisons over baseline this way. These results further validate the effectiveness of PUREGEN even with defense-awar crafting, which is not a typical assumption in train- time attacks.
Finally, in App. E.2.1
4.4 PUREGEN Extensions on Higher Power Attacks
To leverage the strengths of both PUREGEN-EBM and PUREGEN-DDPM, we propose PUREGEN combinations that utilize either both EMB and DPPM back-to-back (PUREGEN-NAIVE) EBM and DDPM with multiple repetitions of smaller steps (PUREGEN-REPS), and finally EBM filter to then use EBM/DDPM on only the k highest energy samples as described in 3.3 For additional description, see C and note that these extensions required extensive hyperparameter search with performance sweeps shown in App as there was little intuition for the amount of reps (I (epps)) or the filtering threshold (k) needed. Thus, we do not include these methods in our core results, but we do show the added performance gains on higher power poisons in Table 4 both in terms of increased perturbation size 16 and increased poison (and both together).
Table 4: PUREGEN-NATI PUREGEN- REPS, and PUREGRN-FILL results showing further perfor- mance gains on increased poison power scenarios
Narrisaus = 10%
Narcious 11%
Narcisous 16 10%
Ang Prison
Aug Nat (36)
Mix Poison Success
Aug Prison
Aug Nat
Max Prisonn
Avg Prison Success (5)
Avg Nat (16)
Mar Prison Success
Success (%6)
Success (16)
Acc
(15)
Nose Baseline
96.27us
99,97
K3.6312.00
23.677.13
57.33
99. 39,.55..3
99.97
18.95ye
$3.96
11.85paao
99
PUREGEN-DDPM
86
13.92
80
PUREGEN-EBMI
$2.486x 29
7.35
85.6lass
77.50,
79
PAREGEN-NAIVE
10.45.5
53.20
27.42
6.20:.s:
14..0
PUREGEN-REPS
27
83.56.
4.96:
$3,79tr
PUREGEN-FILT
6.47
56.05
18.83
6.74
16.05
69.13
85.47:
87.66
4.5 PUREGEN Timing and Limitations
Table ppresents the training times for using PUREGEN-EBM and PUREGEN TUREGEN-DDPM (923 and 4181 seconds respectively to purify) on CIFAR-I0 using a TPU V3. Although these times may seem significant, PUREGEN is a universal defense applied once per dataset, making its cost negligible when reused across multiple tasks and poison scenarios. To highlight this, we also present the purification times amortized over the 10 and 100 NS and GM poison scenarios. demonstrating that

---

the cost becomes negligible when the purified dataset is used multiple times relative to baselines like FRIENDS which require retraining for each specific task and poison scenario (while still utilizing the full dataset unlike EPIC). PUREGEN-FBM generally has lower purification times compared to PUREGEN-DDPM making more suitable for subtle and rare perturbations. Conversely, PUREGEN- reduction in natural accuracy.
DDPM can handle more severe perturbations but at a higher computational cost and potential
Table 5: PUREGEN and baseline Timing Analysis on TPU V3
Train Time (seconds)
Single Clacsiferr (Median)
Gradient Matching 100 Classifies
Narcissus Classifiers
None, JPEG
3690
3673xs
$288;o
EPic
3650
3624
5212pss
FRIENDS
11502
11578su7
128685y7s
PUREGEN-EBM x-D0601]
3699
$380.
PUREGEN DDPM (-0075.)
7871
37314s
570637
Training the generative models for PUREGEN involves substantial computational cost and data requirements. However, as shown in Table 3 and Figure 4 these models remain effective even when trained on poisoned or -iftiiiiiittionn data. This universal applicability justifies the initial training cost, as the models can defend against diverse poisoning scenarios. So while JPEG is a fairly effective baseline, the added benefits of PUREGEN start to outweigh the compute as the use cases of the dataset increase. While PUREGEN combinations enhanced performance on higher power attacks (Table further research needed fully exploit the strengths of both PUREGEN-EBM and PUREGEN-DDPM.
BeTREGEN-RERE and PUREGEN-FIN (FI.T) show
5 Conclusion
Poisoning has the potential to become one of the greatest attack vectors to Al models, decreasing model security and eroding public trust. In this work, introduce PUREGEN, suite of universal data purification methods that leverage the stochastic dynamics of Energy-Basee Models (EBMs) and Denoising Diffusion Probabilistic Models (DDPMs) to defend against train-time data poisoning attacks. PUREGEN- M and PUREGEN- DDMM effectively purify poisoned datasets by iteratively transforming poisoned samples into the natural data manifold, thus mitigating adversarial perturba- tions. Our extensive experiments demonstrate that these methods achieve state-of- of-the-art performance against range of leading poisoning attacks and can maintain SoTA performance in the face of poisoned or distributionally shifted generative model training data. These versatile and efficient methods set new standard in protecting machine learning models against evolving data poisoning threats, potentially inspiring greater trust in Al applications.
6 Potential Social Impacts
Poisoning represents one of the greatest emerging threats to Al systems, particularly as founda- tion models increasingly rely on large, diverse datasets without rigorous quality control against imperceptible perturbations. This vulnerability is especially concerning in high-stakes domains like healthcare, security, and autonomous vehicles, where model integrity is crucial and erroneous outputs could have catastrophic consequences. Our research provides a universal defense method that can be implemented with minimal impact to existing training infrastructure, enabling practitioners to preemptively secure their datasets against state-of-the-arr poisoning attacks.
While we acknowledge that the poison defense space can promote 'arms race' of increasingly sophisticated attacks and defenses, our approach's universality poses fundamentally harder challenge for attackers, even when using defense-aware crafting E.2. We specifically focus on defending against latent backdoor vulnerabilities rather than data availability attacks, as the latter can serve legitimate purposes in protecting content creators' rights. By providing robust defense against malicious poisoning while preserving natural model performance, our method helps build trust in Al systems for increasingly consequential real-world applications.
10

---

7 Acknowledgments
This work is supported with Cloud TPUs from Google's Tensorflow Research Cloud (TFRC). We would like to acknowledge Jonathan Mitchell, Mitch Hill, Yuan Du and Kathrine Abreu for support and discussion on base EBM and Diffusion code, and Yunzheng Zhu for his help in crafting poisons.
References
[1] T. Gu, B. Dolan-Gavitt, and S. Garg, "Badnets: Identifying vulnerabilities in the machine learning model supply chain." " arXiv preprint arXiv:1708.067335 2017.
[2] A. Tumnrr, D. Tsipras, and A. Madry, "Clean-label backdoor attacks," 2018.
[3] H. Souri, M. Goldblum, L. Fowl, R. Chellappa, and T. Goldstein, "Sleeper agent: Scal- able hidden trigger backdoors for neural networks trained from scratch," arXiv preprint arXiv:2106, 08970, 2021.
[4] Y. Zeng, M. Pan, H. Just, L. Lyu, M. Qiu, and R. Jia, "Narcissus: A practical clean-label backdoor attack with limited information," arXiv preprint arXiv:2204005255, 2022.
[5] A. Shafahi, W. R. Huang, M. Najibi, O. Suciu, C. Studer, T. Dumitras, and T. Goldstein, "Poison frogs! targeted clben-label poisoning attacks on neural networks," 2018.
[6] C. Zhu, W. R. Huang, H. Li, G. Taylor, C. Studer, and T. Goldstein, "Transferable llben poisoning attacks on deep neural nets," in International Conference on Machine Learning, 2019,
pp. 7614-7623.
[7] W. R. Huang, J. Geiping, L. Fowl, G. Taylor, and T. Goldstein, "Metapoison: Practical general- purpose clean-label data poisoning," Advances in Neural Information Processing Systems, vol. 33, 2020.
[8] J. Geiping, L. H. Fowl, W. R. Huang, W. Czaja, G. Taylor, M. Moeller, and Goldstein, "Witches' brew: Industrial scale data poisoning via gradient matching," in International Conference on Learning Representations, 2021. [Online]. Available: http:://ppaaeiieweetttoonmnneiee (oooo/o
[9] H. Aghakhani, D. Meng, Y.-X. Wang, C. Kruegel, and G. Vigna, "Bullseye polytope: A scalable clean-label poisoning attack with improved transferability." in 202/ IEEE European Symposium on Security and Privacy (EuroS&P). IEEE, 2021, pp. 159-178.
[10] J. Feng, Q.-Z Cai, and H. Zhou, "Learning to confuse: Generating training time adversarial data with auto-encoder," " 2019.
[11] H. Huang. X. Ma. S. M. Erfani, J. Bailey, and Y. Wang, "Unlearnable examples: Making personal data unexploitable," 2021.
[12] C.-H. Yuan and S.-H. Wu, "Neural tangent generalization attacks," in Proceedings of the 38th International Conference Machine Learning, Proceedings of Machine Learning Research, M. Meila and T. Zhang, Eds., vol. 139. PMIR, 18-24 Jul 2021, pp. 230-11 [Online]. Available: https:/pproceedigsssl...eo wwwpsssss...rrrrsiie..mmme 1 139/yua222.hhmml
[13) G. F. Cretu, A. Stavrou, M. F. Locasto, S. J. Stolfo, and A. D. Keromytis, "Casting out demons: Sanitizing training data for anomaly sensors," 2008 IEEE Symposium on Security and Privacy (sp 2008). IEEE, 2008, pp. 81-95.
[14] J. Steinhardt, P. W. Koh, and P. Liang, "Certified defenses for data poisoning attacks," 2017.
[15] B. Tran, J. Li, and A. Madry, "Spectral signatures in backdoor attacks," in Advances Neural Information Processing Systems, 2018, pp. 8000-8010.
[16] B. Chen, W. Carvalho, N. Baracaldo, H. Ludwig, B. Edwards, T. Lee, I. Molloy, and B. Srivas- tava, "Detecting backdoor attacks on deep neural networks by activation clustering," in SafeAl@ AAAI, 2019.
[17] N. Peri, N. Gupta, W. R. Huang, I. Fowl, C. Zhu, S. Feizi, T. Goldstein, and J. P. Dickerson, "Deep k-nn defense against clean-label data poisoning attacks," in European Conference on Computer Vision. Springer, 2020, pp. 55-70.
[18] Y. Yang, Y. Liu, and B. Mirzasoleiman, "Not all poisons are created equal: Robust training against data poisoning," 2022.

