Inverting Gradient Attacks Makes Powerful Data Poisoning
Authors: Wassim Bouaziz
Nicolas Usunier
El-Mahdi El-Mhamdi
Venue: Accepted by TMLR ()

Abstract: Gradient attacks and data poisoning tamper with the training of machine learning algorithms to maliciously alter them and have been proven to be equivalent in convex settings. The extent of harm these attacks can produce in non-convex settings is still to be determined.
Gradient attacks are practical for fewer systems than data poisoning but have been argued to be more harmful since they can be arbitrary, whereas data poisoning reduces the attacker’s power to only being able to inject data points to training sets, via e.g. legitimate participation in a collaborative dataset. This raises the question whether the harm made by gradient attacks can be matched by data poisoning in non-convex settings. In this work, we provide a positive answer and show how data poisoning can mimic gradient attacks to perform an availability attack on (non-convex) neural networks. Through gradient inversion, commonly used to reconstruct data points from actual gradients, we show how reconstructing data points out of malicious gradients can be sufficient to perform a range of attacks. This allows us to show, for the first time, a worst-case availability attack on neural networks through data poisoning, degrading the model’s performances to random-level through a minority (as low as 1%) of poisoned points.

Published in Transactions on Machine Learning Research (12/2025)
Inverting Gradient Attacks Makes Powerful Data Poisoning
Wassim (Wes) Bouaziz Meto, FAIR & CMAP, Ecole polytechnique
wussim..s.ouuazii0mmaaaaa com
Nicolas Usunier
Work done at Meta, FAIR
El-Mahdi El-Mhamdi
CMAP, École polytechnique
Reviewed on OpenReview: https: /ttp://ppppe openreview. net/ forun? id= Luy5MjyyTh
//
Abstract
Gradient attacks and data poisoning tamper with the training of machine learning algorithms to maliciously alter them and have been proven be equivalent in convex settings. The extent of harm these attacks
produce in non-convex settings is still to be determined. Gradient attacks are practical for fewer systems than data poisoning but have been argued to be more harmful since they can be arbitrary, whereas data poisoning reduces the attacker's power to only being able to inject data points to training sets, via c.g. legitimate participation in a collaborative dataset. This raises the question whether the harm made by gradient attacks can be matched by data poisoning non-convex scttings. this work, we provide a positive answer and show how data poisoning can mimic gradient attaks to perform an availability attack (non-convex) neural networks. Through gradient inversion, commonly used to reconstruct data points from actual gradients, we show how reconstructing data points out of malicious gradients can be sufficient to perform a range of attacks. This allows us to show, for the first time, a worst-case availability altack on neural networks through data poisoning, degrading the model's performances to random-level through a minority (as low as 1%) of poisoned points. Code available hitpps: wttp://wwww/////////eeeeeeeeeeee taagreggr gradient
1 Introduction
Security in Machine Learning requires considering various attackers with a wide range of capabilities. Better understanding the capabilitics of these attackers is crucial to design effective defenses and evaluations. In training time attacks, an attacker may only need to participate in the training procedure and send strategically chosen, yet legitimate-looking participation. We call gradient altacks the cases where the attacker can send gradients, and data poisoning when they send data points. The severity of attacks range from integrity attacks, where the model's reliability or consistency can be altered, to the most severe, availability attacks, where the model is plainly unusable, e.g. due to performances being too low allow for normal operations.
So far, unless the objective function is convex Biggio al. (2013): availability attacks have only been possible through gradient attacks Blanchard et al. (2017) El-Mhandi al. (2018): Baruch et al. (2019), leaving open question, whether gradient attacks are fundamentally more powerful than data poisoning attacks outside the convex setting. What can be the damage caused by data poisoning in a worst-casc scenario, and can it match the damage of gradient attacks? While data poisoning have been considered weaker than gradient attacks, challenging this perception is crucial to develop comprehensive security measures (Section A illustrates real-world sccnarios). In this work, we answer this question by providing empirical evidence that poisoning attacks can lead availability attacks on (non-convex) neural networks, under a worst-case threat model that allows for comparing both gradient and data poisoning attacks.

---

Published in Transactions on Machine Learning Research (12/2025)
Attacker's knowledge
Standard Robust Distributed Learning studies
traditional data
established availability attack
poisoning
omniscient
no known availability attack
model
weights
last layer weights
this work
model architecture
Attacker's degree of freedom w.r.t. interaction with the model
black box
polsoning at each iter.
poisoning at each iter. uncenstrained
embedding attack at each iter. unconstrained
gradient omnipotent at each iter. unconstrainne
poisoning &
attacker
constrained data domain
constrained
Figure 1: Territory of known availability atlacks (in red) within a domain of constraints. The closer to the origin, the more constrained is the setting for the attacker to realize an availability attack. A Geiping et al. (2020b); Zhao & Lao (2022); ; Ning et al.
(2021); ; Huang et al. (2020), V: Blanchard et al.] (2017 Baruch
et al. (2019), El-Mhamdi et al. (2018), 4 80 far only in convex settings Farhadkhani et al. (2022), A:
Availability attacks (Result in subsection 5.3 B: Influence of the feasible set (Result in subsection 5.3)
An "apple-to-apple" comparison of data poisoning attacks and gradient attacks not straightforward because the literature associates them with different threat models offering different. levels of knowledge and interventions. Gradient attacks are only considered in Distributed Learning settings with the Byzantine Machine Learning threat model Blanchard et al. (2017): El-Mhamdi et al. (2018) Baruch et al. (2019). where legitimate workers send actual model updates and malicious workers send arbitrary updates. In contrast, dala poisoning attacks are usually considered in Centralized Learning settings Biggio et al. (2013] Muñoz-González
et al. (2017); : Lu et al. (2022) in a threat model that only allows the attack to be crafted once and for all. order to remove this confounding factor, we consider a threat model in which both attacks can be executed by allowing
attacker to intervene at each iteration, similarly to Algorithm in [Steinhardt ct al. (017)) may it be gradients data poisoning (Figure D Once this confounding factor removed, the fundamental difference between gradient and dala poisoning altacks comes from the limited expressivity of data poisoning compared to the arbitrary gradient attacks.
Our approach leverages gradient inversion methods, previously used in privacy atlacks distributed learning to reconstruct train- ing data points from actual gradients they induced. Contrary to privacy attacks, malicious gradients might not be achievable by the gradient operator if participants are expected to send legitimate-looking inputs (Figure 2h. We reconstruct data points whose induced gradient can replicate as much as possible mali- cious gradient, and show that they can constitute a sufficient data poisoning to achieve an availability attack.
Rd VoL(ho(())3) VoL((h((Fx).
Figure 2: Images of the gradient oper- ator on different sets. Rd is whore an al tacker can craft unrestricted gradient. attacks. (ho(()()))))) is the set of possible gradients given an unrestricted data poisoning (Result B in Section 5.3 and (aL(ho(Fxx, is the set of possi- ble gradients when data poisoning is re- stricted to a feasible set Fx FFy C Xxx (Result in Section 5.3)
In our experiments, we exhibit a successful availability attack on neural network architectures, trained on image classification task with different optimization algorithms, even when protected by a defense mechanism against gradient attacks. We show that: (1) the additional roists under which data poisoning allacks operate, compared to gradient attacks, make them overall less effective than plain gradient attacks, and (2) the severity of data poisoning attacks covers the same range as gradient attacks, in- cluding availability attacks,
non-convex neural works
2

