Delta-Influence: Identifying Poisons via Influence Functions
Authors: Wenjie Li
Jiawei Li
Pengcheng Zeng
Christian Schroeder de Witt
Ameya Prabhu
Amartya Sanyal
Venue: Accepted by TMLR ()

Abstract: Addressing data integrity challenges, such as unlearning the effects of targeted data poisoning after model training, is necessary for the reliable deployment of machine learning models. State-of-the-art influence functions, such as EK-FAC and TRAK, often fail to accurately attribute abnormal model behavior to the specific poisoned training data responsible for the data poisoning attack. In addition, traditional unlearning algorithms often struggle to effectively remove the influence of poisoned samples, particularly when only a few affected examples can be identified. To address these challenge, we introduce $\Delta$-Influence, a novel approach that leverages influence functions to trace abnormal model behavior back to the responsible poisoned training data using just one poisoned test example, without assuming any prior knowledge of the attack. $\Delta$-Influence applies data transformations that sever the link between poisoned training data and compromised test points without significantly affecting clean data. This allows detecting large negative shifts in influence scores following data transformations, a phenomenon we term as influence collapse, thereby accurately identifying poisoned training data. Unlearning this subset, e.g. through retraining, effectively eliminates the data poisoning. We validate our method across three vision-based poisoning attacks and three datasets, benchmarking against five detection algorithms and five unlearning strategies. We show that $\Delta$-Influence consistently achieves the best unlearning across all settings, showing the promise of influence functions for corrective unlearning.

Published in Transactions on Machine Learning Research (02/2026)
Delta-Influence: Identifying Poisons via Influence Functions
Wenjic Li ShanghaiTech University
kunf202225kanngaaatccccc......
Jiawei Li Tsinghua University
Pengcheng Zeng
ShanghaiTech University
Christian Schroeder de Witt
daristin..cdrrcddd@@ogg..oo
University of Ouford
Ameya Prabhu
Tübingen Al Center University of Tübingen
Amartya Sanyal
amso ku. dk
University of Copenhagen
Reviewed on OpenReview: https: // openreview. net/fel forum? id= 4XteGBNNGG
Abstract
Addressing data integrity challenges, such unlearning the effects of targeted data poison- ing after model training, is necessary for the reliable deployment of machine learning models. State-of-the-art influence functions, such as EK-FAC (Grosse et al., 2023) and TRAK (Park et al., 2023), often fail to accurately attribute abnormal model behavior to specific poisoned training data responsible for the data poisoning attack. addition, traditional unlearning algorithms often struggle effectively remove the influence of poisoned samples (Pawelezyk et al., 2024), particularly when only few affected examples can be identified (Goel al., 2024). To address these challenges, we introduce A-Infuennc,, novel approach that lever- ages influence functions to trace abnormal model behavior back to the responsible poisoned training data using just one poisoned test example, without assuming any prior knowledge of the attack. A-Influence applies data transformations that sever the link between poi- soned training data and compromised test points without significantly affecting clean data. This allows detecting large negative shifts in inffuence scores following data transforma- influence collapse, thereby accurately identifying poisoned training data. Unlearning this subset, c.g. through retraining, effectively eliminates the data poisoning. We validate our method across three vision-based poisoning attacks and three datasets, benchmarking against five detection algorithms and five unlearning strate- gies. We show that A-Influence consistently achieves the best unlearning across all settings, showing the promise of influence functions for corrective unlearning. Code is available at https://ght tht.. com/Buuy--07/deelta luence.
lions, a phenomenon
1 Introduction
Machine learning models are increasingly deployed in critical sectors such as healtheare, finance, and au- tonomous systems (Davenport & Kalakota, 2019; Huang al., 2020; Soori et al., 2023). This underscores the importance of ensuring model integrity and robustness against. targeted data poisoning attacks. In such