---

[19] O. Pooladzandi, D. Davini, and B. Mirzasoleiman, "Adaptive second order coresets for data- efficient machine learning," 2022. 2022.
[20] M. Weber, X. Xu, B. Karlaš, C. Zhang, and B. Li. "Rab: Provable robustness against backdoor attacks," arXiv preprint arXiv:2003. 0,990, 2020.
[21] A. Levine and S. Feizi, "Deep partition aggregation: Provable defenses against general poisoning attacks," in International Conference on Learning Representations, 2020.
[22] M. Abadi, A. Chu, I. Goodfellow, H. B. McMahan, I. Mironov, K. Talwar, and L. Zhang, "Deep learning with differential privacy," in Proceedings of the 2016 ACM SIGSAC conference on computer and communications security, 2016, pp. 308-315
[23] Y. Ma, X. Z. Zhu, and J. Hsu, "Data poisoning against differentially-private learners: Attacks and defenses," ," in International Joint Conference on Artificial Intelligence. 2019.
[24] Y. Li, X. Lyu, N. Koren, L. Lyu, B. Li, and X. Ma, "Anti-backdoor learning: Training clean models on poisoned data," Advances in Neural Information Processing Systems, vol. 34, 2021.
[25] L.. Tao, L. Feng, J. Yi, S.-J. Huang, and S. Chen, "Better safe than sorry: Preventing delusive adversaries with adversarial training," Advances in Neural Information Processing Systems, vol. 34, 2021.
[26] T. Y. Liu, Y. Yang, and B. Mirzasoleiman, "Friendly noise against adversarial noise: A powerful defense against data poisoning attacks," 2023.
[27] J. Geiping, L. Fowl, G. Somepalli, M. Goldblum, M. Moeller, and T. Goldstein, "What doesn't 't kill you makes you robust (er): Adversarial training against poisons and backdoors," arXiv preprint arXiv:2102. 13624, 2021.
[28] A. Madry, A. Makelov, L. Schmidt, D. Tsipras, and A. Vladu, "Towards deep learning models resistant to adversarial attacks," in International Conference on Learning Representations, 2018.
[29] M. Hill, J. C. Mitchell, and S.-C. Zhu, "Stochastic security: Adversarial defense using long-run dynamics of energy- models," in International Conference Learning Representations, 2021. [Online]. Available:
[30] H. M. Dolatabadi, S. Erfani, and C. Leckie. "The devil's advocate: Shattering the illusion of unexploitable data using diffusion models," 2024.
[31] W. Nie, B. Guo, Y. Huang, C. Xiao, A. Vahdat, and A. Anandkumar, "Diffusion models for adversarial purification," arXiv preprint arXhv:2205.0744 2022.
[32] X. Chen, C. Liu, Li, K. Lu, and D. Song, "Targeted backdoor attacks on deep learning systems using data poisoning," arXiv preprint arXiv:1712.055: 2017.
[33] Y. Liu, S. Ma. Y. Aafer, W.-C. J. Zhai, W. Wang, and X. Zhang, "Trojaning attack on neural networks," 2017.
[34] A. Saha, A. Subramanya, and H. Pirsiavash, "Hidden trigger backdoor attacks," 2019.
[35] D. Yu, H. Zhang, W. Chen, J. Yin, and T.-Y. Liu, "Availability attacks create shortcuts," in Proceedings of the 28th ACM SIGKDD Conference on Knowledge Discovery and Data Mining, ser. KDD '22. ACM, Aug. 2022. [Online]. Available: 0rt.ooo//gg..114/334377.8..8
[36] E. Borgnia, V. Cherepanova, L.. Fowl, A. Ghiasi, J. Geiping, M. Goldblum, T. Goldstein, and A. Gupta, "Strong data augmentation sanitizes poisoning and backdoor attacks without an accuracy tradeoff," in ICASSP 2021-2021 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP). IEEE, 2021, pp. 3855-3859.
[37] S. Hong. V. Chandrasekaran, Y. Kaya, T. Dumitraş, and N. Papernot, "On the effectiveness of mitigating data poisoning attacks with gradient shaping," arXiv preprint 2020.
[38] B. Jayaraman and D. Evans, "Evaluating differentially private machine learning in practice," in 28th [USENIX] Security Symposium ( (USENIX) Security 19), 2019, pp. 1895-1912.
[39] D. Madaan, J. Shin, and Hwang, "Learning to generate noise for multi-attack robustness." 2021.
12

---

[40] N. Das, M. Shanbhogue, S.-T. Chen, F. Hohman, S. Li, L. Chen, M. E. Kounavis, and D. H. Chau, "Shield: Fast, practical defense and vaccination for deep learning using jpeg compression." 2018.
[41] J. Xie, Y. Lu, S.-C. Zhu, and Y. Wu, "A theory of generative convnet," in Proceedings of the 33rd International Conference on Machine Learning, 2016, pp. 2635-2644.
[42] J. Ho, A. Jain, and P. Abbeel, "Denoising diffusion probabilistic models," 2020.
[43] A. Krizhevsky, V. Nair, and G. Hinton, "Cifar- 10 (canadian institute for advanced research)." [Online]. Available: http://wwwwcs..orontto wwwpontt.eddd/kkrizzfffaa..ort
[44] L. N. Darlow, E. J. Crowley, A. Antoniou, and A. J. Storkey, "Cinic-10 is not imagenet or cifar-10," 2018.
[45] G. Griffin, A. Holub, and P. Perona, "Caltech 256," Apr 2022.
[46] Balsam, chlb-cifar10," 2023, released on 2023-02-12. [Online]. Available:
https:
//gituub.com/yyymm-coooo code/hlb CCF/II
[47] M. Heusel, H. Ramsauer, T. Unterthiner, B. Nessler, and S. Hochreiter, "Gans trained by a two time-scale update rule converge a local nash equilibrium," 2018.
[48] E. Nijkamp, M. Hill, T. Han, S.-C. Zhu, and Y. N. Wu, "On the anatomy of MCMC-based maximum likelihood learning of energy-based -assd models," in Proceedings of the AAAI Conference on Artificial Intelligence, vol. 34, 2020.
[49] T. Miyato, T. Kataoka, M. Koyama, and Y. Yoshida, "Spectral normalization for generative adversarial networks," arXiv preprint arXiv: Naw.:/802.0557. 2018.
[50] A. Schwarzschild, M. Goldblum, Gupta, J. P. Dickerson, and T. Goldstein, "Just how toxic is data poisoning? unified benchmark for backdoor and data poisoning attacks," 2021.
[51] Whitaker, "Hugging face ddpm butterflies model," https//huugnnnfccccccoooooowwiit ddpm-butterflie 32px accessed: 2024-08-05.
[52] N. Onzo, "Hugging face ddpm anime model," https//hugghngtcce.coorrr anime-ddppm33--rs22v3]
anime-ddpm- 32- v332v33 accessed: 2024-08-05.
[53] N. Kokhlikyan, V. Miglani, M. Martin, E. Wang, B. Alsallakh, Reynolds, A. Melnikov, N. Kliushkina, C. Araya, S. Yan, and O. Reblitz-Richardson, "Captum: unified and generic model interpretability library for pytorch," 2020.
13

---

A Further Background
A.1 Poisons
The goal of adding train train-time poisons is to change the prediction of a set of target examples 11 {(x". :)") C Dtest or triggered examples {(x + P: y) (ar, v) Dtest) J to an adversarial label yoh
Targeted clean-label data poisoning attacks can be formulated as the following bi-level optimization problem:
argmin 5, PEC, Di z0, (2r Jen
Σ
C (F((2 + +:: )MM)
s.t. ::0==rrmmnn
Σ ((F(x+6;))).0)
(6)
(a.ylED
For a triggerless poison, we solve for the ideal perturbations ó; to minimize the adversarial loss on the target images, where Cs C, C, {0 R. and D Droinn To address the above optimization problem, powerful poisoning attacks such Meta Poison (MP) [ Gradient Matching (GM) (8].
and Bullseye Polytope (BP) [ craft the poisons to mimic the gradient of the adversarially labeled target, i.e.,
VL (Fo (x*) ",""),"" (dv) & Σ VF(F6(1; +
Minimizing the training loss RHS of Equation 7 also minimizes the adversarial loss objective of Equation
For the triggered poison, Narcissus (NS), we find the most representative patch p for class given C, defining Equation 6 with C5- {o E RR. ". Cp C, II = Dirainn y = y", and D DOODD Dirain. In particular, this patch uses public out-of-distrbuutin dataset DOOOD and only the targeted class Traai As finding this patch comes from another natural dataset and does not depend on other train classes, NS has been more flexible to model architecture, dataset, and training regime 4
Background for data availability attacks be found in 35 J. The goal for data availability attacks (sometimes referred to as "unlcarnable" attacks is to collapse the test accuracy. and hence the model's ability generalize, Iearn useful representations, from the train dataset. As we discuss in the main paper, such attacks are immediately obvious when training a model, or rather create region of poor performance in the model. These attacks do not create latent vulnerabilities that can then exploited by an adversary. Thus we do not focus on, or investigate our methods with any detail for availability attacks. Further, we discuss in the Societal Impacts section how such attacks have many ethical uses for privacy and data protection 6
A.2 Further EBM Discussions
Recalling the Gibbs-Boltzzann density from Equation
(1( = Z(0) exp( exp(-9((=))g(x)
(8)
where & E X C RR denotes image signal, and y(x:) is reference measure, often uniform or standard normal distribution. Here, Go signifies the energy potential, parameterized by a ConvNet with parameters 0.
The normalizing constant, or the partition function, 2 = (x =
E.,[exp(-Go(r)) while essential, is generally analytically intractable. In practice, Z(0) is not computed explicitly, as Go(x) sufficiently informs the Markov Chain Monte Carlo (MCMC) sampling process.
As which a of the images are poisoned unknown, we treat them all the same for a universal defense. Considering i.i.d. samples x; P for i == 1 ... nt, with sufficiently large, the sample average over I; converges to the expectation under IP and one can learn a parameter 0" such that pa- (ar) PP()). For notational simplicity, equate the sample average with the expectation.
14

---

The objective is to minimize the expected negative Log-likelihood, formulated as:
(()) (o Ep Epllog So (o
(9)
The derivative of this log-likelihood, crucial for parameter updates, is given by:
VoL(0) = Fx [Vgo( - Epp [V)o(x))
VoGo(at)
Vo90(17);
(10)
where solving for the critical points results in the average gradient of a batch of real images (x,) should be equal the average gradient of synthesized batch of examples from the real images a ~ po(x). The parameters are then updated as 0,+1 = 0₂ + 7/h VL((,), where y is the learning rate.
In this work, to obtain the synthesized samples z; from the current distribution (a we use the iterative application of the Langevin update as the Monte Carlo Markov Chain (MCMC) method, first introduced in Equation
1 2, ArV x. Go(x+) V2ATG,
(11)
where e, ~ of time 41]. Vz = (go(z) can be obtained by back-propagation. If the gradient term dominates the diffusion noise term, the Langevin dynamics behave like gradient descent. We
7 indexes the time step of the Langevin dynamics, and Ar is the discretization
implement EBM training following 48 see App. A.2.1 for details.
Algorithm Data Preprocessing with PUREGEN-EBM: (z
Require: Trained ConvNet potential Ga(z), training images æ E X, Langevin steps T, Time discretization ÅT for r in 1... do
Langevin Step: draw 6, ~ ID)
2++1 ArV V2ATe,
end for Return: Purified X from final Langevin updates
A.2.1 EBM Training
Algorithm is pseudo-code for the training procedure of data-initialized convergent EBM. We use generator architecture the SNGAN [49] for our EBM as our network architecture. Further intuiton can be found in App. B.I
A.3 DDPM Background
The forward process successively adds noise over a sequence time steps, eventually resulting in values that follow prior distribution, typically standard Gaussian in:
(x, xx-1)) = N (xx /1 -,
(12)
where wo ~ ((z)) be a clean image sampled from the data distribution. The forward process is defined by fixed Markov chain with Gaussian transitions for a sequence of timesteps f = 1,...,77 T:
The reverse process is defined as the conditional distribution of the previous variable timestep. given the current one:
Pa (11-1 xt) -N t), Ee t))
(13)
15

---

Algorithm 2 ML with SGD for Convergent Learning of EBM (3)
Require:
Nenv potential Go (at), number of training steps J 150000, initial weight 0,, training
images {x, Ji=l"
Nau data perturbation Tdata = 0.02, step size T 0.01, Langevin steps T 100,
SGD learning rate "ssD = 0.00005.
Ensure: Weights 81+1 for energy Go(x).
Set optimizer 9 < SGD(?saa): Initialize persistent image bank as Naaa uniform noise images.
for j=l:(J+++ do
1. Draw batch images (1(t)) ) from training set, where (i) indicates randomly selected index
for sample i, and get samples X;*
(0) [i(s) + Tdaraf;, where i.i.d. N(O,
2. Draw initial negative samples (Y, j from persistent image bank. Update Jmm with
the Langevin equation
(K))) y(h-1)- A Ar,,,,,,,,; V V2ATEL,.
where 6i,6 N(O, ID) i.i.d., for K steps to obtain samples (X; (Y(()
J Update
persistent image bank with images (k) 1=-1-
3. Update the weights by ff+1 8 g (A0)
where g is the optimizer and
a
n
m 1 Σ fe, (x, m
A0
fe, (x+t)
a0
is the ML gradient approximation. end for
where 3, E (0, 1) a variance schedule. After steps, or is nearly an isotropic Gaussian distribution. This reverse process is parameterized by neural network and trained to de-noise a variable from the prior to match the real data distribution. Generating from a standard DDPM involves drawing samples from the prior, and then running the learned de-noising process to gradually remove noise and yield a final sample.
B PUREGEN Further Intuition
B.1
Why EBM Langevin Dynamics Purify
The theoretical basis for eliminating adversarial signals using MCMC sampling is rooted in the established steady-state convergence characteristic of Markov chains. The Langevin update, as specified in Equation (4). converges to the distribution pe pz) learned from unlabeled data after an infinite number of Langevin steps. The memoryless nature of a steady-state sampler guarantees that after enough steps, all adversarial signals will be removed from an input sample image. Full mixing between the modes of an EBM will undermine the original natural image class features, making classification impossible 29 Nijkamp et al. [2020] reveals that without proper tuning, EBM learning heavily gravitates towards non-convergen ML where short-run MCMC samples have realistic appearance and long-run MCMC samples have unrealistic ones. this work, we use image initialized convergent learning. (x is described further by Algorithm
48
The metastable nature of EBM models exhibits characteristics that permit the removal of adversarial signals while maintaining the natural image's 's class and appearance [29]. Metastability guarantees that over short number of steps, the EBM will sample Thus, it will sample from the initial class and not bring class features from other classes in its learned distribution. Consider, for instance, an image of horse that has been subjected to an adversarial to perturbation, intended to deceive classifier into misidentifying it as dog. The perturbation, constrained by the -orm ball, is insufficient to shift the EBM's recognition of the image away from the horse category. Consequently, during the brief sampling process, the EBM actively replaces the adversarially induced 'dog' features with characteristies more typical of horses, as per its learned distribution resulting in output image resembling horse more closely than a dog. It is important
local mode, before mixing between modes.
16