---

Published in Transactions on Machine Learning Research (12/2025)
Our contributions are the following:
We leverage gradient inversion mechanism from privacy attacks to reconstruct data poisoning from existing gradient attacks and perform attacks various settings;
We introduce a worst-case threat model that allows for a fair comparison between gradient attacks and data poisoning attacks, by allowing the atlacker to intervene at. each iteration;
We demonstrate that in our worst-case threat model, data poisoning could perform an availability attack on neural networks degrading them to random chance performances.
Paper structure. The rest of the paper is organised as follows. Section 2 reviews related work on the broader effort to understand various types of attacks, Section B describes the formal sctup, Section $| provides our solution to invert the most important gradient attacks back in the training data domain, and provides table of correspondence between gradient attacks and data poisoning attacks, Section 5 implements our solution describing empirical outcomes, finally, Section G discusses our work and provides concluding remarks.
2 Background
Gradient attacks have long been studied in the standard Robust Distributed Learning literature, when an attacker can send arbitrary" gradients. Lemma in Blanchard et al. (2017) shows that with stochastic gradient descent (SGD), availability altacks are possible with only a single malicious worker. The at tacker's freedom allows for a variety of attacks by exploiting the geometry of honest gradients and the inevitable weaknesses El-Mhamdi et al. (2018); Baruch et al.) (2019); ; Xic et al. (2020); Shejwalkar & Houmansadr (2021) of robust gradient aggregators when the model is dimg--iima or when the data is heterogeneous. The attacker's goal is to bring the average gradient to another direction, making step toward their objective. There is no naive way to determine if a gradient is legitimate or not. In such settings, defending is often considered as a task of robust mean estimation. Robust aggregation of gradients is hence a possible defense mechanisms one can deploy Blanchard et al. (0177)s El-Mhamdi et al. (2018); Yin et al. (2018). Still, with better defense mechanisms came better attacks Baruch et al. (0199). Even stronger, Theorem 2 in El-Mhamdi et al. 2023) shows the impossibility of robust mean estimation below a certain threshold that grows with data heterogeneity and model size. Our work relies on these gradient attacks and shows how they can be transferred to data poisoning successful availability attacks, even in non-convex scttings.
Data poisoning is the manipulation of training data of ML algorithms with the goal of influencing the algorithms' behavior. Several approaches exist to generate poisons: label flipping Shejwalkar et al. (2022), generative methods Muñoz- et al. (2019); ; Zhao & Lao (0022), , and gradient-based approaches Klnoo--Gonzlle et al. (2017); Shafahi et al. (2018) : Geiping et al. (2020b). The last allows to finely control the resulting gradient on the poisonous points instead of relying on another proxy. Although [Shejwalkar et al. (2022); Shhewaalkrr & Houmansadr (2021) consider data poisoning to be of limited harm and gradient- approach to be too computationally intensive, clean-label aacks based on gradient matching have shown to be both stealth and effective when performing targeted integrity attack Geiping et al. (2020b). It was also demonstrated in practical settings such as state of the art image classifiers Bouaziz ct al. (2025a) audio classification Bouaziz el al. (2025c), and even language modeling Bouaziz et al. (2025b). To the best of our knowledge, our work is the first to achieve an availability attack on a neural network using data poisoning.
Availability attacks have been demonstrated in a range of settings. As shown in Figure D we can compare these settings in term of attacker knowledge (from black box to omniscient) and degree of freedom (from single constrained interaction to omnipotent attacker). The data poisoning literature networks only allows an attacker to craft poison once to insert it in the training set, with various levels of knowledge. Geiping et al.] (2020b) operate both in black-boz setting and with sole model architecture knowledge. Alunoz-Gonzálln et al. (2019) assume an omniscient attacker and Muñoz-Gonzálezz et al. (2017) add scenarios with attackers not having access to the model weights or to the training data. Farhadkhani
neural
Ofttn called Byzantine attacks, reference to the Ryzantine faults model distributed computing Lamport al. 1982

---

We consider a classification setting where the model is trained on a dataset Dirain = 2 sampled from a distribution D over X' x y. The learner trains a neural network ho parametrized by 0 E Rd with an iterative optimization algorithm on the (non-convex) loss function L. Its goal is to achieve the lowest test Published in Transactions on Machine Learning Research (12/2025)
et al. (022) assume an attacker who can interfere at the embedding level of the last layer of neural network. This particular case is equivalent to attacking a logistic regression which is convex setting for which an equivalence between data poisoning and gradient attacks holds. Previous works in data poisoning on neural networks were only able to slightly decrease the performance of the attacked algorithm and have yet to demonstrate a complete availability at aatk that bring a model down to chance-level Zhhoo & Lao 2022 ; Lu
ct al. (022). Gradient attacks, on the other hand, have established effective ways of making model utterly useless. Blanchard al.] (2017) show how an omniscient attacker sending unconstrained gradients at each iteration can arbitrarily change the model's weights. Baruch et al. (2019) assume attacker with access to model's weights and fraction of the training set (similar to our awsiliary dataset). El-Mhamdi et al. (2020)
suppose an omniscient attacker or one that does not know the legitimate gradients. Finally, Liu et al. 2023
but also the degradation of performances is not as severe as in gradient attacks (Figure 3 in Liu et al.. (2023)
claim a data poisoning availability atlack, but they not only require a high poisoning ratio (al. least 80%)
In this work, we extend the domain of known availability attacks and demonstrate how they are possible in settings were the altacker knows the model weights and can craft data poisoning at each iteration in constrained set or not, similarly to Algorithm in Steinhardt et al. (0117) (Result A and B in subsection 5.3
Defenses against data poisoning have been studied through different approaches such as data sanitization Steinhardt et al. (2017). data augmentation Borgnia et al. (2021). bagging Waan et al. (0022) or pruning and fino-tuning Liu et al. (2018). Howover, the effectiveness of such defenses rely on strong assumptions such as the learner having access to a clean dataset, on the convexity of the loss w.r.l. the model's parameters or the learner's ability to train very large number of models. And still, attackers could find ways break these defenses Koh et al. (2022). Even if thcoretically sound and impenctrable defense mechanism against data poisoning might be impossible El-Mhamdi et al. (2023); Hardt et al. (2023). making the attacker's job harder by adding several imperfect yet constraining defenses in "Swiss cheese" like model is still necessary.
Inverting gradients has recently been sludied in privacy attacks to reconstruct training samples based on the resulting gradient Geiping et al. (2020a): Zhao et al. (2020). Their central recovery mechanism relies on maximizing a similarity measure Sim between a targeted gradient g(tat) that has been computed on the data y) (xa))s computed on Tyee reconst.uuctdd samples S and aggregated through the AGG function:
which the attacker wants reconstruct and the gradients G(ree) =
arg
Sim( Acc(G(ro)))
(1)
3/j
Similarly, we try to recover data points that induce the closest gradient possible to a malicious gradient. The existence of a solution for [1 in the privacy attack setting is known, since actual data points have given rise to the targeted gradient g (t99) More surprisingly, several works Geiping et al. (2020b); Bouaziz et al. (2025a) have shown that it is possible to construct data points whose gradients match targeted sample's gradient. On the contrary, gradient attacks are not actually calculated from a data point hence there is no guarantee that the inversion can find an existing solution.
3 Framework
3.1 Learning Setting
loss on a heldout test set Drest that is not necessarily sampled from the same distribution D as the training set. We formulate the objective as the following optimization problem:
arg min 8EB Nestt
Σ (z.g)
((ho(x),1)
2a ey cybersecurity defense model, see htt.:pp:///....tkkpa....oop/p/pp catee_cheeeeeeeeeee
4