---

Published in Transactions on Machine Learning Research (02/2026)
Attack (eg Brew)
Label "No Entry"
attack yoalds targeted wrong. prediction!
The Mocal
lubil "Sintum Speed 59"
(lein kacel""taaennn Speod 50
Pred "Minimum Speed 50*
X
Poisoning Forensics with A- d-Influence
P
clean samples
triggers (Imperceptible)
poisoned samples
Poisoned Set 1D
Step I
Step II
Label Flipping Augnentation Influence Collapse
Step III
as shown by the signiikant decrease of fnf 4 4,)) fordl
Calculate Inf d6. Re2) each training example dfr utilizing the identified test point Rt i= (Xw, 9tx)
Ainf(G. 2/ff't00 (. 8, Inf (taa)) Infi(0.tt
IE P) stays True acruss multiple Ir......r z flagged as potson.
4
40
Dellwwee Mertee
48'
Pr. "Mintimm Speed S0"
#
Step IV
These Polsonsi
Unlearning the detected poisons
Xex
UNLEAGIING
"One Way
"No 17-Tumm
Yie "Pddestria Crossing"
UEGGOO FLOdES
Figure 1: Our goal is to identify the training points responsible for the poisoning with an affected test point, so that retraining without these points can remove the allack from the model. Slate-of-the-art methods (Grosse et al., 2023; Park et al., 2023) detect only a few poisoned points with low precision, leaving the poisoning effect in the model and causing a large accuracy drop. A Influence outperforms existing approaches by successfully recovering the clean model without sacrificing accuracy.
poisoning, adversaries intentionally manipulate training data by introducing carefully crafted, often imper- ceptible modifications (Chatila et al., 2021), leading to incorrect predictions or embedding specific malicious behaviors within the trained models (Fan et al., 2022). Given the large scale of modern datasets, identifying and removing all manipulated samples is lypically impractical (Nguyen el. al., 2024a; Goel et al., 2024). Therefore, a viable approach involves detecting and attributing the impact of data poisoning to a small set of influential training data points, which is unlearned to mitigate the data poisoning attack.
The challenge of elfective unlearning largely depends on the exlent of knowledge about the data poisoning attack. For example, Goel et al. (2024) demonstrate that retraining model after removing randomly sampled subset containing half of the manipulated data fails to climinate poisoning in relatively simple attacks like BadNet (Gu et al., 2019). In contrast, retraining without the entire set of manipulated data successfully removes the attack. Furthermore, for more sophisticated poisoning strategies such as Witches' Brew (Geiping et al., 2021), Pawelczyk et al. (2024) reveal that existing unlearning algorithms are ineffective unless the model is retrained without the full manipulated set, even when full access to the manipulated data is available.
Building upon the framework of Corrective Unlearning introduced by Goel et al. (2024), our work addresses the setting in which the defender has identified a small set of affected test points. We note that detecting such affected data is practical trigger for realizing that unlearning is necessary and thereby initiating the unlearning process, which can be regarded as form of poisoming forensics: starting from compromised oulput, we lrace back to the culpable training examples whose removal neutralizes the attack. In practice, such "perpetrators" typically surface through (i) deployment observation of anomalous behavior (e.g., a permission system granting administrative access to an unknown user, a stop sign being misclassified as a minimum speed-limit limit sign) or (ii) deliberate in-house stress testing (e.g., red-teaming, white-hat). A key advantage of our method is that it requires only the logically unavoidable minimum that at least one affected
2

---

Published in Transactions on Machine Learning Research (02/2026)
test point can be identified; other methods, while effective in their respective settings, typically assume larger identified set (Min et al., 2025; Coalson et al., 2025). Leveraging this poisoned test point, we propose a detect-then teetttthhnuuuiie whenuutar pipeline: first, identifying a critical set of manipulated training points responsible for the compromised prediction; and second, applying unlearning algorithms to remove the influence of these points from the model. Our approach departs from prior unlearning works that often presuppose the availability of a fforget sct", a subset of known poisoned training points (Goel et al., 2023; Kurmanji et al., 2023; Foster et al., 2024). We argue that such availability can be challenging to satisfy in practice, especially in complex clean-label attacks like Witches' Brew (as illustrated in the 'Attack' panel of Figure 1).
Within this framework, influence functions (Koh & Liang, 2017) serve as natural tool for attributing model predictions to specific training data points. However, recent studies (Grosse et al., 2023; Nguyen et al., 2024b; Bae et al., 2024) have indicated that state-of the-rrt influence functions struggle to accurately identify the manipulated data when used a naive manner. Our experiments Section 3 also corroborate this finding. To address this, we introduce A Inffuence, an approach that enhances influence functions to reliably identify a critical set of training data points necessary for unlearning data poisoning without compromising model accuracy. Instead of directly calculating each training point's influence on poisoned test point, A - IInfuuence assesses the change in influence scores before and after perturbing the test point through (i) label flipping and (ii) image transformation. As ablation studies in Section 4 show, label flipping is essential for breaking the association between poisoned data and the affected test point, while image transformations introduces randomness that reduces false positive rates by preserving the influence of benign data.
To assess the effectiveness of A Influence and the broader applicability of influence functions in this context, we apply our method to three prominent targeted data poisoning attacks: Frequency Trigger (Zeng et al., 2021), Witches' Brew (Geiping et al., 2021), and BadNet (Gu et al., 2019). We compare our approach against multiple defenses (Chen et al., 2018; Tran et al., 2018; Zeng et al., 2021; Grosse et al., 2023; Park et al., 2023) that operate with similar or less information about the poisoming than A - Influence. Each attack presents unique challenges for detection and mitigation, as evidenced by the varying performance of existing detection methods across different atlacks. Additionally, we conduct experiments using known unlearning algorithms to unlearn the poisoning attack using the identified set. These experiments provide a comprchensive comparison of these unlearning algorithms. For example, the gradient ascent-based method SCRUB (Kurmanji et al., 2023) can successfully unlearn some poisoning attacks (e.g. BadNet) when the detected set of training poisons is reasonably accurate. However, its resultant accuracy drops significantly if the detected set includes many falsely flagged clean examples. In contrast, methods like EU and CF (Goel et al., 2024) are surprisingly robust to false positives, delivering the best unlcarning and accuracy. Overall, our experiments demonstrate that A - Influence consistently outperforms existing algorithms across all settings, offering a robust defense against sophisticated data poisoning attacks while preserving accuracy.
2 Using Influence functions to detect poisons
In this section, we present how influence functions can be leveraged to unlearn data poisoning attacks and introduce our primary algorithm, A - Influence.
Consider an example where an adversary modifies a subset of training images belonging to a specific victim class by adding a subtle trigger and altering their labels to a larget class. These manipulated examples, referred to as poisons, are incorporated into the training datasct. Consequently, the trained model learns to misclassify any test image from the victim class containing the trigger as belonging to the larget class, while maintaining normal predictions other test images.
Influence functions (Koh & Liang, 2017) provide a mechanism to quantify the contribution of each training example to a particular prediction. By computing the influence of each training point on the prediction of the selected test point, we can identify the most influential training samples responsible for abnormal behavior. Specifically, poisoned examples typically exert a significant influence on the affected test predictions; this makes it possible to distinguish the poisons through their influence scores. Thus, influence functions offer a natural al for tracing abnormal predictions back to responsible poisoned training data.
3