---

to note, however, that while the output image aligns more closely with the general characteristics of horse, it does not precisely replicate the specific horse from the original, unperturbed image.
We use mid-run chains for our EBM defense to remove adversarial signals while maintaining image features needed for accurate classification. The steady-state convergence property ensures adversarial signals will eventually vanish, while metastable behaviors preserve features of the initial state. We can see PUREGEN-EBL sample purification examples in Fig. below and how clean and poisoned sampled converge and poison perturbations are removed in the mid-run region (100-2000 steps for us).
Stepe:
Stepe: 100
Steps:
Steps: 2000
horse
Polsoned
Clean automobile
Poisoned
Poisoned
Figure 5: PUREGEN-EBE purification with various MCMC steps
Our experiments show that the mid-run trajectories (100-1000 MCMC steps) use preprocess the dataset capitalize on these metastable properties by effectively purifying poisons while retaining high natural accuracy on (x) with training modification needed. Intuitively, the MCMC process as a directed random walk toward a low-energy, more probable natural image version of the original image. The mid-range dynamics stay close to the original image, but in lower energy manifold which removes the majority poisoned perturbations.
can think of
B.2 PUREGEN Additional L2 Dynamics Images
Additional L2 Dynamics specifically for Narcissus e = 16 are shown in Figures 6 and
L2 Distance
L2
p +0]
wyx Al)
[ix 01 e 4l1.
wi0r All 1x Mixxe 5ib
D- Vel 0bb " 1000000-----0-000 -2--1- 6b
150
420
500g
1200, 1500
2000
50mcon
100 125 150 379 200
PureGEN-EBM Steps (mll
PureGEN-DDPM Steps (T[A)nattytnto
Figure 6: L2 Dynamics for Narcissus 16
17

---

Poisoned
Clean
PureGEN-EBM
PureGEN-DDPM Uniform Noise
-0.6
-0.4
-0.2
0.0
0.2
0.4
0.6
Energy Cø(x)
Figure 7: Energy distributions with Narcissus 16 poison.
C PUREGEN Extensions on Higher Power Attacks
We continue with the notation introduced in 3.3 where (2) is the random variable of fixed image x, and we define = (TERM, TDPMM Teeps E IR', where TerM represents the number of EBM MCMC steps, TDdPM represents the number of diffusion steps, and TREPS represents the number of times these steps are repeated.
To incorporate EBM filtering, order D by Go(x) and partition the ordering based kt into D(a) U U((1-)), results in purifying everything and A 0 is traditional training). Then, with some abuse of notation,
min where D(f), contains k[D) datapoints with the maximal energy (where k
V (D) VT (TD(k DUDD (1-A) maser
(14)
To leverage the strengths of both PUREGEN-EBM and PUREGEN-DDPM, we propose PURBGEN combinations:
1. PUREGEN-N TTTTea....T.opp..00000
Apply a fixed number of PUREGEN- EBM steps followed by PUREGEN-DDDPM steps. While this approach does improve the purification results compared to using either method alone, it does not fully exploit the synergy between the two techniques.
2. PUREGEN-REPS ( (Wr)Tsmm SU, >0.Tnep- >1): ): To better leverage the strengths of both methods, we propose a repetitive combination, where we alternate between smaller number of PUREGEN-EBM. EBM and PUREGEN-
steps for multiple iterations.
3. PUREGEN-FILT (4 ( 20.Tppp3200000mmom
In this combination, PUREGEN- EBM to identify a percentage of the highest energy points in the dataset, which are more likely be samples with poisoned perturbations shown in Fig. We then selectively apply PUREGEN-FRE EB. or PUREGEN-DDPM purification to these high-energy points.
first
We note that methods and 3 require extensive hyperparameter search with performance sweeps using the HLB model in F as there was little intuition for the amount of reps (TReps) or the filtering threshold (i) needed. Thus, we not include these methods in our core results, but instead show the added performance gains on higher power poisons in T both in terms of increased perturbation size = 16 and increased poison % (and both together). the adversary has poisoned the entire class in CIFAR-10 10 with an NS trigger, and 16 is starting to approach visible perturbations, but both are still highly challenging scenarios worth considering for purification.
note that 10% would mean
18

---

D Poison Sourcing and Experiment Implementation Details
Triggerless attacks GM and BP poison success refers to the number of single-image targets success- fully flipped target class (with 50 or 100 target image scenarios) while the natural accuracy is averaged across all target image training runs. Triggered attack Narcissus poison success is measured as the number of non-class samples from the test dataset shifted to the trigger class when the trigger applied, averaged across all 10 classes, while the natural accuracy is averaged across the 10 classes on the un un-triggered test data. We include the worst-defended class poison success. The Poison Success Rate for single experiment can be defined for triggerless PSRnot and triggered PSR poisons as:
PSRnotr (F, 1 P((7)=0!"
(15)
(S E(z.))E Drat 1 1((+t))=y (Drest \ Dieat
(16)
Note that all results except for Poison Success Rate for GM and BP attacks have standard deviation, since those attacks are based on a single image class flip for single classifiers training run. We do provide a subset with results for a single poison paradigm of BP and GM in App. E.2.3 where used 3 different seeds for the training classifiers for each of the 50 and 100 runs respectively to get a standard deviation, showing these results are low variance relative to the difference in results between baselines and our method. The compute required to collect such results across all scenarios would be extensive.
D.1
Poison Sourcing
D.1.1 Bullseye Polytope
The Bullseye Polytope (BP) poisons sourced from two distinct sets of authors. From the original authors of BP 19, we obtain poisons crafted specifically for a black-box scenario targeting ResNet18 and DenseNet12) 22 architectures, and grey-box scenario for MobileNet (used in poison crafting). These poisons vary in the percentage of data poisoned, spanning 1%, 2%, 5% and 10% for the linear-transfer mode and single 1% fine-tune mode for all models scenarios has 50 datasets that specify a single target sample in the test-data. We also use a benchmark paper that provides pre-trained white-box scenario on CIFAR-100 [50] This dataset includes 100 target samples with strong poison success, but the undefended natural accuracy bascline is much lower.
500 image transfer dataset. Each of these
D.1.2 Gradient Matching
For GM, we use 100 publicly available datasets provided by [8] Fach dataset specifies single target image corresponding to 500 poisoned images in a target class. The goal of GM is for the poisons to move the target image into the target class, without changing too much of the remaining test dataset using gradient alignment. Therefore, each individual dataset training gives us a single datapoint of whether the target correctly moved into the poisoned target class and the attack success rate is across all 100 datasets provided.
D.1.3 Narcissus
For Narcissus triggered attack, we use the same generating process described in the Narcissus paper, we apply the poison with a slight change to more closely match with the baseline provided by [50]. We learn a patch with = 8/255 on the entire b2-by-32 size of the image, per class, using the Narcissus generation method. We keep the number of poisoned samples comparable to GM for from-seratch experiment, where we apply the patch to 500 images (1% of the dataset) and test on the patched dataset without the multiplier. In the fine-tune scenarios, we vary the poison% over 1 1%, 2.5%, and 10%, by modifying either the number poisoned images or the transfer dataset size (specifically 20/2000, 50/2000, 50/500 poison/train samples).
19

---

D.1.4 Neural Tangent Availability Attacks
For Neural Tangent Availability Attack, the full NTGA dataset (all samples poisoned) is sourced from the authors of the original NTGA attack paper 12 Baseline defenses are pull from AVATAR 30
D.2 Training Parameters
We follow the training hyperparameters given by [8
9 50 for GM, NS, BP Black/Gray-
and BP White-Bou respectively as closely as we can, with moderate modifications to align poison scenarios, HyperlightBench training followed the original creators settings and we only substituted in a poisoned dataloader [46].
Parameter
From Scratch
Transfer Linear
Transfer Fine-Tune
PUREGEN-EBM Steps (TgDM) PUREGEN-DDPM Steps (TDDPM)
1000
125
125
PUREGEN-REPE (Teeps)
7
PUREGEN-FILT (k)
0.5
Device Type
TPU-V3
TPU-V3
TPU-V3
Weight Decay
Se-4
Se-4
Se-4
Batch Size
128
64
128
Augmentations
RandomCrip(22 padding=4)
None
None
Epuchs
200 or 80
60
Optimizer
SGD(momentun-009)
SGD
Adam
Learning Rate
0.1
0.1
0.0001
Learning Rate Schedule
100, 150 - 200 epochs
(Multi-Step Decay)
30, 50, 70 - 80 epochs
15,
45
Reinitialize Linear Layer
NA
True
True
D.3
Core Results Compute
Training compute for core result only which is in Table a TPU V3.
Table 6: Compute Hours TPU V3
From Scratch
Transfer
Total
Matching
Blodilox
BlackBes
Train Time (louro)
1999
4155.34
283.55
73.42
45.29
S48.15
70.76
7135.6
E Additional Results
E.1
Extended Core Results
E.1.1
Full Results Primary Experiments
Results all primary poison scenarios with ResNet18 classifier including all EPIC versions (vari- ous subset sizes and selection frequency), FRIENDS versions (bernouilli or gaussian added noise trasnform), and all natural JPEG versions (compression ratios). Green highlight indicates base- line defense that was selected for the main paper results table chosen by the best poison defense performance that did not resull significant natural accurucy degrudaion. For both Imagett and CINIC- 10 from-scratch results, best performing baseline settings were used from respective poison scenarios in CIFAR-10 for compute reasons (so there are no additonal results and hence they removed from this table).
20