---

Published in Transactions on Machine Learning Research (12/2025)
We consider that learning occurs through set of ny Grodient Generation Units {Vi)== each of which reports
message in a set S = MESSAGEL PDraann 1) = (rr,)= at each iteration t. Messages are then aggregated through an aggregator AgG and the model weights are updated using the UPDATE algorithm:
B+t1 = UPDATE((,, AGG, St))
This abstraction allows us to represent a large spectrum of learning settings, from centrolized learning fully distributed learning and settings in between (such as federated learning).
In the common centvalized selling, when training a neural network, the MESSAGE operator returns a batch of data points sampled from the training set S {(T,,) v1,,)) the aggregator AgG is the j=1
AVERAGE of their gradicnts, computed by the learner and the update algorithm is SGD or ADAM.
In the federated learning setting, the MESSAGE operator returns a batch of gradients (or equivalently model updates) that cach worker computed separately, the default aggregator is the AVERAGE of the messages and the update algorithm is TEDERATEDDVERRGEE McMahan et al. (2077 Stich 20188.
LOCALSGD
This allows to study a common framework for both gradient attacks and data poisoning attacks, normally operating different scttings, characterized by different MESSAGE operators. The choice for the MESSAGE operator boils down to entrusting the calculation of gradients to the workers not. This, in turn, gives different degrees of freedom for a malicious Gradient Generation Unit to influence the training: in the scope of this paper, respectively gradient attacks or data poisoning K
In our experiments, we consider an image classification task on the CIFAR10 dataset on which the attacker can tamper with messages (data point or gradient depending on the learning setting). We use the SGD and ADAM update algorithms as well as AVERAGE and MULTIKRUM [Blanchard et al. (2017) aggregators. MULTIKRUM/<00. is robust aggregator which can withstand ratio of malicious elements up to and is defined for set of vectors {u.) as the average of the n(1 f) - 2 vectors minimizing the score function si) = E,,, ||: 1), with i + the indices of the n11 - f) - closest vectors to U;.
The selection of the update algorithm and aggregator is crucial, as both are regarded as defense mechanisms in the Robust Distributed Learning literature El-Mhamdi et al. (020)).
3.2 Threat model
In order to study the expressivity of data poisoning in non-convex settings, we consider a worst-case threat model that allows for a fair comparison with gradient attacks. Here, the attacker:
has knowledge of the weights of the model O,, the update algorithm UPDATE, the aggregator AgG function and the message operator MESSAGE as in, Farhadkhani et al. (002) Blanchard et al. (017)
Yin et al. (2018); Shafahi et al. (2018);
does not have access to the batch 5 unlike the stronger standard assumption of omniscient attacker
in the robust distributed learning literature Blanchard et al. (2017) EI-Mhandi et al. 2020 ; Chen
et al. (2017); ; Yin el al.] (2018);
has access to an auxiliary dataset Da ~ D that is a surrogate to the unobservable training set. This a standard assumption when not assuming omniscient attackers, as in El-Mhamdi et al. 2018 ;
Farhadkhani al. (2022); El-Mhamdi al. (2020):
has the control over a ratio a of Gradient Generation Unils and the ability to append a set of arbitrarily crafted poisoned messages (gradients or data points) Sp = { to the clean batch
St at each iteration t up to a level a of contamination (i.e. | SUP = a), as in Blanchard et al.
Thee notion of Gradient Generation Units be used as abstraction for any source of input that itsclf gradient, model update, or that can be later transformed gradient, such training data point, machine distributed learning or user account. in social media platform, depending the level of granularity that is considered.
5

---

Published in Transactions on Machine Learning Research (12/2025)
Attacker
5
S
MESSAGE
Va L
atk
Vo
9t
otk
G
D
Dirain ~
Neural Network
hot
shup
Figure 3: Threat model. The attacker has access to 0 but does not have access to the batch St and uses an auxiliary dataset Da to craft S the set of poisoned messages. Both the batch and the poisons set are gathered into Stup. The attacker's goal is either to slow down the training or attack the model's availability.
2017); El-Mhamdi et al. (2018) Yin et al. (2018) for gradients attacks, in Steinhardt et al. 2017 for data poisoning or in Farbadkhani et al. (2022 for both gradients attacks and data poisoning:
constrains itsel to only crafting poison in feasible domain Sy E F"r, depending the task and data structure. For instance, for image classification task of H x W RGB pixels encoded 3 bytes and labels between 1 and C, we set F to be the set of possible such sized images and labels: F = [0..255] W x3, [1..C] as in Farhadkhaai et al. (2022). but without restricting ourselves to convex settings.
The attacker's goal is to perform availability attack: degrading the learner's performances much possible. We also consider slow down attacks, in which the attacker tries to stall the learning procedure much as possible. This attack is important, given the cost for training large models and the financial repercussion of slowing it down.
This threat model is inspired from gradient attacks and assumes much more communication between the attacker and the model than traditional data poisoning threat models. The latter leads to poor availability attacks performance. We hypothesized that once we allowed for the same amount of interactions between gradient attacks and data poisoning, the two methods would display far less discrepancy of destructive power than what is currently thought.
4 Method
At each iteration t, the attacker, controlling p Gradient Generation Units, computes an auxiliary batch ST MESSAGE(Da, and constructs Sº such that UPDATE(O,, AGG, ST US?) gives poorer performance on D. than UPDATE(O,, AGG, ST). This should, in turn, also decrease the model's performances Dirain under the assumption it follows the same distribution as De_
4.1 Gradient attacks
When the MESSAGE operator outputs gradients, malicious Gradient Generation Units can participate in St with gradient attack in Rd. At each iteration t, the attacker uses the auxiliary dataset D, surrogate
Result subsection obtained without this constraint and further understand expressivity of data poisoning from inverted gradient. attacks.
strongest result and is obtained under this constraint the attacker. Result B is 5.3 is

---

Published in Transactions on Machine Learning Research (12/2025)
for the batch Sp. Let St and oi = - na Egesp g the averaged auxiliary gradient. Similarly, g ny Egest 9 denotes the averaged clean batch gradient. The attacker constructs a set of ny attacking gradients G based on St and sends them as message Sp We denote s = St U Sy the set of poisoned batch of gradients, ST = St U. the set of poisoned auxiliary gradients and Dt dup and di aup their respective averages. We consider several gradient attacks to perform an availability attack.
(o L (z), ()) (a.y)e.. be the set of per-sample auxiliary gradients
Gradient Ascent (GA) Blanchard et al. (017): the attacker sends a gradient such that the averaged poisoned gradient is anti-collinear with the mean clean gradients. This provokes a gradient ascent step with the SGD update rule, AVERAGE, and X > 0:
5 [0++1] = 8: - 5 ( L
0: + s [
Orthogonal Gradient (OG): the attacker sends gradient such that the averaged poisoned gradient is orthogonal to the mean clean gradient. This should stall the training.
Little is Enough (LIE) Baruch et al. 2019 Shejwalkar & Houmansadr (021 the attacker sends the mean clean gradient deviated by a strategically chosen amount times the coordinate wise standard deviation of the clean gradients, with off-- = y /Var(folilbaesy
9t = 0t max σ
(2)
where
max E arg max =ER;
|| A
and
unU (S (oe 20 )0))))
A = AGG(
This attack has been shown to be effective against MULTIKRUM aggregator. Note that contrary to Baruch et all (2019) and similarly to (Sheewaalkrr & Houmansadr (2021), ; we use an adaptive approach and choose mar to maximize the divergence of the poisoned gradients on the aggregation Adup.
4.2 Data poisoning
When the MESSAGE operator outputs data samples, malicious Gradient Generation Units are expected participate via similarly structured messages, i.e. data poisoning. In our experiments, on CIFAR10 and its 32 x 32 RGB images, it leaves room for attacker to participate in the training process via messages crafted in [0, 25525553222 32x333x3 This gives only 32 x 32 x 3 = 3, 072 degrees of freedom, far less than commonly used deep learning models' number of parameter, hinting that data poisoning should be less expressive than gradient attacks. Models' non-linearities further constrain the dimension of the image space of the gradient operator (as illustrated in Figure Dp. Data poisoning is allegedly harder as it constitutes a far more constrained problem than gradient attacks (in which the attacker can send an arbitrary gradient from Rd).
At each iteration 1, the attacker computes given gradient attack gith in the same manner as above and inverts the gradient operator to compute an associated set of data points SP {( "e,",, He such that Dn Vo, T.ho, (xf,), vi,)) = th That set of data points is then sent as message S and appended to St. like in the gradient attack case. Similarly to what is done in privacy attacks, we optimize a similarity measure between the gradient attack and the gradients calculated on S.. Contrary to privacy attacks where the existence of a solution is known there is no guarantee that the inversion can find an existing solution, let alone an effective data poison.
We can formulate our data poisoning ing function fp. fp characterizes the dissimilarity of the data poison gradients G. (V,, [ho (œ), v) (
optimization problem where the attacker aims to minimize a poison-
Tnn privacy attacks, the gradient being inverted was produced by the data point that the attacker trying retrieve.
7