---

Published in Transactions on Machine Learning Research (02/2026)
However, our experiments in Section 3, along with several recent studies (Nguyen et al., 2024b; Bac et al., 2024; Li et al., 2024b), demonstrate that naively applying state-of-the-art influence functions fails to accu- rately identify poisoned points. This limitation necessitates the development of a more robust method to effectively utilize influence functions for detecting and unlearning data poisoning.
2.1 Our Algorithm: A-Influence
To address the shortcomings of the naive approach, we introduce A Influence. The core idea is to mon- itor the changes in influence scores of training data points when the affected test point undergoes various transformations.
Notations. Let z/r = (= vir) denote a labeled training data point, where zyr X represents the in training input (e-g., an image for vision tasks) and yir E y represents the label. Tet O+ represent the trained model parameters optimized on the training dataset. For a given test point tre == (Ztes Ite) with predicted label iie, the influence function quantifying the impact of zt, on the loss of 21e is:
Inft (0", Piee Zt0) = VoL (Ztos 0³) VoL (').0))
where [(2, 0*) is the loss evaluated at the point with parameters 6* and H is the Hessian of the loss function with respect to 0 at 0*, Higher influence values indicate a greater contribution of the training point z to the prediction on the test point Zie.
Monitoring Change in Influence. Our goal is to attribute the predicted label fie of a poisoned test point Zte to a subset of training points p = { ...................... #tr responsible for the misclassffication. To achieve this, we monitor the change in influence scores Infi (8, 2/, 20)) for each training data point 2 when the test point Ate undergoes set of transformations.
Formally, let 9j be a transformation applied to the test point Ate (Zier (te), consisting of pairing the test image with a random label V', and applying standard data augmentations such as blurring, color jitter and rotating to Ite (see Appendix B.2 for the list of all transformations). Note that we utilize common data augmentation techniques without designing any poison-specific transformations, suggesting the broad applicability of A-Influence. We consider such simplicity be a key strength of our contribution. Then, for each transformation gj. we compute the change in influence score
Alnll(,, an',g (zre)) Infl a0, (9((z))) - Infl (0, zer', (to)
(2)
For brevity, we denote this change as Ainfl(i,j), where and j index the training point and the transformation function, respectively.
Influence Collapse. Computing the A Inffuence is motivated by the following two observations, which refer to Inffuence Collapse. Let are be the affected test point.
Negative Change for Poisons: For all manipulated training samples = P and transformations
gj> the change in influence Ainf((i,j) is consistently negative.
2. Minimal Change for Clean: For all clean training samples * $ P and transformations Jjs the change in influence Alnf((k. is significantly smaller in magnitude and often positive in value, for most transformations.
This is illustrated in Figure 2, where Ainf((i, is consistently negative for poisoned samples across all transformations. whereas it often remains near zero (compared to that of poisons) or shows no clear trend for clean examples. However, Figure 2 shows that this is not consistently the case for all clean examples (with some values being considerably small), which brings us to the next component.
Boosting Using Multiple Transformations. The above discussion shows that the change Alnf((i.) be used score function for detecting whether a is manipulated. However, this score function is
4

---

Published in Transactions on Machine Learning Research (02/2026)
10a
105
10a
106
Change in Influence Alnfl(i.)
10a
10a
10a
10a
10a
109
10a
10"
10
10a
-100
-10a
-100
-10f
-10-
-10*
-10
-104
-10"
-104
-10
-108
-10
-10
Cleans
Poisons
Cleans
Poisons
Cleans
Poisons
Cleans
Poisons
Cleans
Poisons
106
10a
109
10F
106
Change in Influence Alnfl(.J)
10a
103
103
101
10a
109
109
10a
10a
10%
0-
0-
0-
-10
-10"
-10"
-10º
-10"
-104
-10
-104
-104
-104
-10
-10
-10
-10
-108
Cleans
Poisons
Cleans
Poisons
Cleans
Poisons
Cleans
Poisons
Cleans
Polsons
Figure 2: The Infiuence Score Change ()) for 125 poisoned training points (orange) and 49,875 clean training points (light blue) on the Frequency Trigger with CIFAR100. Fach plot shows the score change for different transformation applied the affected test image. Results show consistent drop in scores for all poisoned examples while clean examples exhibit no clear trend.
a relatively weak classifier, especially for clean points, as seen in Figure 2. To overcome this problem, wo use classical ideas from bagging and apply multiple random transformations 91. Ir, to obtain a series of weak classifiers, where each classifier flags the example its corresponding score sufficiently negative. We use ni transformations obtain na weak classifiers
Then, combine the classifiers using count- decision rule. Specifically, flag a as manipulated if a sufficiently large number of weak classifiers also flag it. Note that this happens if large number of transformations simultaneously lead to negative change in influence score for the example. The key hypothesis we leverage here that for most clean points, few transformations will always result a positive change influence Ain
Unlearning identified points. Once the set of poisoned training points is identified using A Influence, the next step is to unlearn them to mitigate the data poisoning attack. We employ several unlearning algorithms (Goel et al., 2023; Kurmanji al., 2023; Golatkar al., 2020; Foster et al., 2024) to remove the inffuence of P from the trained model 0" In practice, the choice of unlcarning algorithm may depend on factors such as compulational efficiency, scalability, and the specific characteristics of the poisoning allack. this work, we look at several popular unlearning algorithms including retraining from scratch (denoted as EU (Goel et al., 2023)), CF (Goel et al., 2023), SSD (Foster et al., 2024), SCRUB (Golatkar et al., 2020), and BadT (Kurmanji al., 2023).
2.2 Full Algorithm
To summarise, the full pipeline of detection and unlearning in Influence proceeds as follows:
Initialization Begin with trained model 6*, a poisoned test point Æte, and the entire training dataset
D [
Transformations Apply a diverse set of transformations G {gr ) to the poisoned test point 2te to obtain multiple z/e = g (Ete)-
5