---

From Scratch
CIFAR-I0 (ResNet-18)
Matching-1%%
N
Poison
Avg Nat
Aug Posson Success (%)
Avg
Success (%)
Aec (163
Acc (16)
Success (%)
None
44.00
94.346x
43.95aa
94.89
95.59
EPIc-0.1
34.00
91. 376.
30 18
91.176
$1.50
EPIC-02
21.00
53. 0467
32.5 32.50
56 86.89
$4,39
EPIc-E33
10.00
85 14,,
27.31
82 22,30,3
K4.71
FRIENDS
1.00
91.16u.4
8.32
9101a.
71.76
FRUINDS44
0.00
85.08
JPEG-25
90.15,
JPEG-50
91.700.1
IPEG-75
2.00
17
92.94, is
JPEG-85
5,00
93.43 to
5.761a.4
93.45
43.36
PUREGEN-DDPM
0.00
90,9 93
90 90,
2,83
PUREGEN-EBM
1.00
92 92.98
1.39ss
92.92u2
2.50
Transfor Learning (CIFAR-10, ResNcr-18)
Rullssye Polytope
Bullseye Polytope-10%
Narcissus-19%
BlackBox-109
Poioon Succes (18)
Avg
Poison Success
Poison
Avg
Ang
(
(96)
(9))
Aoc
(16)
(38)
8934
53.41,3
90.14 90,14
83. 83.5%,
70.0%
90.022
8
3
EPIc-0.2
42,00
81.95%
20
91.73
84 34.
91:00
64. 79.
86 86.5ga
28.01
84. 34.66a
66.67
83 25
60 60.86.5
FRIENDS-B
80
3.34.
62
19488
84 97,9
19:00
60.85uu
PRIENDS-G
87.87,
3.04,
89.
182
60 60.90
JPEG-25
88.91
2
87.63
12:55
92,44..4
50:42..1
JPEG 50
0.00
90,40.u4
3,54444
88.41.3s
13:76
0.00
26.03
16.0
53.4%
JPEG
4.80
90.11a.7
18.28
89.12
86.39
16.67
$4,23 1.4
36.0
56.02..33
JPEG-8
5:00
93.43
25. 35.19
38.6 88.63.5
94.41
$4.17
$3.61 1.36
51.0
58.08 58.066.14
POREGEN-DDPM PURKGIN-EBM
0.00
91,53,.5
188
90.69.
3.42
0.00
93,81
44.53,
0.00
87.5 87.52,
2,02,
89.78
3.85
0.00
92.386,
6,00
64.9%
E.1.2
From Scratch 80 Epochs Experiments
Bascline FRIENDS (26 includes an 80-epoch from-scratch scenario show poison defense on faster training schedule. None of these results are included in the main paper, but we show again SoTA or near SoTA for PUREGEN against all baselines (and JPEG is again introduced baseline).
Table 7: From-Scratch 80-Epochs Results (ResNer-18, CIFAR-10)
From Scratch (80 Epochs)
Gradient Mutching-
NarcisuusJ1
Poison
Avg
Avg Poison Success (%)
Avg Nat Acc (%6
Max Poison
Success (9)
Ace (%)
Success (%)
79.
32.51.mm
93.76g.2
EPIc-0.1
27.00
90.87o.4
24.15
90.92,.4
79.42
EPIC-0.2
91.02..
23.75
89.72g.3
EPIc-0.3
44.00
92.46,a
21.53
88.05
80.75
FRIENDS.B
90.07
1.42p.s
90.06g.a
FRIENDS-G
1.00
90.09..
1.37
90.01g.2
3.18
JPEG.
88.73
16660,92
90.01
JPEG-50
2.00
90.55
1.76,
90.56,.9s
3.67
JPEG.75
91.69
1.68
91.676.33
JPEG-N 85
4.00
92.31
1.87,41
92.42.
5.13
PUREGEN-DDPM
89.82 22
1.54,,2
90.00v.15
PUREGEN-EBM
1.00
92.012,
1.52
92.02,.3
2,81
21

---

E.1.3 Full Results for MobileNetV2 and DenseNett221
Table 8: MobileNetV2 Full Results
From
Transfer
Gradient Matching: 1%
Narcisuus-1 1%
Fite- Tine Narcissus 10%
Liscar HP BlackTlox 18%
Piesen
Ang Na.
Avg Poisce
Avg Na.
Mus Prisess
Avg Poians
Aug Nut
Mux Points
Posson Stccess (%)
Ave Nai
Stooms (16)
Ace (85
Suacns (16)
Arc (16)
Stacons (56)
Stccons (S)
Ace [96
Smorms (86
Aoc (9)
98.93
73.07
Ro.54
15
UPIc-0.1
$7.50
91.24,a
79.24
88:35,
66.97
08.33 06.7%
EPIc-0.2
19.00
91.34
38.55
$7.63
74.72
19 19.05
$7.67
50.05
56.25
$4.47
EPSc-0.3
9.78
37.90.4
22.35
09.52
21 21.70pa3
78.17.0
74.55
58.33
58,74,0
PRINNDG
6.00
$4.900
2,00
48.7.
4.38
221
BAHS.T
1A1
41.67
68.8h
FRIENDS
5.00
88886.
2.05
58,13
0.33
2,30L
83044
5.42
42.92
(894
JPEG-25
1.00
85.18
83.00L.1
4.40
6:30mm
g0000.
3.08
34
2,30
6.2-0333
76.12:m
JPEG-75
JPHG-85
2,00
10
18.01a31
12.40
14.5
77.05
PUREGEN-EBM
1,80
9
1.64,
91.756.
2,91
3
$4.18;1
18.85
0.00
78,57,,1
PURSGES-DIPM
1.00
85 34
2.13:
96.91.91
3.74
341.e
36.92.39
16.79
0.00
8X.14
Table 9: DenseNet121 Full Results
From Suratch
Toweseer Lorinng
Gradient Matching-1 %
Narcious-15 1%
Fine- Tane-Tane Narcious-100 10%
Lincur BP BlackBox-188 18%
Prison Stccess (18)
Any
Aug Stccess (1S)
Aree Nat
Mus
Aug Priere
Prium Stecoss
Potson Stecess
Act
(V61
Success (16)
(1B)
Acc (B)
Acc (S)
Nimc
14:00
45. 90
46 57.3
95.31
96
$7.01
99.55
35:43
82.1%
EPIc-0.1
14:00
03.0uu
43.35 43.3852
93.07
58.97
53 23.
87.184
99.44
62.50
78,8%
B.
7:20
98
41.97533
90123
56.35
43.60 66.60
35.726
97.17
41.67
70.136.3
EPIC-03
4.00
88.3ga
32.60pa
$5.12
71:30
45 24
72.7hmu
100.00
66.87
70.20 70.20ua3
PRIENDS-
1.00
91.33
31.55
08.57
5.38
35.42
00.81
00.22
FRIENDS-G
91.33g4
10.13553
91.32a4
5.55p4
88.751
$0.12
JPEG 50
0.00
1.90s5
12.50
$4.24,22
JPRG-35
0.50
0.7%v.z
91. 17.18.27
3.46
32.31
87.19
98.64
27.05
51,
JPEG 35
7:00
91.5 92.55
13.30ga00
93,77067
90.77
38,70
96.25
97.19
70.53
$0.57
PURSGEXEBBM
0.80
92
1.4211
93.48,
2.60
2.48.
7.41
0.00
R9.2 89.29
PURXGEN-DDMM
3.00
91.0%
1.71g.
90
2.57
2.7%
85.316.02
3.95
0.00
$9002,
E.1.4 PUREGEN Combos on Increased Poison Power
Table 10: PUREGEN Combos with Narcissus Increased Poison % and e
Nardowo - 55%
Narcboo tn 101
Nardoww
1015
Nartiaa 1i 10%
Aug
Pricce
Max Police
Patsee
Mat Pracee
Naa
Mas Paicc
Saccon 1901
1911
CTty
Aua
Saccos
Succen 1911
Anc 2913
Sacce 190
Sacoos 190
Act (91
Success (9))
Nax
$0.25
16.27
$4.
55377
55.00pmm
53.87411
97.35
19.35
54.5%
79.57
36 177
10677
$3.41
50-75
18
08
79.7%
EPic
18.38
22000
10:02.00
$5.05
32
64.55
10.90
18 10
$1.15
71.43
31.5
10.42
FRENDD-B
18.9
1.3..s
30.93
JPEG 15
166.0
3.30
00.53
34 1686
40.77411
4114
07
00.34-1
PIRAGENDOUPN
5.30
45.58..7
16:20
521
15.16u
13.32
63.2
20.35
$9.35
PUREGIN Nave,
135
3,17
10.45
25.
15.20m
21.42
a
13.06
5.20
020008
50.1
$7.11
133
3
12.9%
00.35
33390-11
Prantiox
E.2
Additional Experiment Results
E.2.1
Defense/EBM-Awarre Narcissus Experiments
To further demonstrate the robustness of PUREGEN, we conduct an additional experiment simulating a scenario where an adversary is aware that PUREGEN is in use. Specifically, we incorporate the Energy-Based Model (EBM) within the Narcissus poison generation framework. Narcissus generates poisons by training a surrogate model, then refining the poison through SGD on frozen surrogate outputs (further details in ()). For simplicity, assume that the adversary possesses knowledge of the EBM defense mechanism but is unaware of the specific image instances ultimately used during training.
In this experiment, we include our pre-trained EBM as a preprocessing layer for the ResNet-based surrogate model, using 50 EBM steps choice that balances computational efficiency with reliable performance. When training the EBM-aware surrogate, we freeze the EBM to allow the classifier to train on a diverse set of stochastic EBM outputs. After brief warmup phase, the entire surrogate
22

---

model is frozen, and we propagate gradients to optimize poison effectiveness. We test variations of when the surrogate and poison generation do do not have EBM information, applied of the 10 CIFAR-10 10 classes. The results are recorded in Table 11
Our results show that PUREGEN consistently defends against all new EBM-aaare Narcissus poisons, demonstrating the robustness of our approach. Interestingly, we observe that when both the surrogate and poison-generating models include the EBM, the Narcissus method struggles produce effective poisons, even in an undefended model context. Conversely, with traditionally trained surrogate model but EBM augmentation in the poison generation process, the new poisons slightly improve efficacy on an undefended model. Overall, these findings reinforce the reliability of PUREGEN as robust defense mechanism against adaptive poisoning attacks.
Table 11: Success Rates of EBM-Aware Narcissus Poisons Against PUREGEN Defense on classes 0,1,2. This table shows that even with the knowledge of the EBM, Narcissus is unable to generate effective poisons against PUREGEN. Furthermore, when the EBM taken in the entire Narcissus process, Narcissus struggles to find poison that works for undefended models.
Narcissus Baseline
Narcissus EBM Generation Model
Avg Poisun
Avg
Puison Success (56)
Avg Poison
Avg Ace (9) f
Max Poison
Success (%) J
Acc (%)
Success (5) L
Success (%)
Defense PUREGEN-DDPE
31.02
03.64..2
87.94
46.82,7.00
93,36u.14
90.52
1.49.s
91. 12.10
2.36
1.06..3
91.10.c
1.64
PUREGEN-EBM
1.57
91.486.25
1.29
91.43p.16
1.83
Narcisuus EBM Surrugate Model
Narcissus EBM Surrogate and Generation Model
Avg Poison
Avg Nat
Max Poison Success (%)
Avg Poisen
Avg Nat
Max Poison
Success
Acc (
Success (%)
Acc
Success
No Defense
20.08
93. 93.576.17
57.67
3.042.00
93.65u.12
5.74
PUREGEN-DDAN -DDMM
1.46..u
91.04.17
2.64
1.42,.0
91.12p.1
2.60
PUREGEN-
1.56
91.36,,2
2.73
1.59
91,29o.s
2.50
E.2.2 Pre-Trained Public DDPM Comparison
We include results using two pre-trained diffusion models from HuggingFace [51 52
The results show that these models can achieve defense performance similar to that of some of our POOD) in-house trained models. The table below includes 4 baseline PUREGEN models and the two Hugging Face models trained on butterflies and anime datasets, showing both are comparable for poison defense and natural accuracy to some POOD datasets performance. These results how that, for PUREG DN-DDMM pre-trained models could be adequate, but come with the risks of using model with unknown data security. We reiterate our primary contribution for BUREGEN-DDPPS was in reducing training and improving performance for a given architecture and dataset if one needs to train a diffusion model and if purification the known use-case.
Table 12: Two pre-trained diffusion models from HuggingFace, showing similar results to our POOD DDPM results on Narcissus From-Scratch attack [1 52
DDPM Model
Poison Success (%)
Nat Ace (%)
Max Poison (%)
PUREGEN EBM CINIC-
1.39
92.92 0.20
PUREGEN-DDE MDMM CINIC-IO,IN IO
1.64 + 0.82
90.99 + 0.22
3.83
PUREGEN Food
1.71
88.35 0.21
PUREČEN-DDEE Office-Home
1.83 0.83
87.32 a 0.22
3,16
HuggingFace Butterflies 51
87.79 + 0.18
3.01
HuggingFace Anime
52
+.75
90.91 + 0.13
2.95
23

---

E.2.3 GM and BP Poison Success Standard Deviation
Table 13: Core results poison success for one GM and one BP scenario where we compute poison success across 3 different seeds to show the relatively low variance of these results where our method still SoTA.
Polson Success
Poison Scenario
Baseline
EPIc
FRIENDS
JPEG
PUREGEN-EBM
PUREGEN-DDPM
Hoo--Sertch,, GM-15, CIFAR-ID 10 (ResNNei-18)
44.44,.17
10.58
0.33,.47
0.670.47 0.676.04
1000.00
0.00buop
Tunc, BP-
18.63
44.675.73
7.19
0.0.
0.67pst
24