---

Published in Transactions on Machine Learning Research (12/2025)
with a gradient attack 9hth calculated from the auxiliary dataset gradients Gī (Vo, (a)))) (since the attacker cannot have access to the batch (t) over a feasible domain F:
St E arg min Salho, 5) SE
(3)
Since characlerizing the image space of the gradient operator on the loss function L is a diffieult task, we canmot know beforehand if a vector can have an antecedent data point through the gradient operator. Together with constraints on feasibilitt, finding data poisons which exactly reproduce the gradient attack S (h), S R the set Zv might not
might be impossible. Since Ivz Ve, cover all the possible candidates for an effective gradient attack, not any (Figure 2). Thus, achieving an effective data poisoning that performs similarly to a gradient attack is non trivial.
We show in our experiments that an attacker can still produce data poisons which have significant impact the training procedure. Poisons are iteratively updated to minimize the poisoning objective fp using the Adam optimizer and are projected the feasible set F at cach itcration of the poisoning optimization by clipping. Table [ details the formulas used to determine the gradient allacks and their equivalent poisoning functions in the data poisoning case.
Table I: Gradient attacks formula and their equivalent data poisoning objective functions to be optimized following Equation 3 """.g"."uuu are respectively the averaged gradients computed on the data poisons, on the auxiliary dataset, and the weighted average between them. cos is the cosine similarity. mar and are defined as in eq. 2
Gradient attack 9d E Rdd s.t.
Our data poisoning attack
Fp
Gradient Ascent
cos(g gg")) = -1
cos (g OOO gg
Orthogonal Gradient
(guuup .ga)) 0
|cos (g oup ,g²) )²2
Little is Enough
9" = g mag x o
g|" 9 + mar 0ll²
5
Experiments
5.1
Preliminary experiment
To give a better intuition of the capabilities of data poisoning, we present a preliminary experiment on the XOR operator classification task. Sampling a point x in [0, 1J2, its label is y = 1 [= > 0.5} @ 1 [x[11] > 0.5} with 1 the indicator function and @ the XOR operator. We generate a set of possible poisons by regularly sampling on the [o, 1J2 grid and labeling them with XOR then flipping their labels. After training a multilayer perceptron with Gradient Descent (i.e. full batch) on 1000 data points, we perform single step of gradient descent on the data poisoned with one of the possible poisons, repeated as to reach contamination level a.
The resulting lest accuracies obtained for all poisons are illustrated in Figure
While a single step at a = 0.005 is not enough to reduce the model accuracy down to random-chance several steps of poisoned update will do. A 10% level of contamination is already enough to bring the model close to the level of random guess, which suggests that a single step on poisoned data is enough to obtain an availability attack on neural network for a task such XOR. This proof of concept could however be argued to require a high contamination ratio. We exhibit experimental evidences that lower contamination ratio can actually be effective on, e.g. an image classification setting.
5.2 Experimental setup
Model & dataset We demonstrate our poisoning procedure on a custom convolutional neural network (described in Table 5 in Appendix B) and on Vision Transformers models (ViT-tiny models with patch size 8) trained for 50 epochs on the CIFAR10 dataset partitioned in training, validation, and auxiliary datasets. We use different optinization algorithms and aggregation rules to train the models: SGD & AVERAGE,
8

---

Published in Transactions on Machine Learning Research (12/2025)
0.005
0.100
1.2
1.00
1.00
Min. poisoned accuracy
Minimum accuracy
Random
0.6
0.6
0.4
0.4
0.8
0.6
0.2
0.0
0.5
1.0
0.98
0.2
0.0
0.5 1.0
0.54
0.025 0.050 0.075 0.100
X2
XL
Figure 4: Landscape of accuracies after 1 poisoned step with the respective poison with two levels of contamination = 0.005 (left) and = 0.1 (center). The black squares represent the border of the feasible domain F. Right: The minimmm accuracy in the landscape for different levels of contamination a.
ADAM & AVERAGE, SGD & MULTIKRUM (with different levels of data truncation f (.21, Since MULTIKRUM is used defense mechanism, expect it to be robust to the attacks operating within its working assumptions. However, the Little is Enough attack was specifically designed to circumvent these assumplions when using gradient attacks. We thus expect Little is Enough to bypass MULTIKRUM in the gradient attacks situation.
Baseline In every setting, the learning rate is fixed to the value were the learner achieves the best performances without any poisoning to set a baseline for the performances of the model. We then measure the docay in performances caused by an attack. Each sctting of this experiment rum times for better statistical significance. Each run has different model and poisons initialization, and dataset split. Full results can be seen in the Appendix.
Attacks In every setting, we perform either one of the considered allacks either via gradient attack, or data poisoning attack as specified in section 4.2 The npp crafted poisons are added to the batch of size ns at cach iteration so that Mi = a E [0.01, 0.48 Since the gradients induced by the poisoned data mimic mat#
the malicious gradients, expect our data poisoning is at best good as the associated gradient attack. Gradient attacks should thus be a topline for our data poisoning attack.
5.3
Results
5.3.1
Gradient attacks
Table shows that gradient attacks do perform an availability attack, bringing the models' performances down random-lovel. We also notice that the MULTIKRUM aggregation rule does as a defense mechanism, for levels of contamination lower than its tolerance parameter f. However, expected, this defense is well circumvented by the Little is Enough attack.
5.3.2 Data poisoning
After performing the equivalent data poisoning atlacks, the observed effects range from a slowdown of the training procedure to its complete halt and up to degrading the performances down random levels. Figure 5a comparcs the different attacks with random data poisoning (uniformly sampled in [0, a 0.01 with its baseline counterpart. While the Gradient Ascent and Orthogonal allacks behave similarly and at most only slightly slow down the training at most, Little is Enough attack strongly degrades performances, even at such low levels of contamination. Figure 5b shows for the Gradient Ascent and Little is Enough attacks that the higher the level of contamination, the stronger the effect: validation accuracy increases slower or plummets earlier. Therefore, our main result is the following.
Availability attacks (Result A). To fairly compare each setting under that attack, each model has been evaluated the test set with the weights achieving the best validation accuracy. Figure T shows that for