---

Published in Transactions on Machine Learning Research (02/2026)
3. Influence Score For each training data point zir E D and each transformation Jj E 9, compute the change in influence score JTn as defined in Equation (2).
4. Boosting and Detection For each training data point afr aggregate the infiuence score changes across all transformations. If the number of significant negative changes exceeds Ahol, flag eir a poisoned sample (noo) is a hyperparameter, see Appendix B.4). If the number of negative changes exceeds a predefined threshold т, flag z as a poisoned sample.
5. Unlearning Once the set of poisoned training points P is identified, apply unlearning algorithms to remove their influence from the trained model f*.
In the next section, we test and evaluate the above algorithm on several datasets, data poisons, and unlearning algorithms to compare with existing approaches.
3 Experiments
3.1
Experimental Setup
Attacks.
Ensuring broad coverage and robustness, we evaluate against three distinct types of attacks:
1. Frequency Trigger (Zeng et al., 2021): In this approach, along with changing the label, trained, imperceptible pattern embedded in both the spatial and frequency domains, thereby encompassing the whole image. As shown in Alex et al. (2024), these patterns difficult to detect by both human and automated methods, making the poisoned samples challenging to identify.
2. Clean Label Attack (Witches' Brew) (Geiping et al., 2021): Unlike Frequency Trigger, this attack adds imperceptible pattern to images without altering their labels. The poisoned samples appear benign since their labels are consistent with their content, yet they cause the model to learn incorrect associations, leading to misclassifications during inference. As shown in Pawelczyk et al. (2024), these patterns are difficult to unlearn using unlearning algorithms.
3. Patch Trigger (BadNet) (Gu et al., 2019); Also studied in Goel et al. (2024), this attack involves adding a subtle patch to the corner of selected training images and altering their labels to designated target class. The presence of the patch causes the model to misclassify any test image containing the patch inlo the target class while maintaining normal performance on other inputs.
Model and Datasets. We utilize the CIFAR1O and CIFARI00 datasets (Krizhevsky, 2009) and a ResNet18 model (He et al., 2015), following the standard benchmarks and models used in the shate-of-the-art machine unlearning setup (Pawelezyk et al., 2024). For CIFAR10, we poison 500 training images (1% of the dataset), while for CIFARIOO, BadNet, which requires a higher size of 350 samples to be effective. The victim class and attack class (when different) are selected randomly. Detection mods are tuned on a small validation set using cross- validation techniques. Hyperparameters such as threshold values and clustering parameters are optimized basod on validation performance metrics to achieve the best balance between detection accuracy and false positive rates. Detailed hyperparameter settings and our code are provided in the Appendix to ensure reproducibility.
poison 125 training images (0.25% of the dataset) for all attack types except
Compared Methods. We compare the detection performance of existing popular methods in the data poisoning literature by adapting them to our setting. Additionally, we include the state-of-the-art methods for computing influence function: EK-FAC (Grosse et al., 2023) and TRAK (Park et al., 2023) as baselines. Our Influence method built upon EK-FAC.
1. Activation Clustering Binstering-Based Based Detection (Chen et al., 2018) identifies backdoored samples by clustering the activations of the last hidden layer for cach class. If a class's activations can be effectively clustered into two distinct groups, the smaller cluster is doemed to contain poisoned samples and is subsequently removed for retraining.

---

Published in Transactions on Machine Learning Research (02/2026)
2. Spectral Signature-Based Detection (Tran et al., 2018) employs singular value decomposition the activations of the last. hidden layer per class. Samples with high values in the first singular dimension are flagged as poisoned and removed based on predefined hyperparameter threshold.
3. Frequency-Bane Based Detection (Zeng et al., 2021) performs frequency analysis by building a classifier on the discrete cosine transforms of synthetic images containing hardcoded backdoor-like features. It identifies poisoned examples by detecting these frequency-based patterns.
4. EK-FAC (Grosse et al., 2023) serves as our baseline method for using influence functions in poison detection. It calculates influence scores for every training sample based on one known affected test sample. Samples with average scores exceeding a predefined threshold are removed.
5. TRAK (Park et al., 2023) uses another popular implementation of influence functions when thresholding.
Metrics. We evaluate our algorithm using four key metrics. All metrics are averaged over three random soeds.
1. True Positive Rate (TPR): Fraction of identifidd poisoned samples out of the total poisoned samples in train set.
Number of correctly flagged poisoned samples 100%
Total number of poisoned samples
2. Precision: Proportion of correctly identified poisoned samples among all flagged samples. It captures the tradc-off between detection accuracy and model utility.
Number of correctly flagged poisoned samples 100%
'otal number of samples flagged as poisoned
3. Poison Success Rate (PSR): Fraction of poisoned test samples that are misclassified into the target (in- correct) class.
Number of poisoned samples classified as target
Total number of poisoned samples x 100%
4. Test Accuracy: The performance on unpoisoned test samples, measuring drop in model utility.
Number of correct predictions test set
x 100%
Total number of test samples
5. Area under the ROC curve (AuROC): Trade-off between TPR and Precision due to the choice of threshold.
3.2
Main Results
We present experimental findings across the above metrics and compare the performance of A Influence against several baselines. Specifically, we report the precision, TPR, and AuROC of detecting poisons in Table 1, and the overall PSR and test accuracy after retraining without the identified set in Figure 3.
Performance of A-Inflnence As illustrated Figure 3, A Influence consistently achieves a poison success rate below 5% across all three types of poisoning attacks and both datasets. This success rate is marked by V, while unsuccessful detections are marked by a x. In contrast, the next best methods, Activation Clustering (ActClust) and EK-FAC, succeed in only out of 6 cases, highlighted in Table 1. This showcases the substantial improvement in performance gained by A - Influence.
Among the baseline methods, EK-FAC outperforms ActClust by minimizing the drop in test accuracy, also indicated by a higher precision Table 1. Furthermore, A-Influence consistently achieves the highest precision, offering better performance with minimal accuracy loss compared the other methods. Additional experiments detailed in Section 4.1 demonstrate that both label and input augmentations are necessary for A Influence.
7