---

F PUREGEN Extensions T Sweeps
COPPE-SS
ACE
DD 20 Palaen Bacinse
0DPMM-1 Plac Pallann
11.77
1331A
0112%
Daor
1025
10.15
Shaak
6000%
87
447%%
1196
1000
16490
19%
MM
MCNC sp
HCMC Steps
NCMC Stope
D0P9-33
D0795-25 Pation
02PM-33 Mac Palaen
400
022
B1123
4.09
EL.IN
1278
23:004
11.03
Punlly
R1A7S
17:00
1.775
16/0PM
15:00
18.0%
R1/25
120%
7.4%%
14490
13.75
11:3%
8::03:
13:77
1.4%%
6265
0.215
1.70
14:00M
10:07%
30
100
VRAI%
VISA
120
MMN
LD
61%
13.99
15/0%
4.0%
14%
1
13:996
14:04
10 10%
11.4%
1.4%
8.23%
1126
K1M
12:
13.05
1:26
1/
MCNC spaps
MCNC Staps
NCMC Sta
somee Mil
00 15 Pateen
CDPM 24 Max Palsen
01:344
511
11.03
410
SEACK
J3P
Rapa
ANC
4.%%
45%
7:406
11%%
61%
40%
AMT
4%%
4.1%
1.44
1120
4.06
MCNC
HCME Stepe
NCMC Strpe
Figure 8: PUREGEN- REPS Sweeps with HLB Model on Narcissus
25

---

Fui DOPN MAL Pollc SeCOHES
X-I
L0A 17.1N
1.30 01139
CM
4.75 s.C. 6M
CAM
1800% 11.01
3005
2.7e 7AM
133mh
MCCCC Stops
MCMC Stops
MECPCC Stops
Figure 9: PUREGEN-NAIVE Sweeps with HLB Model on Narcissus
PureGen:Filee Filt
Succesa
Speceus
10 S1.9I S4h 42%
081
JLAXN INIS JLAES K.00 9170 6474
621
M..% Avo in voc SIC ALOTN
1ANAN K.W. S-A APPS A3 11.00
NOC KYIN 11.0% SLANC EVAE
pea BLACK mass ara arars
2a/1h TALRO 21a25 8.th 2400 1724
Saaa dusi to 404 skipp Lears S4.M
2. ULLES: coarn 6:33h comt 130t 7.0%
650
Ikrre stare 3130 us share scaie 11.31
1850
1n0 who 1a80u 1980e 2010
sabko thior (860 2000
PureGen-Flte Filtzor
Natt
Poben Succesn
Mix Pobre Success
$25.2
F90h
7,005
18.7%
B4 03
724h
79
1525
112
15.25
1:44
0.5%%
5.7%
13.44
6-0%%
611%
19.9%
-020
684
19/2
Diffudian Steps
Diffusian Staps
Steps
Figure 10: PUREGEN-FILT Sweeps with HLB Model on Narcissus
G Interpreting PUREGEN Results
G.1 Model Interpretability
Using the Captum interpretability library, in Figure 11 various defense techniques on a sample image poisoned with the NS Class 5 trigger [53]. Only the clean model and the model that uses PUREGEN-EBI correctly classify the sample as horse, and the regions most important to prediction, via occlusion analysis, most resemble the shape of a horse in the clean and PUREGEN-EBM images. Integrated Gradient plots show how PUREGEN-EBM actually enhances interpretability of relevant features in the gradient space for prediction compared to even the clean NN.
we compare a clean model with clean data to
26

---

Clean
None
EPic prediction: dog
FrieNDs prediction: dog
PureEBM prediction: horse
prediction: horse
prediction: dog
Poisoned
Clean
Image
Image
Occlusions
0.0
0.5
1.0
0.0
100
0.5
Integrated Gradients
0.5
6.0
0.5
1.0
0.0
0.5
Clean
No Defense prediction: dog
Epic prediction: dog
Friendly prediction: dog
EBM prediction: frog
prediction: frog
Poisoned
Clean Image
Image
Occlusions
Integrated Gradients
0.5
0.5
5.0
0.5
5.0
0.5
5.0
0.5
Figure 11: Defense Interpretability: Model using PUREGEN-EBM. focuses on the outline of the horse in the occlusions analysis and to higher degree on the primary features in the gradient space than even the clean model on clean data.
27

---

G.2 Differences between PUREGEN-EBM and PUREGEN-DDPM
In this section we visualize a Narcissus 64 trigger patch to better see the PUREGEN-EBM and PUREGEN-DDPM samples on visible perturbation. In Figure [22 we see again how the EBM struggles purify larger perturbations but better preserves the image content, while DDPM can degrade such perturbations better at the cost of degrading the image content as well.
Figure 12: Narcissus 64 trigger patch purification samples Top Left: Original Poisoned. Top
Right: PUREGEN-EBM 500 Steps. Top Left: PUREGEN-DDPM 75 Steps.
28

---

1. Claims
Question:
Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?
Answer[[Yes)
Justification: The claims the abstract and introduction are supported by the detailed methodologies and comprehensive experimental results presented in Sections 3 and 4 respectively. These sections demonstrate the effectiveness and universality of PUREGEN methods in defending against variety of train-time poisoning attacks.
Guidelines:
The answer NA means that the abstract and introduction do not include the claims made in the paper.
The abstract and/or introduction should clearly state the claims made, including the contributions made the paper and important assumptions and limitations. A No or
NA answer to this question will not be perceived well by the reviewers.
The claims made should match theoretical and experimental results, and reflect how much the results
be expected to generalize other settings.
is fine to include aspirational goals as motivation as long is clear that these goals are not attained by the paper.
2. Limitations
Question: Does the paper discuss the limitations of the work performed by the authors?
Answer:[Yes]
Justification: The limitations discussed in Section 4.5 where address the computa-
tional cost, data requirements for training the generative models, and the trade-offs between purification times and performance.
Guidelines:
The answer NA means that the paper has no limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.
The authors encouraged create separate "Limitations" section in their paper.
The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g., independence assumptions, noiseless settings, model well-specification. asymptotic approximations only holding locally). The authors should reflect how these assumptions might be violated in practice and what the implications would be.
The authors should reflect on the scope of the claims made, e.g., if the approach was only tested on few datasets or with few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.
The authors should reflect on the factors that influence the performance of the approach. For example, facial recognition algorithm may perform poorly when image resolution low or images are taken in low lighting. Or speech-to-text system might be used reliably to provide closed captions for online lectures because it fails to handle technical jargon.
The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.
If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and fairness.
While the authors might fear that complete honesty about limitations might be used by reviewers as grounds for rejection, worse outcome might be that reviewers discover limitations that aren't acknowledged in the paper. The authors should use their best judgment and recognize that individual actions in favor of transparency play an impor- tant role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed to not penalize honesty concerning limitations.
3. Theory Assumptions and Proofs
29

---

Question: For each theoretical result, does the paper provide the full set of assumptions and complete (and correct) proof?
Answer: [Yes]
The theoretical results, assumptions, and proofs are detailed in Sections 3.1 and 3.2, with additional mathematical formulations provided in the appendices.
Justification:
Guidelines:
The answer NA means that the paper does not include theoretical results.
All the theorems, formulas, and proofs in the paper should be numbered and cross- referenced.
All assumptions should be clearly stated or referenced in the statement of any theorems.
The proofs can either appear in the main paper or the supplemental material, but if they appear in the supplemental material, the authors are encouraged provide short proof sketch to provide intuition.
Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix or supplemental material.
Theorems and Lemmas that the proof relies upon should be properly referenced.
4. Experimental Result Reproducibility
Does the paper fully disclose all the information needed to reproduce the main perimental results of the paper to the extent that it affects the main claims and/or conclusions of the paper (regardless whether the code and data are provided or not)?
Question:
Answer: [Yes]
Justification: The paper includes commitment to release code and models upon publication (along with an anonymous codebase attached for submission). Detailed instructions for reproducing the experiments are provided in the Appendix.
Guidelines:
The answer NA means that the paper does include experiments.
If the paper includes experiments, a No answer to this question will not perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.
If the contribution is dataset and/or model, the authors should describe the steps taken make their results reproducible verifiable.
Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is a novel architecture, describing the architecture fully might suffice, or if the contribution be necessary to either make it possible for others to replicate the model with the same dataset, or provide access to model. In general. releasing code and data often one good way to accomplish this, but reproducibilityy can also be provided via detailed instructions for how to replicate the results, access to a hosted model (e.g.. in the case of large language model), releasing of a model checkpoint, other means that are appropriate to the research performed.
specific model and empirical evaluation, may
While NeurlPS does not require releasing code, the conference does require all submis- sions to provide some reasonable avenue for reproducibility, which may depend the nature of the contribution. For example
(a) If the contribution is primarily a new algorithm, the paper should make it clear how reproduce that algorithm. (b) If the contribution is primarily the architecture clearly and fully.
model architecture, the paper should describe
(c) the contribution is a new model (c.g., a large language model), then there should either be way to access this model for reproducing the results or way to reproduce the model (e.g., with an open- open-source dataset or instructions for how to construct the dataset).
(d) We recognize that reproducibility may be tricky in some cases, in which case authors are welcome describe the particular way they provide for reproducibiliity In the case of closed-source models, it may be that access to the model is limited in
30

---

some way (e.g., to registered users), but it should be possible for other researchers have some path reproducing or verifying the results.
5. Open access to data and code
Question: Does the paper provide open access to the data and code, with sufficient instruc- tions faithfully reproduce the main experimental results, as described in supplemental material?
Answer: [Yes]
Justification: All relevant training and testing details, including data splits, hyperparameters, and optimizer settings, are thoroughly described in Section 4.1 and Appendix D. The paper includes commitment to release code and models upon publication (along with an anonymous codebase attached for submission).
Guidelines:
The answer NA means that paper does not include experiments requiring code.
Please see the NeurlPS code and data submission guidelines (https://nips cc/
for more details.
While we encourage the release of code and data, we understand that this might be possible, so "No" is an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (e.g., for new open-source benchmark).
The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurIPS code and data submission guidelines (https
/ ltaaps.cc/publcc/guud.oo
for more details.
The authors should provide instructions data access and preparation, including how to access the raw data, preprocessed data, intermediate data, and generated data, etc.
The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. only subset of experiments are reproducible, they should state which ones are omitted from the script and why.
At submission time, to preserve anonymity, the authors should release anonymized versions (if applicable).
Providing as much information as possible in supplemental material (appended to the paper) recommended, but including URLs to data and code permirted.
6. Experimental Setting/Details
Question: Does the paper specify all the training and test details (e.g., data splits, hyper- parameters, how they were chosen, type of optimizer, etc.) necessary understand the results?
Answer: [Yes]
Justification:
Training and test details are, the best extent of the authors, following
previous benchmarks provided by previous poisons authors [50
18
4
9.
Otherwise,
hyperparameter explanations specific to PUREGEN are given in Section 3.4
The details of
all byperparameters used are listed in App. D.2
Guidelines:
The answer NA means that the paper does include experiments.
The experimental setting should be presented the core the paper to level of detail that is necessary to appreciate the results and make sense of them.
The full details can be provided either with the code, in appendix, supplemental material.
7. Experiment Statistical Significance
Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?
Question:
Answer:
[Yes]
Justification:
The results include error bars in all experiential results in Section 4
Guidelines:
31

---

The answer NA means that the paper does not include experiments.
The authors should answer "Yes" if the results are accompanied by enror bars, confi- dence intervals, or statistical significance tests, at least for the experiments that support the main claims of the paper.
The factors of variability that the error bars capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall run with given experimental conditions).
The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap, etc.)
The assumptions made should be given (e.g., Normally distributed errors).
should be clear whether the error bar is the standard deviation or the standard error of the mean.
It is OK to report I-sigma error bars, but should state it. The authors should preferably report a 2-sigma error bar than state that they have 96% CI, if the hypothesis of Normality of errors is not verified.
For asymmetric distributions, the authors should be careful not show in tables figures symmetric error bars that would yield results that are out of range (c.g. negative error rates).
error bars are reported in tables or plots, The authors should explain the text how they were calculated and reference the corresponding figures or tables in the text.
8. Experiments Compute Resources
For each experiment, does the paper provide sufficient information on the com- puter resources (type of compute workers, memory, time of execution) needed to reproduce the experiments?
Question:
Answer: [Yes]
Justification: Information the compute resources used, including the type of hardware (TPU V3), memory, and execution time, is provided in Section 4.5 and Table
Guidelines:
The answer NA means that the paper does include experiments.
The paper should indicate the type of compute workers CPU or GPU, internal cluster, cloud provider, including relevant memory and storage.
The paper should provide the amount of compute required for each of the individual experimental rums as well as estimate the total compute.
The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary or failed experiments that didn't 't make it into the paper).
9. Code Of Ethics
Question: Does the research conducted the paper conform, in every respect, with the NeurlPS Code of Ethics http:///wwr.p...cc.aaa...tttttta
Answer: [Yes]
The research adheres to the NeurIPS Code of Ethics, ensuring responsible use AI technologies and addressing potential ethical concerns related to data poisoning and model security, as discussed in the "Potential Social Impacts" Section
Justification:
Guidelines:
The answer NA means that the authors have not reviewed the NeurlPS Code of Ethics.
If the authors answer No, they should explain the special circumstances that require a deviation from the Code of Ethics.
The authors should make sure to preserve anonymity (e.g.. if there special consid- eration due to laws or regulations in their jurisdiction).
10. Broader Impacts
Question: Does the paper discuss both potential positive societal impacts and negative socictal impacts of the work performed?
32