---

Published in Transactions on Machine Learning Research (12/2025)
Table 2: Best validation accuracy under different attacks with different update rules, different aggregation functions and different levels of contamination a. A high validation accuracy (colored in apricot) indicates failed attack. A low validation accuracy (colored in pale green) indicates a successful attack.
UPDATE; AGG
Attack
0.01
0.05
0.10
0.20
0.30
0.40
0.48
GA
10.0
9.8
10.0
10.0
10.0
10.1
10.0
ADAM;
OG
9.9
9.9
10.1
10.1
9.8
10.0
10.1
AVERAGE
LIE
10.2
10.3
10.1
10.2
10.1
10.1
10.0
GA
10.1
10.1
10.1
9.9
10.0
10.0
10.0
SGD;
OG
10.2
10.2
10.0
9.9
10.1
10.1
10.2
AVERAGE
LIE
10.2
9.9
10.2
9.9
9.9
10.0
10.0
GA
65.1
63.2
33.7
10.1
10.1
10.2
10.2
SGD;
OG
65.1
65.3
65.9
10.0
10.1
10.2
9.9
MULTIKRUM/=011
LIE
41.7
15.0
10.4
9.9
10.0
9.9
10.1
1itte Fhange
0.56
AStaCC
(a) Comparison of different attacks at 0.01.
(b) Comparison of different levels contamination for the Gradient Ascent & Little is Enough attacks.
Figure 5: Validation accuracies during training in the SGD & AVERACE setting under different attacks and different level a of contamination. Error bars represent the standard error.
the SGD AVERAGE learner under the Little Enough attack, a 0.01 is enough significantly degrade the model's performance. Among the 4 runs, ended up diverging while every poison was in the feasible set F. Figure g in the Appendix shows 50 of the first 500 poisons crafted by the attacker in one of the diverging run. Similarly, in the SGD & MULriKRUM setting, the Little is Enough attack with contamination level = 0.05 finds data poisons that circumvent the robust aggregation rule and drastically reduce the model's performance.
Table 3: Epoch of best validation accuracy (validation accuracies in parenthesis) for the CNN model with ADAM optimizer and AVERAGE under different data poisoning attacks. Higher levels of contamination induce slower training and lower performances.
GA
OG
LIE
0
4 (67.1)
4 (67.1)
4 (67.1)
0.01
5 (66.4)
5 (66.4)
6 (66.3)
0.05
7 (66.5)
7 (65.3)
7 (66.3)
0.1
19 (63.6)
14 (63.9)
10 (65.7)
0.2
34 (61.2)
17 (62.5)
22 (62.1)
10

---

Published in Transactions on Machine Learning Research (12/2025)
Table Poison selection rates the SGD & MULTIKRUM/=o. averaged over all runs and all epochs. Each row corresponds to different attack. Standard deviations in parenthesis.
a
0.01
0.05
0.2
0.0
2 10-1
2 X 10-3
0.91
GA
(0.0)
(4 x 10
(2 x 10
(0.08)
0.0
3 x 10
0.18
0.85
OG
(0.0)
(1 x 10-3)
(0.1)
(0.05)
0.92
0.91
0.97
0.87
LIE
(0.07)
(0.13)
(0.02)
(0.06)
Comparison of update rules. Figure shows that our data poisoning procedure failed at performing an availability attack against the ADAM update rule. Because ADAM normalizes the aggregated gradients, the training cannot diverge as abruptly as with SGD. However, the slow down attack can still be observed (e.g. in Figure in Appendix B meaning that the data poisoning procedure could find a solution that perturbs the total gradient enough to slow down convergence, but not enough to completely halt it. Table 3 shows that higher levels of contamination lead to a lower best validation accuracy but most importantly to a higher number of epochs (hence a longer time) before reaching it.
Figure 6: Test accuracy of the CNN model which achieved the best validation accuracy under the Little is Enough attack. Each column represents different setting of update function and aggregation rule. The blue line is the test accuracy obtained with (SGD, AvERAGE) setting and no attack. Error bars are the standard errors.
Data poisoning against a robust aggregation rule Table shows that with the MULTIKKUMM=o. aggregation rule, the attacker still manages to have some of its messages not filtered out. For a > f. the aggregation rule does not play defensive role anymore as per its functioning conditions. On the other hand, for a below this point, the Little is Enough attack displays significantly higher selection rates than the other attacks. This means that the attacker manages to produce data poisons whose gradients deceive MULTIKRUM/=O.11 similarly to the gradient version of the attack which is particularly designed for this purpose. However Figure i shows that a higher selection rate does not necessarily mean success of attack. Even if the attacker sometimes manages successfully attack the model, MULTIKRUM overall enhances the robustness of the model while slightly degrading its performances.
Influence of the feasible set (Result B). As the feasible set Fx changes, the altacker will only be allowed to converge (in case of convergence) towards different poisons. We compare three increasingly restrictive feasible sets to determine their influence on the success of the attack:
Constraint-free set.: the feasible set is simply the input domain Fx = R x3
Image-encoding set: the feasible set ensures that the poisons respect the same encoding as the clean data Fximg = [5.. XX "xW x3, and
Neighborhood set: this subset of the previous one and is composed of all the images that are L11 norm of at most 32 of an actual image Fxnci {ar Fximg D.s.I. || xalli c).
11

---

Published in Transactions on Machine Learning Research (12/2025)
Plac 120
001
0.35
32
04
0.15
08
0.05
03
3.18
0.1
0.1
32
(a) Fxtrre
(b) Fxing
(c) Fxuel
Figure 7: Final test accuracies for the SGD; AVERAGE setting under the Little is Enough attack for different. feasible sets. Error bars are the standard errors.
Figure 7 shows that the more constrained the feasible set, the less effective the resulting attack. It is important to note, however, that early stopping helps in limiting the effects of the attack (Figure 10 Appendix B
Neural Network architecture. We perform the same al Lacks on the same learning pipelines replacing the CNN with a Visual Transformer (ViT, Dosovitskiy al. (2020)) tiny with patch size 8. Since ViTs are predominantly trained using ADAM-like approaches, we report the efficiency of our attacks using it. Figure in the Appendix shows that ViTs are also vulnerable to our data poisoning, although with less success and on higher levels of contamination.
6 Discussion
Our work shows that even in training settings involving deep neural networks, which are not restricted to convex cases as in Farhadkhani et al. (2022), inverting malicious gradients can result in an effective data poisoning, achieving an availability atlack, and mimicking the harm of gradient atlacks. To compare both type of attacks, our threat model uses assumptions that differ from the common threat model in data poisoning, making it an impractical threat model for now. These assumptions should be further explored in future work on at least four different fronts. (1) The role of the auxiliary dataset. Further experiments should consider auxiliary dataset with distribution different than the training set or auxiliary dataset. at all. (2) Accessing the trained model's weights. Performing
attack when the attacker estimates the victim's 's model with surrogate model would make the threat model more practical.
(3) The role of the feasible set. Clean label poisoning (Geiping et al.) 2020b Shafahi et al. 2018) shows that it is possible to design data poisons which deceive human annotators by resembling logitimate images. Future work should consider exploring more constraining feasible sets for the altacker to reach such level of hiness (4) Number of interventions. In our threat model, similarly to Farhadkhani al. (2022) the attacker is allowed craft and inject malicious data at each iteration, which limits the practicality of our threat model, future work should explore data poisoning availability attacks limiting also the number of times the attacker can craft its poisons (the common data poisoning threat model only allows single intervention).
7 Conclusion
Our work asks whether not gradient attacks were fundamentally more effective than data poisoning, Our experiments yicld a nuanced response. On one hand, inverting malicious gradients sometimes results in a devastating data poisoning, and our results are the first to show the leasibility of a total availability atlack on neural network via data poisoning. On the other hand, the success rate of our data poisoning attacks is lower than for their gradient attack counterparts, but the mere possibility of mimicking gradient attacks with feasible data poisoning should motivate further research in defense mechanisms for attacks that evade today's state of the art defense in robust machine learning.
12