---

Published in Transactions on Machine Learning Research (02/2020)
Frequency Trigger
Witches' Brew
BadNet
100 0006
CIFARTO
Testt Accuracy
(more accurate
75
75
75
410
433
75
75
75
Nottor www.emmiiiiiiiiii.
50
50
25
25
25
25
80
31
(tamn)
Prepbee
446tt (Bun))
Spersig
Thai
4-09f (Dtmni
BK-AC
770AK
Test Accuracy (mare accurate
100
100
100
1000
100
100
100
Polson Succoss/66
better unlearming
CIFART 00
75
71.8
GET
97/667
S11
50
50
06
8
Prester
Actosut
Arthost
Spertii
+
TRCK
Av (Dhmn)
mextee
Buled
Accuracy
Poison Success
Figure 3: Poison Success Rate and Test Accuracy. This table shows both poison unlearning effectiveness and model utility. A method is considered successful if the PSR is below 5%, marked by V, with unsuccessful methods marked by x. A-Influence is successful in 6/6 cases, while the closest competitors succeed only 3/6, Additionally, A-Influence nearly perfectly preserves test accuracy. Figure structure from (Pawelczyk et al., 2024).
Variance across Poisons. Our analysis shows that the BadNet poison can be effectively removed without identifying all poisoned samples, reaffirming that it realatively casy to climinate. Basod on these results, we advocate that the corrective unlearning literature should benchmark proposed algorithms on the more challenging frequency-based poisons (Zeng al., 2021), which require detecting nearly all poisoned samples and are notably harder to remove with a partial subset. This was also identified to be difficult in previous work (Alex et al., 2024).
Surprisingly, in the case of the Witches' Brew attack on CIFAR-10, our A Influence method often identifies fewer but a sufficient number of true poisoned samples compared to other methods. We attribute this to the unique behavior this particular poison. A Inffuennee effectively identifies the samples most responsible for the misclassification, and in Witches' Brew, only a few samples are truly effective for poisoning. Additional experiments in Scction 4.3 show that removing the complement of detected poisons does not allow the model to recover, despile the complement set being similar in size larger.
Conclusion. Overall, A Influence offers an effective mechanism for unlearning data poisonining attacks without significantly impacting model performance. Crucially, requires no prior knowledge of the attack method, making it more generalizable across various poisoning strategies.
4 Unpacking Key Factors in A-Inllunnce
We present a series of additional analyses designed to improve the understanding of - Influence. Specifi- cally, we explore: (i) individual contributions image and label perturbations, (ii) effectiveness of various unlearning algorithms, (iii) a counterfactual analysis to determine whether the detected samples are solely responsible for enabling poisoning in the Witches' Brew attack, and (iv) the unreliability of using a known training poison attribution target (see Appendix K).
4.1 Perturbing Only Images Labels
Setup. To distinguish the contributions of image and label perturbations in our A Influence method, we conduct ablation study by evaluating the two key components separately:
8