---

Answer: [Yes]
Justification: The social impacts section in App. provides a balanced discussion both positive and negative societal impacts of the research, including ethical considerations and the potential for misuse.
Guidelines:
The answer NA means that there no societal impact of the work performed.
If the authors answer NA or No, they should explain why their work has no societal impact why the paper does not address societal impact.
Examples of negative societal impacts include potential malicious unintended uses (e.g., disinformation, generating fake profiles, surveillance), fairness considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.
The conference expects that many papers will be foundational research and not tied to particular applications, let alone deployments. However, if there is direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster.
The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology is being used intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology.
If there are negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition attacks, mechanisms for monitoring misuse, mechanisms to monitor how system learns from feedback over time, improving the efficiency and accessibility of ML).
11. Safeguards
Question: Does the paper describe safeguards that have been put in place for responsible release of data or models that have a high risk for misuse (e.g., pretrained language models, image generators, scraped datasets)?
Answer: [NA]
The research does not involve the release of high-risk models or datasets that require specific safeguards, but broader risks of the research in general is discussed in
Justification:
Section 6
Guidelines:
The answer NA means that the paper poses no such risks.
Released models that have high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere to usage guidelines or restrictions to access the model or implementing safety filters.
Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.
We recognize that providing effective safeguards is challenging, and many papers do not require this, but we encourage authors to take this into account and make best faith effort.
12. Licenses for existing assets
Are the creators or original owners of assets (c.g., code, data, models), used in the paper, properly credited and are the license and terms of use explicitly mentioned and properly respected?
Question:
Answer: [Yes]
Justification: All datasets and models used properly cited in Section or in Appendix D
Guidelines:
33

---

The answer NA means that the paper does not use existing assets.
The authors should cite the original paper that produced the code package dataset.
The authors should state which version of the asset is used and, if possible, include URL.
The name of the license (c.g., CC-BY 4.0) should be included for each asset.
For scraped data from a particular source (e.g., website), the copyright and terms of service of that source should provided.
assets are released, the license, copyright information, and terms use in the package should be provided. For popular datasets, paperssi thcode. com/ com/datasets has curated licenses for some datasets. Their licensing guide can help determine the license of dataset.
For existing datasets that are re-packaged, both the original license and the license of the derived asset (if it has changed) should be provided. If this information is not available online, the authors are encouraged to reach out to the asset's 's creators.
13. New Assets
Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?
Answer: [NA]
Justification: Code and models will be released upon acceptance. Anonymous code is attached with submission. No additional assets.
Guidelines:
The answer NA means that the paper does release new assets.
Researchers should communicate the details the dataset/code/moodll as part their submissions via structured templates. This includes details about training, license, limitations, etc.
The paper should discuss whether and how consent was obtained from people whose asset used.
At submission time, remember anonymize your assets (if applicable). You can either create an anonymized URL or include an anonymized zip file.
14. Crowdsourcing and Research with Human Subjects
Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well details about compensation (if any)?
Answer: [NA]
Justification: No Human Subjects
Guidelines:
The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.
Including this information the supplemental material is fine, but if the main contribu- tion of the paper involves human subjects, then as much detail as possible should be included the main paper.
According to the NeurIPS Code of Ethics, workers involved data collection, curation, or other labor should be paid at least the minimum wage in the country of the data collector.
15. Institutional Review Board (IRB) Approvals or Equivalent for Research with Human Subjects
Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or an equivalent approval/review based on the requirements of your country or institution) were obtained?
Answer: [NA]
34

---

Justification:
No Human Subjects
Guidelines:
The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.
Depending the country in which research is conducted, IRB approval (or equivalent) may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.
recognize that the procedures for this may vary significantly between institutions and locations, and we expect authors to adhere to the NeurlPS Code of Ethics and the guidelines for their institution.
For initial submissions, do not include any information that would break anonymity (if applicable), such the institution conducting the review.
35