---

Published in Transactions on Machine Learning Research (12/2025)
8 Broader Impact Statement
This paper presents work whose goal is to advance the field of Robust Machine Learning. There are many polential societal consequences of our work, all of which fall under the usual considerations to take into account when considering tools that can facilitate data poisoning or make it more potent. In particular, our technique of inverting gradients aims at showing that availability attacks which were believed to be specific to gradient attacks except for convex settings are doable with data poisoning alone, and in small amount.
References
Gilad Baruch, Moran Baruch, and Yoav Goldberg. little is enough: Circumventing defenses for dis learning. Advances in Neural Information Processing Systems, 32, 2019. URL https://arxiv: org abs/
1902.06156
Battista Biggio, Blaine Nelson, and Pavel Laskov. Poisoning attacks against support vector machines, 2013,
Peva Blanchard, El Mahdi El Mhamdi, Rachid Guerraoui, and Julien Stainer. Machine learning with adversaries: Byzantine tolerant gradient descent. Advances in neural information processing systems, 30, 2017.
Eitan Borgnia, Valeriia Cherepanova, Liam Fowl, Amin Ghiasi, Jonas Geiping, Micah Goldblum, Tom Goldstein, and Arjun Gupta. Strong data augmentation sanitizes poisoming and backdoor attacks without an accuracy tradeofT. In ICASSP 2021-2021 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), pp. 3855 3859. IEEE, 2021.
Wassim Bouaziz, Nicolas Usunier, and Fl-Mahdi FI-Mhamdi. Data taggants: Dataset ownership verification via harmless targeted data poisoning, In ICLR 2025 The Thirteenth International Conference on Learning Representations, 2025a.
Wassim Bouaziz, Mathurin Videau, Nicolas Usunier, and El-Mahdi El-Mhamdi. Winter soldier: Backdooring language models at pre-training with indirect data poisoning. arXiv preprint arXiv:2506. 14918, 2025b.
Wassim Wes Bouaziz, El-Mahdi El-Mhamdi, and Nicolas Usunier. Targeted data poisoning for black-box audio datasets ownership verification. In ICASSP 2025-2025 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), pp. 1-5. IEEE, 2025c.
Nicholas Carlini, Matthew Jagielski, Christopher Choquette- Daniel Paleka, Will Pearce, Hyrum Anderson, Andreas Terzis, Kurt Thomas, and Florian Tramér. Poisoning web-scale training datasets is practical. arXiu preprint arXim:2302.101 2023. URL https://arxiv.. www.ooggg/ao.o....ooooo /20ess/2222.20 2004.10149
Paul Charon and Caan-Bapistte Jeangène Vilmer. Chinese influence operations: machiavellian moment. Report by the Institute for Strategic Research (IRSEM), Paris, Ministry for the Armed Forces, 2021.
Yudong Chen, Lili Su, and Jiaming Xu. Distributed statistical machine lcarning in adversarial scttings: Byzantine gradient descent. Proceedings of the ACM on Measurement and Analysis of Computing Systems, 1(2):1-25, 2017.
Alexey Dosovitskiy, Lucas Beyer, Alexander Kolesnikov, Dirk Weissenborn, Xiaohua Zhai, Thomas Unterthiner, Mostafa Dehghani, Matthias Minderer, Georg Heigold, Sylvain Gelly, et al. An image is worth 16x16 words: Transformers for image recognition at scale. arXiv preprint ar arxiv:2010. 11e.9.199.. 2020.
El-Mahdi El-Mhamdi, Rachid Guerraoui, and Sébastion Rouault. The hidden vulnerability of distributed learning in byzantium. In International Conference on Machine Learning, pp. 3521 3330. PMLR, 2018.
El-Mahdi El-Mhamdi, Rachid Guerraoui, and Sébastien Rouault. Distributed momentum for byzantine- resilient. learning. arXie preprinl ar arXiv:2003.0001 2020.
El-Mahdi El-Mhandi, Sadegh Farhadkhani, Rachid Guerraoui, Nirupam Gupta, Lê-Nguynn Hoang, Rafacl Pinot, Sébastien Rouault, and John Stephan. On the impossible safety of large ai models. 2023.
13

---

Published in Transactions on Machine Learning Research (12/2025)
Sadegh Farhadkhani, Rachid Guerraoui, Oscar Villemand, et al. An equivalence between data poisoning and byzantine gradient attacks. Tn International Conference on Machine Learning, pp. 6284-6323, PMTR, 2022.
Jonas Geiping, Hartmut Bauermeister, Hannah Dröge, and Michael Moeller. Inverting gradients-how easy is it to break privacy in foderated learning? Advances in Neural Information Processing Systems, 33: 16937-16947, 2020a.
Jonas Geiping, Liam Fowl, W Ronny Huang, Wojciech Czaja, Gavin Taylor, Michael Moeller, and Tom Gold- stein. Witches' brew: Industrial scale data poisoning via gradient matching. arXiv preprint Xiv:20000 02276, 2020b.
Moritz Hardt, Eric Mazumdar, Celestine Mendler-Dünner, and Tijana Zrnic. Algorithmic collective action in machine learning. In International Conference on Machine Learning, pp. 12570 12586. PMLR, 2023.
Lê-Nguyén Hoang, Louis Faucon, Aidan Jungo, Sergei Volodin, Dalia Papuc, Orfeas Liossatos, Ben Crulis, Mariame Tighanimine, Isabela Constantin, Anastasiaa Kucherenko, et al. Tournesol: A quest for large, secure and trustworthy database of reliable human judgments. arXiv preprint or #rXin:2107.0030 2021.
W Ronny Huang, Jonas Geiping, Liam Fowl, Gavin Taylor, and Tom Goldstein. Metapoison: Practical general-purpose clean-label data poisoning. Advonces in Neural Information Processing Systems, 33: 12080 12091, 2020.
Pang Wei Koh, Jacob Steinhardt, and Percy Liang, Stronger data poisoning attacks break data sanitization defenses. Machine Learning, pp. 1-47, 2022.
Leslie Lamport, Robert Shostak, and Marshall Pease. The byzantine generals problem. ACM Thans. Program. Lang. Syst., 4(3):382-40) jul 1982. ISSN 0164-0925. doi: 10.1146//3777723357776, URL
/etps:///oi... org. 10.
Kang Liu, Brendan Dolan-Gavitt, and Siddharth Garg. Fine-pruning: Defending against backdooring attacks on deep neural networks. In International symposium on research in allacks, intrasions, and defenses, pp- 273 294. Springer, 2018.
Yiyong Liu, Michael Backes, and Xiao Zhang. Transferable availability poisoning attacks. arXiv preprint 2rXiv:2310.05144 2023.
Yiwei Lu, Gautam Kamath, and Yaoliang Yu. Indiscriminate data poisoning attacks neural networks ArXie, abs/2204.09092 2022. URL https://api. semanticscholar org/CorpusID :tt//ooppuuII:222667722222 248266720
Alexandra Luccioni and Joseph Viviano. What's in the box? an analysis of undesirable content in the common crawl corpus. In Proceedings of the 59th Annual Meeting of the Association for Computational Linguistics and the 11th International Joinl Conference on Natural Language Processing (Volume 2: Short Popers), pp. 182 189, 2021.
Brendan McMahan, Eider Moore, Daniel Ramage, Seth Hampson, and Blaise Aguera y Arcas. Communication- efficient learning of deep networks from decentralizod data. In Artificial intelligence and statistics, pp. 1273 1282. PMLR, 2017.
Luis Gonzáázz,, Battista Biggio, Ambra Demontis, Andrea Paudice, Vasin Wongrassamee, Emil C Tupu, and Fabio Roli. Towards poisoning of deep learning algorithms with back-gradient optimization. Tn Proceedings of the 10th ACM workshop on artificial intelligence and security, pp. 27 27-38, 2017.
Luis Muñoz González, Bjarne Pfitzner, Matteo Russo, Javier Carnerero-Cane and Emil C Lupu. Poisoning attacks with generative adversarial nets. arXiv preprint XrXii:1906.07777 2019.
Rui Ning, Jiang Li, Chunshong Xin, and Hongyi Wu. Invisible poison: A blackbox clean label backdoor attack deep neural networks. In IEEE INFOCOM 2021-IEEE Conference on Computer Communications, pp. 1-10. TEFF, 2021.
14