---

Published in Transactions on Machine Learning Research (02/2026)
Table 1: Comparison of Precision & TPR & AuROC across methods and dataset for detecting poisoned samples. Green indicates successful unlearning (PSR v 5,, while red indicates failed unlcarning (sce fig. for exact poisoning success rates). We evaluate the precision and TPR of detecting poisoned training samples. SpecSig Tran et al. (2018), ActClust Chen et al. (2018), TRAK Park et al. (2023) and EK-FAC Grosse et al. (2023) yield low precision, flagging many clean samples as poisoned. FreqDef Zeng et al. (2021) and A InInflnnnce better preserve clean data, though FroqDef shows a significantly lower TPR, missing many true poisoned samples. For BadNet, the poisoning success rate correlates with the number detected poisoned samples, making the attack in Goel al. (2024) relatively easy to unlearn. In contrast, the Frequency attack requires nearly all poisoned samples to be removed for recovery, making it particularly challenging. Surprisingly, the Witches' Brew setting is easier than anticipated Pawelczyk et al. (2024), requiring only few key samples mainly
mainly identified by influence functions-be to be removed for effective unlearning.
Method
Metric
CIFAR10
CIFAR100
Frequency Trigger
Witches' Brew
BadNet
Frequency Trigger
Witches' Brew
BadNet
Precision
1.3%
1.4%
3.6%
0.5%
0.3%
1.3%
SpecSig
TPR
88.3%
96.8%
88.3%
78.4%
35.2%
82.6%
AuROC
0.53
0.88
0.82
0.72
0.58
0.76
Precision
2.2%
2.1%
2.2%
0.6%
0.3%
1.6%
ActClust
TPR
99.1%
93.4%
94.9%
100%
55.2%
96.3%
AuROC
0.77
0.75
0.79
0.79
0.53
0.78
Precision
0.4%
10.2%
8.0%
0.1%
1.8%
5.3%
Deeq
TPR
3.2%
93.6%
72.3%
2.4%
78.4%
85.7%
AuROC
0.32
0.98
0.97
0.28
0.91
0.97
Precision
1.4%
1.0%
1.9%
0.5%
0.2%
1.4%
TRAK
TPR
70.6%
49.8%
93.6%
96.8%
48.0%
100%
AuROC
0.73
0.50
0.60
0.79
0.49
0.58
Precision
2.9%
0.8%
2.8%
0.9%
0.4%
3.2%
EK-FAC
TPR
100%
17.4%
67.1%
96.8%
47.2%
70.0%
AuROC
0.89
0.57
0.87
0.94
0.68
0.71
Precision
13.3%
3.3%
17.6%
2.9%
2.1%
37.3%
A-Infi (Ours)
TPR
100%
19.4%
99.1%
100%
62.4%
96.9%
AuROC
0.96
0.38
0.95
0.96
0.75
0.82
Table 2: Comparison of Precision & TPR & AuROC across Label-Only, Image-Only and combined transfor- mation of affected image. Green indicates successful unlearning (PSR < 5%), while red indicates unsuccessful highly effective in detecting poi-
unlearning (See Appendix for exact PSR). Label-only augmentations soned samples, whereas image-only augmentations perform poorly. Conversely, image-only augmentations significantly reduce the FPR, preserving more clean data and improving detection precision.
Method
Metric
CIFARIO
CIFAR100 Witches' Brew
Frequency Trigger
Witches Brew
BadNet
Frequency Trigger
BadNet
Precision
6.3%
1.2%
4.0%
1.1%
0.8%
3.1%
Ours (Label-Oaly)
TPR
100%
24.2%
97.5%
100%
73.6%
99.1%
AuROC
0.94
0.48
0.90
0.92
0.69
0.79
Precision
28.9%
2.7%
14.4%
0.6%
0.3%
7.6%
Ours (Img-Only)
TPR
26.4%
13.2%
68.9%
62.4%
40.8%
50.6%
AuROC
0.51
0.25
0.85
0.78
0.62
0.76
Precision
13.3%
3.3%
17.6%
2.9%
2.1%
37.3%
Ours (Doth)
TPR
100%
19.1%
99.1%
100%
62.4%
96.9%
AuROC
0.96
0.38
0.95
0.96
0.75
0.82
1. Modify Label (A Influence (Label-Only)): Conversely, this bascline, we only modify the test point's labels while keeping the images unchanged. This setup helps evaluate the effect of label manipulation on detecting the influence of poisoned training points.

---

Published in Transactions on Machine Learning Research (02/2026)
Frequency Trigger
Witches' Brew
BadNet
7050
1000
105.6
.1.0
Test Accuracy (%) (more accurate
Success better unleaming
723
75-
75
CIFARTO
25
25-
5003
Scrub
BextT
CF
550
950
Scrub
X
X
V
100
1000
100
Success (r belter unleaming)
Test Test Accuracy (N)
CIFAR1ON
30
50-
50
50-
(more
25-
25
57
0.
650 Stnb
BasT
8U
OF
650
Souu
BodT
EV
CF
550
Sorub
BMd
Accuracy
Poison Success
Figure 4: Poison Success Rate and Test Accuracy for Unlearning Methods Applied Samples Identified by A Influence. Catastrophic Forgetting (CF) and Exact Unlearning (EU) from Goel et al. (2023) perform best, effectively unlearning poisoned samples while maintaining test accuracy. In contrast, SSD (Foster et al., 2024) and SCRUB (Kurmanji et al., 2023) struggle with false negatives, leading to significant accuracy drops, while BadT (Chundawat et al., 2023) fails to unlearn effectively. We recommend EU or CF as strong baselines and highlight the need for future methods improve robustness against false positives.
2. Modify Image (A Influence (Img- Only)): this baseline, we exclusively modify the test images without altering their labels. This allows us to isolate the impact of image transformations the model's ability to detect poisoned data.
Both ablations are benchmarked across the same datasets and poisoning attacks, utilising identical metrics to ensure consistency in ovaluation. The goal to understand the individual and combined effects image and label perturbations on the detection performance of Influence.
Results. As depicted in Table 2, our ablation study reveals that label-only augmentations achieve high TPR across all poisoning types and datascts, effectively identifying almost all poisoned samples. However, this leads to low precision, resulting in the unnecessary removal of significant number of clean samples. On the other hand, image-only augmentations exhibit poor TPR, failing at the core task but also rejects less clean samples (higher precision). In contrast, A - Influence leverages both label and image perturbations to achieve a balanced performance and detects sufficient key poisoned samples while rejecting lesser clean samples (see Figure A Appendix for detailed unlearning performance). Our ablation study underscores the necessity of incorporating both label and image augmentations in the A Influence method. Label flippings are pivotal for enhancing detection accuracy, while image transformations play critical role in minimizing false positives.
Conclusion. Our ablation study underscores the necessity of incorporating both label and image augmen- lations in the A - Influence method. Label perturbations are pivotal for enhancing detection accuracy, while image augmentations play a critical role in minimizing false positives.
4.2 Which Unlearning Methods Work?
Setup. To evaluate the effectiveness of various unlearning algorithms when paired with our A Influence method, we fix the influence scoring method to A - Influence and vary the unlearning algo- rithm. We benchmark several corrective unlearning approaches, including exact unlearning methods such as EU (Goel et al., 2023), CF (Goel et al., 2023), as well approxinate unlearning methods such as SSD (Foster et al., 2024), SCRUB (Golatkar et al., 2020), and BadT (Kurmanji al., 2023). Following (Pawel-
10