Reviews:
[{"review_id": "K9EgTlI9Kp", "reviewer": "Reviewer_16Y8", "summary": "This paper proposes a stochastic preprocessing defense technique, named PureGen, against train-time poisoning attacks, with EBM-Guided and Diffusion-Guided sampling processes. First, with EBM-based purification, called PureGen-EBM, the purifier first evaluates the (unnormalized) energy function of the images. Then, this considers the high-energy images as the 'posioned' images, and purifies with the stochastic preprocessor $\\Psi_T$. On the other hand, with Diffusion-based purification, called PureGen-DDPM, the purifier first add Gaussian noises to the inputs and run the reverse diffusion process using DDPM.", "questions": "* In the PureGen-DDPM process, the dataset is trained with DDPM fewer steps, (250 steps rather than the conventional 1000 steps). Nevertheless, training DDPM with fewer discrete steps yields heavier posterior mismatch between the DDPM posterior covariance and the optimal covariance, according to [Bao et al, 2022]. I doubt that the purification gain from less timesteps from Figure 4 (bottom right) is just a side-effect of this posterior mismatch, which is not rigorously intended. I will be more convinced if some explanation on setting the fewer steps in PureGen-DDPM for training.\n* Even though the time complexity of the proposed purification method is comparable to the existing methods, this can be easily improved with some higher-order solvers without any additional training. The paper will be much stronger if more results with some solvers are addressed.\n\n[Bao et al, 2022] Analytic-DPM: an Analytic Estimate of the Optimal Reverse Variance in Diffusion Probabilistic Models, ICLR 2022\n\n---\n\nMinor typos\n* (Appendix C) Intition $\\to$ Intuition", "limitations": "N/A", "rating": 4, "confidence": 5, "soundness": 3, "presentation": 3, "contribution": 1, "strengths": "* This paper demonstrates purification results with respect to diverse poisoning attacks and data availability attacks, which provides a new benchmarks on the adversarial learning communities.\n* To the best of my knowledge, this is the first result to implement adversarial purification to poisoning attacks, achieving superior performances compared to other existing methods.", "weaknesses": "* The idea of using adversarial purification to adversarial attacks is already well-known, and this is an increment of the adversarial purification to other kinds of attacks.\n* There are still scenarios that also breaks the adversarial robustness of the purification models such as BPDA+EOT [Athalye et al, 2018]. To mitigate this, additional consideration like fine-tuning on the adversarial perturbation models is required. [Lin et al., 2024]. Without this, the purified images will be easily poisoned with stronger poisoning attacks, which also involves with the purifier in the poisoning steps.\n* Some additional validation on using the diffusion models on adversarial purification should be addressed: see __Questions__.\n* In my opinion, with improved sampling methods using a higher-order solver of consistency-based distillation models, the purification can be drastically faster compared to both the proposed methods and the existing method. I presume that this can be easily improved: See __Questions__.\n\n[Athalye et al, 2018] Obfuscated Gradients Give a False Sense of Security, ICML 2018 \\\n[Lin et al., 2024] Adversarial Training on Purification (AToP): Advancing Both Robustness and Generalization, ICLR 2024", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We thank the reviewer for their time and directly respond to the stated questions and weaknesses.\n\n---\n\n### Weaknesses\n\n1. *Contributions are limited and adversarial purification is a known technique.*\n\nWe respectfully disagree that our contribution is incremental and believe that conflating inference and train-time attacks contributes to this impression. In the general rebuttal (**Train-Time vs. Inference-Time Attacks**), we detail the differences between train and inference-time attacks. Train-time attacks require preventing the creation of \"latent\" backdoors during training, where defenders have no knowledge of poison presence in the data, and ***the attacker no longer has access to the training or inference pipeline after poisoning***. We demonstrate significant improvements across diverse train-time poisoning scenarios, establishing a new benchmark in this domain. Our extensive experiments provide practical applications beyond the norm in defense literature. We hope clarifying this distinction allows the reviewer to see the novelty of this work. \n\n2. *There are still scenarios that break the adversarial robustness of the purification models such as BPDA+EOT [Athalye et al, 2018]. To mitigate this, additional consideration like fine-tuning on the adversarial perturbation models is required. [Lin et al., 2024].*\n\n**BPDA+EOT is an inference-time attack, which is out of scope for our paper.** PureGen is focused on train-time attacks, where attackers poison a dataset but lack access to the training pipeline afterwards. This central assumption in train-time attack and defense literature makes BPDA+EOT irrelevant here. As a side note, the SoTA defense against PGD+EOT(the full gradient version of BPDA+EOT) uses an EBM [1]. The published SoTAs for train-time poisons are EPIC [2] and FRIENDS [3], which do not defend against PGD/BPDA+EOT. DiffPure claims SoTA against BPDA+EOT but fails when true gradients, which is memory intensive and requires gradient checkpointing, are calculated i.e. PGD+EOT. \n\n**Fine-tuning in this way is not applicable in the train-time attack setting.** The train-time poisons in this paper are SoTA in strength, and our EBM and Diffusion models defend against them better than any other defense while maintaining natural accuracy. Even if future train-time poisons are stronger, the goals differ from PGD/BPDA+EOT and a comparison is not possible. For this rebuttal, ***we collected results crafting a defense-aware Narcissus patch (see **Defense-Aware Poison** in the general rebuttal), showing PureGen-EBM dynamics make crafting itself no longer possible in the standard budget*** (8/255) . Note, we are a defense paper, and not a poison paper, and coming up with a defense aware train time poison is not our burden, but we did so to answer these questions raised directly and indirectly by multiple reviewers. \n\nWe provide concrete evidence that our PureGen method is SoTA under from-scratch, fine-tune, and linear transfer modes across various architectures, poison types, and attacker knowledge levels of gray and white-box scenarios covering all attacks relevant to train-time attack literature.\n\n---\n### Questions\n\n1. *The reviewer asks about fewer DDPM steps in training and resulting heavier posterior mismatch*\n\nOur choice balances the fidelity of the original image with the need to effectively remove the poison perturbation and improve diffusion model training time. While a posterior mismatch is theoretically possible, **Figure 4 in Appendix B.3 shows empirical evidence that the truncated DDPM training schedule results in better poison defense and natural accuracy** for a given architecture and dataset. We will move this figure to the main paper due to its importance.\n\nWe also include results with pre-trained Diffusion models (see **Usage of Pre-Trained Diffusion Models** in the general rebuttal), showing they can achieve reasonable defense success. However, for specific purification use-cases, the truncated PureGen-DDPM method offers improved performance and decreased training burden.\n\n2. *The reviewer states even though the time complexity of the proposed purification method is comparable to the existing methods, this can be easily improved with some higher-order solvers without any additional training.*\n\nThe time complexity of PureGen is significantly faster than SoTA defense FRIENDS as shown in Table 5, and is quickly marginalized over usage of the data as we only need to purify once. Using higher-order solvers can potentially give marginal speedups to diffusion, but as the reviewer mentioned, can be used on our diffusion models without re-training. **Since we only need to purify one time, the delta between standard DDMP and using a higher-order solver is negligible.** In the context of adversarial inference attacks where one must defend against every incoming image with gradients needing to be propagated through every step of diffusion, this may make a difference, but not in our train-time poison context. \n\n---\n\nWe hope these responses clarify any stated weaknesses and answer the reviewer’s questions. References are in general rebuttal. We look forward to any additional discussion.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "WE0GPksHMJ", "reviewer": "Reviewer_gd22", "summary": "This work introduces PureGen, a method to purify a potentially poisoned dataset before the dataset is used to train a classifier. The work explores using Langevin MCMC with both EBMs and diffusion models to remove potential adversarial artifacts from data, with the justification that MCMC sampling should move a sample away from the adversarial artifacts and towards the data distribution. The number of Langevin steps is chosen to be enough to remove adversarial artifacts while preserving the original image. Experimental comparison shows strong performance of the proposed method for training robust classifier with a variety of data poisons compared to existing approaches.", "questions": "Could the authors discuss the situation where the attacker is aware of the defense? I am willing to raise my score if this concern can be addressed.", "limitations": "Limitations are adequately discussed.", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 2, "strengths": "* The presentation of the method is clear and straightforward, and the paper is easy to follow.\n* The work proposes interesting adaptions of Langevin purification for white-box adversarial defense to the domain of data poisons.\n* Empirical results show that the proposed defense can outperform existing defense. There is a thorough examination of different poisons and comparison with existing methods.", "weaknesses": "* The defense requires costly Langevin iterations and has a higher computational burden compared to existing methods. I appreciate that this is acknowledged clearly and discussed by the authors in the limitations section.\n* My main concern about this work involves the situation where the data poisoner is aware of the defense method that will be applied to the dataset. Developing attacks that can adapt to different defense strategies is standard in the white-box attack literature, although I am not as familiar with such procedures in the poison literature. Will the defense remain robust if the attacker is aware of the defense strategy? See, for example, [a].\n\n[a] https://arxiv.org/abs/1802.00420", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We thank the reviewer for their time and directly respond to the stated questions and weaknesses.\n\n---\n\n### Weaknesses\n\n1. *The defense requires costly Langevin iterations and has a higher computational burden compared to existing methods.*\n\nThe Langevin sampling is not as costly as it may seem. With modern GPUs, the cost is comparable to gradient descent. Our timings show that MCMC is actually much faster than the SoTA defense FRIENDS [3], as demonstrated in Table 5. This table also illustrates that **PureGen's cost becomes negligible when the purified dataset is reused.**\n\n2. *Concern about the situation where the data poisoner is aware of the defense method that will be applied to the dataset and white-box scenarios.*\n\nIn the context of train-time poisons (see general rebuttal **Train-Time vs. Inference-Time Attacks** for detailed differences), the poisoner must stealthily insert poisoned samples into the training dataset to create a backdoor in the NN. A central assumption is that the poisoner has no access to the training pipeline after impacting the train dataset, and the impact of those poisons remains undetected (minimal impact on standard train/test losses). Thus, in this context, **a white-box attack refers to the poisoner having the exact architecture, initialization, and weights (for transfer learning scenarios) of a pre-trained or from-scratch model, but they still lack access to the training pipeline and the model after training**. This scenario is addressed in Table 1, bottom right (Bullseye Polytope Linear Transfer White-Box Scenario), representing the strongest possible poison scenario.\n\nAlthough crafting poisons is outside the scope of defense papers, ***we did craft an EBM dynamics-aware Narcissus trigger and found that it was unable to poison against PureGen***. The stochastic nature of PureGen ensures that almost any effective poison perturbation will be high-energy and thus \"purified\" by PureGen dynamics, with the main concern being a tradeoff in natural accuracy.\n\n| Poison Craft Method                     |   Defense   |   Poison Success  |\n|:----------------------------------------|:-----------:|:-----------------:|\n| Narcissus Label 2 Baseline (In-Paper)   | No Defense  |      70.95 %      |\n| Narcissus Label 2 Baseline (In-Paper)   | PureGen-EBM |       2.70%       |\n| Narcissus Label 2 PureGen-EBM Aware     | No Defense  |       3.63%       |\n| Narcissus Label 2 PureGen-EBM Aware     | PureGen-EBM |       2.37 %      |  \n\nAdditional analysis of these results can be found in the general rebuttal **Defense-Aware Poison**. We encourage poison researchers to utilize our code and attempt to break the defense, but ***we already include results with the strongest scenarios available per the train-time poison literature along with this additional defense-aware experiment***. Note, crafting this single trigger took over 20+ hours of A100 GPU time. While we could not get more results for this rebuttal, we will include results and analysis in an appendix for the camera-ready version for all classes and for “PureGen-DDPM aware” Narcissus.\n\n---\n\n### Questions\n\n1. *The reviewer asks if we could discuss defense-aware poisons.*\n\nSee the Weakness 2 above and the **Defense-Aware Poison** section in the general rebuttal where we discuss this at length and include an additional experiment showing PureGen’s robustness to a custom defense-aware poison for PureGen-EBM. \n\n---\n\nWe hope these responses clarify any stated weaknesses and answer the reviewer’s questions. References are in general rebuttal. We look forward to any additional discussion.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "xmedgtJShD", "reviewer": "Reviewer_n59K", "summary": "This paper studies the generative purification methods, i.e., EBM and DDPM-based purifications, as defenses against a set of data poisoning attacks.", "questions": "1. Can you provide more intuition about why sacrificing generative capabilities can improve poison defense?\n\n2. Can AVATAR[1] work as a defense baseline against Bullseye Polytope, Gradient Matching, and Narcissus?\n\n3. In Table 1, why are there no gradient matching results on CINIC-10 and no Narcissus results on Tiny-ImageNet?\n\n4. Why do some Poison Success cells show no standard deviations in Table 1,2? \nAnd is the bold font abused in these tables?\n\n[1] Dolatabadi H M, Erfani S, Leckie C. The devil’s advocate: Shattering the illusion of unexploitable data using diffusion models", "limitations": "See weaknesses and questions.", "rating": 4, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 2, "strengths": "1. They suggest that a proper range of implementation steps in the EBM and DDPM-based purification methods matters for defense performance. \n\n2. They conduct comprehensive experiments to evaluate the effectiveness of PureGen methods.\nExperimental results show that proposed defenses perform better than the baselines in the paper.\n\n\n3. They study some considerations in practical scenarios including (a) training distribution shift in the generative model training; (b) training the generative model on poisoned data; (c) network architecture transferability\n\n4. They explore some PureGen variants.", "weaknesses": "1. The idea of employing generative methods to purify imperceptive noises has been explored, i.e. EBM [1] and DDPM [2]. \nAs for training-time poisoning attacks, [3, 4] propose to use diffusion process to defend against availability attacks.\nThough this paper studies different data poisoning attacks such as Bullseye Polytope, Gradient Matching, and Narcissus, I don't think there is any essential difference in the defense mechanism.\n\n2. Since the technical modification in DDPM lies in the truncation of training steps, it's beneficial to move Figure 4 to the main paper which illustrates how the the selection of steps influences the defense performance.\n\n\n\n\n[1] Yoon J, Hwang S J, Lee J. Adversarial purification with score-based generative models\n\n[2] Nie W, Guo B, Huang Y, et al. Diffusion Models for Adversarial Purification\n\n[3] Jiang W, Diao Y, Wang H, et al. Unlearnable examples give a false sense of security: Piercing through unexploitable data with learnable examples\n\n[4] Dolatabadi H M, Erfani S, Leckie C. The devil’s advocate: Shattering the illusion of unexploitable data using diffusion models", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We thank the reviewer for their time and directly respond to the stated questions and weaknesses.\n\n---\n\n### Weaknesses\n\n1. *The idea of employing generative methods to purify imperceptible noises has been explored before and the defense mechanism is not different from other attack paradigms such as the availability/unlearnable attack.*\n\nIn the general rebuttal (**Train-Time vs. Inference-Time Attacks**), we detail the differences between train and inference-time attacks and availability attacks. Our initial EBM work is based on the 2020 paper Stochastic Security [1]. We adapted a similar setup in PureGen-EBM for the poison setting, showing it defends against poisons much better than SoTA. We found poisons are separable as high-energy, which is specific to train-time poison settings. We scaled up the EBM and optimized the number of steps. Given the popularity of diffusion models related to EBMs via Langevin sampling, we found they also reach near SoTA performance. \n\nUnlearnable examples (availability attacks) are recent, and so is the Devil's Advocate paper [4]. AVATAR is related to diffusion-style purification, which is why we compared PureGen-DDPM on availability examples in Table 2. We see that out-of-the-box PureGen performs nearly as well as AVATAR. Using AVATAR would be \"cheating\" since it has seen clean versions of poisoned images as it was designed for inference-time attacks. Additionally, the augmentations used in their method (Cut-Mix, Cut-Out, etc.) are not used in our method to isolate PureGen's impact. Unlearnability and clean-label train-time poisons pose different problems; unlearnability produces detectable results counter to neural network goals, while poisoning is harder to detect post-training, posing significant security risks. Our technique provides universal defense against the strongest poisoning techniques.\n\nFinally, we conducted numerous additional experiments for intuition, exploring POOD distribution shifts, poisoning generative model training data, and combining EBM+DDPM and EBM filtering, pushing the boundaries of generative model defense work. We believe these differences and extensive experiments make PureGen a valuable contribution to the community.\n\n2. *The reviewer suggests moving Figure 4 to the main paper to illustrate how the selection of steps influences the defense performance.*\n\nWe appreciate this suggestion and will move Figure 4 to the main paper for the camera-ready version to clarify the justification for our pipeline modification.\n\n---\n\n### Questions\n1. *Can you provide more intuition about why sacrificing generative capabilities can improve poison defense?*\n\nThe empirical results in Figure 4 support that for a given architecture, dataset, and training pipeline, sacrificing some generative capabilities improves poison defense. We utilize Langevin dynamics as a \"restoration\" of the conditional information in the corrupted image, akin to EBM dynamics moving a sample to a lower-energy, more realistic image. Since the model is not trained to generate from the prior, no model capacity is needed for this initial high-energy, random noise sample. All model capacity is dedicated to restoring the corrupted image, which retains significant low-energy information, similar to conditional generative diffusion processes like in-fill or super-resolution, rather than standard unconditional DDPMs. We will include more discussion around this in a camera-ready version. \n\n2. *Can AVATAR work as a defense baseline against Bullseye Polytope, Gradient Matching, and Narcissus?*\n\nAVATAR is primarily designed for unlearnable examples, which differ from train-time poisoning attacks. The released AVATAR checkpoints are trained on CIFAR-10, making it unfair to use them for purifying unpoisoned images as they have memorized the clean images. However, diffusion methods trained on the correct subsets or POODs likely work, as shown by our results with pre-trained diffusion models in the general rebuttal (**Usage of Pre-Trained Diffusion Models**). While PureGen-DDPM training offers computational advantages and some performance improvements, it is not necessary to achieve reasonable defense performance when pre-trained models are available. \n\n3. *Why are there no gradient matching results on CINIC-10 and no Narcissus results on Tiny-ImageNet?*\n\nWe focused our experiments on the most relevant and challenging scenarios for each dataset, leveraging available poisons from crafting papers. Crafting new poisons is computationally expensive, highly hyper-parameter dependent, and not typically done by defense paper authors. We will clarify this in the appendix. We crafted “new” poisons for analysis in the “defense-aware Narcissus poison” in the general rebuttals, going beyond the scope of typical defense papers.\n\n4. *Why do some Poison Success cells show no standard deviations in Table 1,2? And is the bold font abused in these tables?*\n\nStandard deviations are not shown for un-triggered poison scenarios (Gradient Matching and Bullseye Polytope) for Poison Success. For these experiments, the poison success is based on training 100 classifiers (as each classifier has a single target image for which it is poisoned or not). It would be possible to obtain a standard deviation using different initialization seeds, such repetitions are quite costly (core table results alone took over 7k TPU V3 hours). We can obtain these results for a camera-ready version. \n\nWe use bold fonts to highlight the highest performing method for each category within reason (highest natural accuracy might be ignored if there is poor poison defense). The exception is Table 3 where we try to highlight all the poisoned model scenarios that would still be SoTA. We will modify Table 3 to use bold font for the highest performing methods as well.\n\n---\n\nWe hope these responses clarify any weaknesses and answer the reviewer’s questions. References are in the general rebuttal. We look forward to any additional discussion.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "99Bg69Su4s", "reviewer": "Reviewer_K3RB", "summary": "The paper presents a novel approach to securing model's performance (robust and natural accuracy) against train-time data poisoning attacks by introducing a set of data purification transformations during training, specifically employing Energy-Based Models (EBM) and Denoising Diffusion Probabilistic Models (DDPM). The effectiveness of the proposed method is demonstrated through evaluations on CIFAR-10, Tiny-ImageNet, and CINIC-10 datasets.", "questions": "1. The application of EBM and DDPM for adversarial purification is gaining traction, particularly in defense against inference attacks [1]. Is this the first application of these models for training-time data poisoning defense? How does this work distinguish itself within the existing body of literature regarding its novelty?\n\n2. The claim on Page 2, Line 45, that purification models require training with a POOD dataset may not present a significant challenge. Pre-trained DDPM models are readily available in open-source repositories and can be employed for data purification, as demonstrated in [1]. Could the authors conduct a comparative analysis between the performance of publicly available DDPM models and those trained in-house?\n\n\n[1] \"(Certified!!) Adversarial Robustness for Free!.\" Carlini, Nicholas, et al. The Eleventh International Conference on Learning Representations. 2022.", "limitations": "See weakness and questions.", "rating": 5, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1. The paper is generally well-written and structured. However, certain sections could benefit from additional clarity and elaboration to enhance the overall presentation quality.\n2. The elucidation of the L2 Distance in Section 3.4 is commendable, offering a lucid explanation of the method's underlying mechanism for aligning poisoned data with the benign data distribution.\n3. The exploration of different variants of the proposed method in Section 4.4 is a valuable addition to the paper.\n4. The method achieves state-of-the-art performance in the conducted experiments, with a comprehensive exploration of its capabilities across various scenarios.", "weaknesses": "1. Section 3.1 could be improved by providing a more in-depth discussion on the application of EBM models within the context of the proposed method, rather than focusing predominantly on foundational concepts.\n2. The relevance of Section 3.3 is questionable, as the equations introduced (e.g., Eq. 6) do not appear to be integral to the subsequent discussion.\n3. The paper may benefit from a clearer articulation of its novelty within the field.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We thank the reviewer for their time and directly respond to the stated questions and weaknesses.\n\n---\n\n### Weaknesses\n\n1. *The reviewer suggests that Section 3.1 could be improved by providing a more in-depth discussion on the application of EBM models within the context of the proposed method.*\n\nWe appreciate this feedback and are open to modifying Section 3.1. As this is the first application of an EBM in the poison setting, we believe it was useful background information. That being said, we can condense the fundamental concepts more in the camera-ready version and move more details to the appendix. \n\n2. *The reviewer questions the relevance of Section 3.3, as the equations introduced do not appear integral to the subsequent discussion.*\n\nWhile these sections provide a theoretical basis for a stochastic transformation defense, we can further condense this section down and move some details to the appendix. We will revise the paper to ensure a clearer connection between these theoretical concepts and their practical application in our method. \n\n3. *The reviewer states that the paper may benefit from a clearer articulation of its novelty within the field.*\n\nWe agree and have articulated the novelty in more detail in the general rebuttal **Novelty of Work** section. We will similarly update the camera-ready version of the paper.\n\n---\n\n### Questions\n\n1. *Is this the first application of EBM and DDPM for training-time data poisoning defense? How does this work distinguish itself within the existing body of literature regarding its novelty?*\n\nYes, this is the first application of EBM and DDPM models for training-time data poisoning defense to the best of our knowledge. We address the main novelty points of our paper in our general rebuttal **Novelty of Work** section and clarify the difference between train-time and test-time poisons.\n\n2. *The claim on Page 2, Line 45, that purification models require training with a POOD dataset may not present a significant challenge. Could the authors conduct a comparative analysis between the performance of publicly available DDPM models and those trained in-house?*\n\nWe have included an additional experiment using two pre-trained diffusion models from HuggingFace. The results show that these models can achieve defense performance similar to that of some of our POOD in-house trained models. The table below includes 4 baseline PureGen models and the two Hugging Face models trained on butterflies and anime datasets [5,6], showing both are comparable for poison defense and natural accuracy to some POOD datasets in performance. We will include these results and make clear that when available, a pre-trained diffusion model is quite capable of providing poison defense. Our primary insight was in reducing training and improving performance for a given architecture and dataset if one needs to train a diffusion model and if purification is the known use-case.   \n\n\n|    | Model                  | Poison Success (%) |  Nat Acc (%) | Max Poison (%) |\n|---:|:-----------------------|:------------------:|:------------:|:--------------:|\n|  0 |PureGen-EBM CINIC-10_IN |    1.39 ± 0.80     | 92.92 ± 0.20 |      2.50     |\n|  1 |PureGen-DDPM CINIC-10_IN|    1.64 ± 0.82     | 90.99 ± 0.22 |      3.83      |\n|  2 |PureGen-DDPM Food-101   |    1.71 ± 0.74     | 88.35 ± 0.21 |      2.72      |\n|  3 |PureGen-DDPM Office-Home|    1.80 ± 0.83     | 87.32 ± 0.22 |      3.16      |\n|  4 |HuggingFace Butterflies |    1.65 ± 0.83     | 87.79 ± 0.18 |      3.01      |\n|  5 |HuggingFace Anime       |    1.47 ± 0.75     | 90.91 ± 0.13 |      2.95      |\n\n\n---\n\nWe hope these responses clarify any stated weaknesses and answer the reviewer’s questions. References are in general rebuttal. We look forward to any additional discussion.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:
We thank the reviewers for their thoughtful feedback and the opportunity to address their concerns. Below, we provide a concise response to the main points raised by the reviewers and outline main revisions we will make to improve our paper.