---

Published in Transactions on Machine Learning Research (12/2025)
Christoph Schuhmann, Romain Beaumont, Richard Vencu, Cade Gordon, Ross Wightman, Mehdi Cherti, Theo Coombes, Aarush Katta, Clayton Mullis, Mitchell Wortsman, et al. Laion-5b: An open large-scale dataset for training next generation image-text models. Advances in Neural Information Processing Systems, 35:25278-25285 2022.
Ali Shafahi, W Ronny Huang, Mahyar Najibi, Octavian Suciu, Christoph Studer, Tudor Dumitras, and Tom Goldstein. Poison frogs! largeted clean-label poisoning altacks on neural networks. Advunces in newral information processing systems, 31, 2018.
Virat Shejwalkar and Amir Houmansadr. Manipulating the byzantine: Optimizing model poisoning attacks and defenses for foderated learning. Proceedings 2021 Network and Distributed System Security Synposium, 2021. URL
Virat Shejwalkar, Amir Houmansadr, Peter Kairouz, and Daniel Ramage. Back to the drawing board: A critical evaluation of poisoning altacks on production federated learning. In 2022 IEEE Symposium on Security and Privacy (SP), pp.
IEEE, 2022.
Jacob Steinhardt, Pang Wei W Koh, and Percy S Liang. Certified defenses for data poisoning attacks. Advances neural information processing systems, 30, 2017.
Sebastian U Stich. Local sgd converges fast and communicates little. arXiv preprint arXiv:1805.0919 2018.
Onur Varol, Emilio Ferrara, Clayton Davis, Filippo Menczer, and Alessandro Flammini. Online human- bot interactions: Detection, estimation, and characterization. In Proceedings of the international AAAT conference web and social media, volune 11, pp. 280 289, 2017.
Wenxiao Wang, Alexander J Levine, and Soheil Feizi. Improved certified defenses against data poisoning with (deterministic) finite aggregation. In International Conference on Machine Learning, pp. 22769-22783.
PMTRR 2022.
Cong Xie, Oluwasammi Koyejo, and Indranil Gupta. Fall of empires: Breaking byzantine-tolerant sgd by inner product manipulation. In Uncertainty Artificial Intelligence, pp. 261-270. PMLR, 2020.
Dong Yin, Yudong Chen, Ramchandran Kannan, and Peter Bartlett. Bymantine-robust distributed learning: Towards optimal statistical rates. In International Conference on Machine Learning, pp. 5650 5659. PMLR, 2018.
Bingyin Zhao and Yingjic Lao. CLPA: Clean-Label Poisoning Availability Attacks Using Generative Adversarial Nets. In Proceedings of the AAAI Conference on Arlificial Intelligence, volume 36, pp. 9162 9170, 2022. doi: 10.1609/ v3iaa..i....i..2... 23618.20902. URL https://ojs. www.aaaiiiaaaaaaaaaaaaa org/index.oo pttpp//AA///ttiic///e///////////
Bo Zhao, Konda Reddy Mopuri, and Hakan Bilen. idlg: Improved deep leakage from gradients. arXie preprinl ar 2011:22001.06610, 2020.
15

---

Published in Transactions on Machine Learning Research (12/2025)
Appendix
A Discussion on realistic values of a
Machine Learning practitioners process data scraped online Luccioni & Viviano (2021): Schuhmann al. 2022) or sent by users and trust their resulting models Hoang al. (2021). Since data poisoning has proven to be practical in real case scenario Carlini et al. (2023), we should treat models trained on scrapped collaborative datasets with as much precaution
untrustworthy data. A few redditors unpurposefully obtained dedicated token in GPT-3's tokenizer by artificially inflating their online presence on the platform by massively posting over 160k posts on the "r/counting" subreddit on which people simply count [d] Even worse, these data can potentially be sent by malcvolent agents who can thus influence the models by legitimately participating to these data sources.
Estimating realistic value for a is difficult since the point for attackers to not be detected. Since bots represent non-negligible part of online users (between 5% / and 15% Varol al. (2017) Twitter), we could expect the ratio of stealthy malevolent agents to be somewhat similar (il not higher). "Armies" as large as 2 million full-time individuals Charon & Vilmer 2021] could be conducing campaigns on social media (each individual manually steering tens of social media accounts to escape automateed-actiiity detection). Collaborative datasets like Wikipedia Carlini et al. (2023) could already be stealthily poisoned. As such, we should not only presume that data we train on might. have been poisoned, we should also consider the contamination ratio be much higher than fraction of percent. In this work, we considered wide range up to the extreme case of = 0.48
We chose to solve the poisoning optimization problem with gradient-based approaches which are computa- tionally intense, limiting us in experimenting with larger models and datasets. Stronger gradient attacks that only require to steer the model in a direction only slightly dissimilar from honest gradients should also be explored to increase the chances for a stealth data poison to exist and to improve the attack success rate. Stronger or less computationally expensive data poisoning approaches (that may not rely on gradient attacks) can be experimented to enhance the attack success rate. While the tested defense mechanisms for the gradient case appear to generalize and defend against data poisoning, it has been shown that the latter can bypass certain defense mechanisms Koh et al. (2022) and that robust mean estimation only works up to certain point El-Mhamdi et al. (2023). This leaves room for potentially devastating data poisoning that can bypass defenses while mimicking an unstoppable gradient atlack.
B Complementary Figures and Tables
Table 5: Architecture of the 1.6M parameters convolutional neural network used for our experiments.
Layer
# of channels
kernel
stride
Conv2d
32
5 x 5
2
ReLU
Conv2d
64
5 x 5
2
ReLU
Linear
512
ReLU
Linear
64
ReLU
Linear
10
(SolidGGoldMaggikarp (plus, prompt generation)
16

---

Published in Transactions on Machine Learning Research (12/2025)
30
0.01
40
0.18
Epoch
Epoch
Figure 8: Validation accuracies of the CNN during training with the SGD and ADAM update rule with the AVERAGE aggregation function under the Gradient Ascent attack. This data poisoning manages to slow down the training but not degrade the model's performance to random levels. Error bars represent the standard error.
Figure 9: 50 of the first 500 poisons crafted in the (SGD & AVERAGE, Little is Enough, = 0.01) setting.
17

---

Published in Transactions on Machine Learning Research (12/2025)
70
70
Best
Best
10-
10-
C'
(a) Fxtree
(b) Fxing
Uest cast arcuracy
20-
1100
1101
0.1
0.5
0488
0c
(c) Fxtei
Figure 10: Best test accuracies for the SGD; AVERAGE setting under the Little is Enough attack for different. feasible sets.
Ou Crihogonal Gradiont
Little Enouyss
0.01
Wastatin
0.05
20-
0.0
0.91
035
0.1
62
0.01
845
03
02
0.3
20
Eboch
(a) Availability attack.
(b) Slow down attack.
Figure 11: Visual Transformer (ViT) tiny with patch size under different attacks. Little is Enough performs a slow down attack whereas Gradient Ascent and Orthogonal Gradient are able to perform an availability atlack for high enough contamination levels a.
18