---

Published in Transactions on Machine Learning Research (02/2026)
ezyk et al., 2024), for approximate unlearning methods we reduce the compute budget to 10% of the original training budget (e.g,, 4 unlearning epochs when the original model is trained for 40 epochs). Meanwhile, to avoid confounding factors (i.e., whether failures are due to poor detection or to limitations of imperfect approximate unlcarning); we allocate the full training budget to exact unlcarning methods EU and CF so that they serve as gold-standard baselines. All methods are implemented using the codebase and training protocols from Goel et al. (2024). Further implementation details are provided in Appendix B.
Results. As illustrated in Figure 4, our evaluation reveals that CF performs comparably to EU, achieving near-perfect poison removal. Both CF and EU remain robust against false positives, maintaining high test accuracy. In contrast, approximate unlearning methods are less reliable overall. While SCRUB can successfully remove poisons in some cases (Frequency Trigger and BadNet), it does so at the expense of model utility due to its susceptibility to false positives. BadT and SSD completely fail to unlearn poisons effectively.
Conclusion. We recommend EU CF competitive baselines for corrective unlearning using influence functions, and also highlight the importance of robustness towards false positives.
4.3 Counterfactual Analysis: Do Detected Samples Account for Poisoning in Witches' Brew?
Table Does the Detected Set Truly Influence the Poison? For Witches' Brew, we test the "Original" set, representing the poisoned samples identified by Influeence and "ommpemmen""" set, which includes all other poisoned samples not detected. The absence of drop in poison success rate when removing the complement set suggests that the detected set fully captures the poisoning effect. Conversely, removing the detected set completely eliminates the poisoning effect.
I-Iflunecce Set TPR(t) Polson Success Rate (4)
Test. Accuracy (t)
CIFAR10
Original
19.4%
0%
91.0%
Complement
80.6%
100%
92.2%
CIFAR100
Original 62.4%
0%
71.9%
Complement Set
37.6%
100%
72.8%
Setup. The analysis compares the original detected of poisoned samples in Witches" Brew to its com- plement set (i.c., all poisoned samples except those detected by A - Influence). This aims to assess whether the detected set exclusively accounts for the poisoning effect.
Results. As presented in Table 3, the removal of the "Original" detected set (19.4% TPR for CIFAR1O and 62.4% TPR for CIFAR100) results in 0% poison success rate, effectively unlearning the poisoning. In stark contrast, removing the "Complement" set (80.6% TPR for CIFAR10 and 37.6% TPR for CIFAR100) maintains a poison success rate of 100%, indicating that the undotected samples do not sufficiently contribute to the poisoning. The complement set achieves higher test accuracy simply because it only contains unaffected samples without false positives. These results demonstrate that our detected subset accounts for nearly all the poisoning effects in Witches' Brew, highlighting the unusual nature of this particular poison as well the precision of our A - Influence algorithm.
Conclusion. These results demonstrate that our detected subset accounts for nearly all the poisoning effects in Witches' Brew, highlighting the unusual nature of this particular poison as well as the precision of our A- Influence algorithm.
4.4 Scaling Results to ImageNette
Setup. We evaluate the scalability and consistency of A Influence on more complex dataset, Imagenette. The setup consistent with the experiments in Section with specifie adjustments (details in Appendix D.2).
11

---

Published in Transactions on Machine Learning Research (02/2026)
Frequency Trigger
Witches' Brew
BadNet
Detection Performance
100
100.
100
100
100
(- Sittts Sunteaming
Test Accuracy(
2000 Successi
35
70.5
75
$1.5643
16.
50
50
(more
2044
14
(Dtuna
Freetedd
+
AnDiant
A-lnt (Stan)
Freeche
+
Antiun
x
Speccia
+
(Cumn)
DEFAC
Frmebel
+
ArtC
Spper x
+
x
Unlearming Methods
Test Recurace (%)
(%)
belter unleamingg
75
(more accurate
50-
50
50-
25-
25
(r
1/1
04
02
03
60
650
Strbb
BasT
8U
OF
660
Soub
BudT
EU
550
Sorub
BMT
Accuracy
Poison Success
Figure 5: Scaling to Imagenette. Results on Imagenette consistent with previous findings.
Results. Replicating our prior conclusions on Imagenette, Figure illustrates that A Influence continues to achieve the most effective poison unlearning across all attack types, maintaining minimal accuracy loss. Notably, the EK-FAC baseline also successfully unlearns all poisons but incurs higher false positive rate, leading to significant drops in test. accuracy due to the unnecessary removal of clean samples. When ap- plying various unlearning algorithms to the samples identified by A - Influence, both CF and EU perform consistently well with CF achieving notably higher accuracy during poison unlearning compared to EU. contrast, approximate unlearning methods perform substantially worse.
5
Conclusion
We address a critical issue in corrective machine unlearning: identifying training samples whose removal can unlearn a data poisoning attack. A-Influence traces abnormal behavior back to the key poisoned training data utilizing one single affected test point, without assuming any prior knowledge of the attack. By retraining without these identified points, A-Influence successfully unlearns multiple poisoning attacks across diverse datasets. We evaluate to the identified training set. Our results demonstrate that A-Inftuence consistently outperforms existing approaches in all tested scenarios. Our findings highlight the potential of influence functions as a foundation for unlcarning data poisoning attacks. Additionally, our ablation study shods light on the strengths and limitations various poisoning attacks and unlearning algorithms, offering insights that could inform the development of more effective unlearning techniques and robust poisoning attacks for rigorous testing.
method against five detection algorithms and apply five unlearning algorithms
Acknowledgements
The authors would like thank (in alphabetic order): Shashwat Goel, Shyamgopal Karthik, Elisa Nguyen, Shiven Sinha, Shashwat Singh, Matthias Tangemann, Vishaal Udandarao for their helpful feedback. AS acknowledges the Novo Nordisk Foundation for support via the Startup grant (NNF240C0087820) and VILLUM FONDEN via the Young Investigator program (72069). WL, JL, and CSW acknowledges support from the Supervised Program for Alignment Research (SPAR) program. AP acknowledges financial support by the Federal Ministry of Education and Research (BMBF), FKZ: 16IS24085B and Open Philanthropy Foundation funded by the Good Ventures Foundation. We also thank the Center for Al Safety (CAIS) for their computational resources support.
12