---

### Responses to General Points

1. **Train-Time vs. Inference-Time Attacks**

***PureGen is the first method to use EBMs and DDPMs for defending against train-time data poisoning attacks.*** Our work focuses on train-time poisoning attacks, which aim to manipulate training data to cause misclassification during inference. This is distinct from inference-time attacks (PGD/BPDA+EOT), which aim to fool a trained model with perturbed test samples.

Clean-label train-time attackers manipulate a small portion of training data to introduce undetected backdoors, without further access to the model once training begins. In practice, attackers may disseminate poisoned images on public platforms like social media, hoping they are used for training. The goal is to avoid human detection, have images classified as intended in training, and not significantly alter training or validation metrics to avoid suspicion. We acknowledge works on generative models for inference-time attacks (e.g. Avatar [4], Stochastic Security [1]) but focus on the unique risk of train-time attacks, where an attacker creates a latent backdoor that can be exploited later without alerting the model trainer or deployer. 

2. **List of Novel Contributions**:
- We are the first to bring generative model defense to train-time poisons and provide a comprehensive set of experiments showing SoTA performance over the strongest poisons and scenarios.
- We demonstrate that poisoned samples are separable as high-energy using EBMs, showing why generative model dynamics purify and lower the energy of such samples.
- We find generative models effective even when trained with distributionally shifted or poisoned data.
- We introduce a truncated DDPM training cycle to reduce computational costs and improve purification performance.
- We explore a combination of EBMs and DDPMs for better purification.

3. **Defense-Aware Poison**

To address concerns about “defense-aware” attackers, we conduct experiments using "defense-aware" Narcissus poisons crafted with knowledge of the EBM defense (using EBM dynamics in the crafting process directly). The results show PureGen's robustness, even against attacks designed with defense knowledge.

| Poison Craft Method                     |   Defense   |   Poison Success  |
|:----------------------------------------|:-----------:|:-----------------:|
| Narcissus Label 2 Baseline (In-Paper)   | No Defense  |      70.95 %      |
| Narcissus Label 2 Baseline (In-Paper)   | PureGen-EBM |       2.70%       |
| Narcissus Label 2 PureGen-EBM Aware     | No Defense  |       3.63%       |
| Narcissus Label 2 PureGen-EBM Aware     | PureGen-EBM |       2.37 %      |  

Our “defense-aware” Narcissus experiments suggest two possible results: finding a hole in the EBM defense or failing to craft effective poisons due to stochastic purification. Our success against various poisons makes the first scenario unlikely. While not theoretically guaranteed, the new results further support that finding an effective poison with EBM knowledge is improbable. We can expand on this table for the camera-ready version but emphasize that we are not a poison paper and cannot hypothesize new poison techniques to bypass PureGen. We could not get more results for this rebuttal (crafting this single trigger took over 20+ hours of A100 GPU time), *we will include results and analysis for the camera-ready version for all classes*.


4. **Usage of Pre-Trained Diffusion Models**

We include an experiment using two pre-trained diffusion models from HuggingFace, showing similar results to our POOD DDPM results on Narcissus From-Scratch attack. PureGen-DDPM training is beneficial but not required for good defense performance; pre-trained models are often adequate when available. 

|    | Model                  | Poison Success (%) |  Nat Acc (%) | Max Poison (%) |
|---:|:-----------------------|:------------------:|:------------:|:--------------:|
|  0 |PureGen-EBM CINIC-10_IN |    1.39 ± 0.80     | 92.92 ± 0.20 |      2.50     |
|  1 |PureGen-DDPM CINIC-10_IN|    1.64 ± 0.82     | 90.99 ± 0.22 |      3.83      |
|  2 |PureGen-DDPM Food-101   |    1.71 ± 0.74     | 88.35 ± 0.21 |      2.72      |
|  3 |PureGen-DDPM Office-Home|    1.80 ± 0.83     | 87.32 ± 0.22 |      3.16      |
|  4 |HuggingFace Butterflies [5] |    1.65 ± 0.83     | 87.79 ± 0.18 |      3.01      |
|  5 |HuggingFace Anime [6]    |    1.47 ± 0.75     | 90.91 ± 0.13 |      2.95      |

---

### Revision and Improvements

- We will include the results from both our additional experiments:
“Defense-aware” Narcissus showing PureGen is still effective when attackers can utilize the PureGen-EBM dynamics
Use of pre-trained Diffusion models that can obtain comparable defense performance to PureGen-DDPM
- We will clarify that the PureGen-DDPM training process shows gains empirically over standard diffusion but it not necessary to obtain reasonable defense performance
- We will add more detail to Section 1 to clearly enumerate our novel contributions.
- We will move Figure 4 into main paper

---

### References
[1] Hill M, Mitchell J, Zhu S. Stochastic Security: Adversarial Defense Using Long-Run Dynamics of Energy-based Models.  
[2] Yang Y, Liu T Y, Mirzasoleiman B. Not All Poisons are Created Equal:  Robust Training against Data Poisoning. (EPIc).  
[3] Liu T Y, Yang Y, Mirzasoleiman B. Friendly Noise against Adversarial Noise: A Powerful Defense against Data Poisoning Attacks.  
[4] Dolatabadi H M, Erfani S, Leckie C. The devil’s advocate: Shattering the illusion of unexploitable data using diffusion models.  
[5] https://huggingface.co/johnowhitaker/ddpm-butterflies-32px  
[6] https://huggingface.co/onragi/anime-ddpm-32-res2-v3

Meta-review: The reviews were split: On one hand, all reviewers acknowledged the novelty of this work as being the first to apply generative model based purification to training time poisoning attacks. On the other hand, Reviewers 16Y8 and n59K expressed concerns on the incremental nature of contributions, compared to existing purification work on inference attacks and availability attacks. Most other questions from the reviewers seem to have been largely addressed during the rebuttal. 

While I agree with the reviewers that the idea of applying purification to mitigate training time poisoning attacks may sound natural and incremental, the authors have done commendable work to thoroughly verify and present the effectiveness of this idea. It is likely that many people in the field might benefit from learning these experimental results. And another tool to deal with data poisoning is certainly a welcome addition to the practitioners who have to deal with data in the wild and bear significant consequences had anything go awry. Thus, in the end I believe the merits and potential impact outweigh the concerns, and getting this work published sooner rather than later may encourage further, more significant efforts from the entire community.

Some suggestions for the next revision: 

- Avoid using sentences like "people should be purifying all image data with whatever EBM/diffusion model they have access to," considering that there is certainly downsides and possible unknown side effects of purification.

- Make clear the poisoning attacks studied in this work are mostly targeted attacks, in contrast to indiscriminate attacks. Some of these were described in the appendix and it is important to clearly phrase the experimental setup as early as possible. 

- Please incorporate the additional discussions and experiments during rebuttal.
Decision: Accept (poster)