Reviews:
[{"review_id": "ikvY9pfBVM", "reviewer": "Reviewer_rVzR", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "This paper shows that data poisoning can replicate the harm of gradient attacks via gradient inversion in non-convex neural networks. The authors propose a threat model in which the attacker can inject poisoned samples at every training iteration, and they empirically demonstrate the effectiveness of data poisoning under different gradient attack strategies. Although the setup is idealized (assuming the attacker knows the model and weights at each iteration), it shows that data poisoning can achieve results comparable to gradient attacks in the worst-case scenario.", "claims_and_evidence_yn": "Yes", "claims_explanation": "The authors provide thorough empirical results through carefully designed experiments on CIFAR10 using both CNN and ViT-tiny. The results show that data poisoning crafted via gradient inversion can degrade model performance. They demonstrate that such attacks can achieve effects comparable to gradient attacks, supporting the claims made in the paper.", "audience_yn": "Yes", "audience_explanation": "The paper studies whether data poisoning can achieve effects similar to gradient attacks in non-convex neural network settings. Its findings on gradient inversion and worst-case attacks will be of interest to researchers studying model robustness, security, and privacy.", "requested_changes": "The motivation could be a bit clearer. It would help if the authors explained why showing that data poisoning can match gradient attacks matters in practice. For instance, the author could discuss real-world implications, like how understanding the limits of data poisoning can help evaluate AI system security or guide the design of more robust models. Making these connections clearer would show the study’s relevance and broader impact.", "broader_impact_concerns": "No concern.", "additional_comments": "", "extra_scores": {}, "extra_text": {}}, {"review_id": "5lIAKBMO1e", "reviewer": "Reviewer_SQoY", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "This paper investigates the effectiveness of privacy attacks, specifically gradient-based attacks and data poisoning. To facilitate comparison, the authors introduce a novel attack model and demonstrate that data poisoning attacks can replicate the behavior of gradient-based counterparts. These findings point to new research directions concerning the robustness of machine learning algorithms.", "claims_and_evidence_yn": "Yes", "claims_explanation": "The Authors present carefully designed experiments that align with their proposed attack model. While certain assumptions in the attack model may be somewhat unrealistic, the results remain valid and valuable as a proof of concept.", "audience_yn": "Yes", "audience_explanation": "This work is relevant for ML research, especially in the areas of robustness and privacy.", "requested_changes": "The assumptions underlying the attack model appear somewhat impractical. It would be valuable to investigate the extent to which these assumptions influence the attack’s effectiveness.\n\n- Analyzing how changes in the distribution of the auxiliary dataset (when diverging from the training data) impact attack success would provide further insights.\n\n- Visualizing the poisoned data generated through gradient-based modifications could help assess their realism. For instance, do these examples appear plausible, or could such attacks be mitigated simply by removing outliers (assuming the distribution of poisoned data differs from that of the training data)?", "broader_impact_concerns": "N/A", "additional_comments": "", "extra_scores": {}, "extra_text": {}}, {"review_id": "2hZ7zdKhF2", "reviewer": "Reviewer_C5Be", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "The paper argues that data poisoning can match the harm made by gradient attacks in non-convex settings. The authors provide positive answers through numerical experiments on (non-convex) neural networks by inverting malicious gradients into feasible training examples at each iteration for three gradient attacks: Gradient Ascent, Orthogonal Gradient, and Little is Enough.", "claims_and_evidence_yn": "Yes", "claims_explanation": "The authors provide empirical evidence through numerical experiments.", "audience_yn": "Yes", "audience_explanation": "This paper bridges the gap between data poisoning and gradient attacks in non-convex settings to some extent.", "requested_changes": "(1) From the introduction, I am not motivated by the idea of matching the harm of data poisoning to the harm of gradient attacks.\nWhy are we studying this, and what can this result bring?\n\n(2) The attacker needs per-iteration poisoning with access to current weights, which is much stronger than standard data poisoning requirements. Can the authors provide realistic justifications? This is also not clear for the claim: \"as low as 1%\" since $\\alpha$ is chosen per iteration.", "broader_impact_concerns": "No Concern.", "additional_comments": "", "extra_scores": {}, "extra_text": {}}, {"review_id": "zARxKb8Y1L", "reviewer": "Reviewer_Xoxo", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "Summary:\nThis paper proposes a novel and effective method for data poisoning attacks on non-convex neural networks. The core contribution is the idea of using gradient inversion (a technique typically associated with privacy attacks) to craft powerful data poisons. The authors demonstrate that by first designing a malicious gradient (as in a standard gradient attack) and then inverting it to find a corresponding data point, they can create a poisoning attack that effectively mimics the devastating impact of a direct gradient attack.\n\nThis approach allows them to perform a worst-case availability attack, successfully degrading a model's performance to the level of random guessing with as little as 1% poisoned data. The paper establishes a threat model that enables a direct and fair comparison between the capabilities of data poisoning and gradient attacks by allowing the attacker to intervene at each training iteration.\n\nStrengths:\n\nThe connection drawn between gradient inversion, gradient attacks, and data poisoning is a creative and significant contribution to the field of adversarial machine learning.\n\nThe authors provide comprehensive experiments on CIFAR10 with both CNN and Vision Transformer architectures, showing the attack's effectiveness against different optimizers (SGD, ADAM) and a common defense mechanism (MultiKrum).\n\nThe paper is well-structured and clearly articulates the problem, the proposed method, and the experimental results.\n\nWeaknesses:\n\nThe assumption that an attacker can inject poisons at every training iteration and has full knowledge of the model's weights is a significant one and may not be practical in all real world scenarios.\n\nWhile testing against MultiKrum is valuable, the evaluation would be more robust if it included a broader range of modern data poisoning defenses.", "claims_and_evidence_yn": "Yes", "claims_explanation": "The claims are well-supported by a thorough set of experiments. The authors convincingly demonstrate that their method can achieve an availability attack, a feat that has been difficult to accomplish with previous data poisoning techniques in non-convex settings.\n\nThe results consistently show that the attack can reduce model accuracy to random-chance levels (around 10% on CIFAR10), which is a clear indicator of a successful availability attack.\n\nThe attack is shown to be effective even with a very small fraction of poisoned data (e.g., 1-5%), highlighting its potency.\n\nThe attack is shown to be effective against both SGD and ADAM optimizers. Crucially, the \"Little is Enough\" variant of the attack successfully circumvents the MultiKrum robust aggregation defense, which is a strong piece of evidence for its effectiveness.\n\nThe paper includes an analysis of how the attack's success is influenced by the constraints on the feasible set of poisons, which adds credibility to the results.", "audience_yn": "Yes", "audience_explanation": "The findings of this paper would be of significant interest to the TMLR audience, particularly researchers and practitioners in machine learning security, robustness, and privacy. The paper addresses a fundamental question in adversarial ML that is, are gradient attacks fundamentally more powerful than data poisoning? By showing an equivalence in destructive capability (under their threat model), the authors challenge a common assumption and open up new avenues for both attack and defense research. The novel use of gradient inversion for this purpose is a clever technique that will likely inspire further work in this area.", "requested_changes": "The paper would be significantly strengthened by a deeper discussion of the threat model's assumptions. Please add a section in the discussion or conclusion that explicitly addresses the practicality of an attacker having iterative access to model weights and the ability to inject data at each step. \n\nDiscuss potential ways the attack could be adapted for a more constrained, \"one-shot\" poisoning scenario.\n\nTo better position the work, I suggest evaluating the attack against at least one other class of defense, such as data sanitization methods (e.g., using outlier detection) or certified defenses. This would provide a more complete picture of the attack's robustness.\n\nThe references to \"Result A\" and \"Result B\" in the text (e.g., in Figure 1 and Section 4) are a bit confusing. I recommend making these labels more descriptive or integrating their descriptions more directly into the main text to improve readability.\n\nThe current title is functional but could be more impactful. A title like \"Data Poisoning via Malicious Gradient Inversion\" or \"Equating Data Poisoning and Gradient Attacks via Gradient Inversion\" might better capture the core contribution.", "broader_impact_concerns": "No", "additional_comments": "", "extra_scores": {}, "extra_text": {}}]

Author rebuttal:

Decision: Accept (poster)