---

Published in Transactions on Machine Learning Research (02/2026)
References
Neel Alex, Shoaib Ahmed Siddiqui, Amartya Sanyal, and David Krueger. Protecting against simultancous data poisoning attacks. arXic:2408.1322 2024.
Juhan Bae, Wu Lin, Jonathan Lorraine, and Roger Grosse. Training data attribution via approximate unrolled differentation. arXiv:2405.122) 12186, 2024.
Samyadeep Basu, Phil Pope, and Soheil Feizi. Influence functions in deep learning are fragile. In International Conference on Learning Representations (ICLR), 2021.
Lucas Bourtoule, Varun Chandrasckaran, Christopher A. Croquctte-Choo, Hengrui Jia, Adelin Travers, Baiwu Zhang, David Lie, and Nicolas Papernot. Machine Unlearning. TEEE Symposium on Security and Privacy (IEEE SBP), 2021.
Yinzhi Cao and Junfeng Yang. Towards making systems forget with machine unlearning. In IEEE Symposium on Security and Privacy (IEEE SBP), 2015.
Nicholas Carlini, Matthew Jagielski, Christopher A Choquette- Daniel Paleka, Will Pearce, Hyrum Anderson, Andreas Terzis, Kurt Thomas, and Florian Tramèr. Poisoning web-scale training datasets is practical. In IEEE Symposium on Security and Privacy (IEEE SBP), 2024.
Raja Chatila, Virginia Dignum, Michael Fisher, Fosca Gianmotti, Katharina Morik, Stuart Russell, and Karen Yeung. Trustworthy AI. In Reflections on Artificial Intelligence for Humanity, 2021.
Bryant Chen, Wilka Carvalho, Nathalie Baracaldo, Heiko Ludwig, Benjamin Edwards, Taesung Lee, Ian Mol- loy, and Biplav Srivastava. Detocting backdoor attacks on deep neural networks by activation clustoring. arXiv:1811.037 2018.
Huili Chen, Cheng Fu, Jishen Zhao, and Farinaz Koushanfar. Deepinspect: A black-box trojan detection and mitigation framework for deep neural networks. In International Joint Conferences Artificial Intelligence (IJCAI), 2019.
Vikram S Chundawat, Ayush K Tarun, Murari Mandal, and Mohan Kankanhalli. Can bad teaching induce forgetting? unlearning in deep networks using an incompetent teacher. In Proceedings of the AAAI Conference on Artificial Intelligence, 2023.
Zachary Coalson, Juhan Bac, Nicholas Carlini, and Sanghyun Hong. If-guide: Influence function-guided detoxification Ilms, 2025.
R Dennis Cook and Sanford Weisberg. Characterizations of an empirical influence function for detecting influential cases in regression. Technometrics, 1980.
Thomas Davenport and Ravi Kalakota. The potential for artificial intelligence in healthcare. Future Healthe J, 2019.
Yinpeng Dong, Xiao Yang, Zhijie Deng, Tianyu Pang, Zihao Xiao, Hang Su, and Jun Zhu. Black-Bor Detection of Backdoor Attacks With Limited Information and Data. In International Conference on Computer Visions (ICCV), 2021.
Jiaxin Fan, Qi Yan, Mohan Li, Guanqun Qu, and Yang Xiao. A Survey on Data Poisoning Atlacks and Defenses. In IEEE International Conference on Data Science in Cyberspace (DSC), 2022.
Vitaly Feldman and Chiyuan Zhang. What neural networks memorize and why: Discovering the long tail via influence estimation. Advances in Neural Information Processing Systems (NeurIPS), 2020.
Jack Foster, Stefan Schoepf, and Alexandra Brintrup. Fast machine unlearning without retraining through selective synaptic dampening. In Proceedings of the AAAT Conference on Artificial Intelligence, 2024.
13

---

Published in Transactions on Machine Learning Research (02/2026)
Jonas Geiping, Liam H Fowl, W. Ronny Huang, Wojeiech Czaja, Gavin Taylor, Michael Moeller, and Tom Goldstein. Witches' brew: Industrial scale data poisoning via gradient matching. In International Con- ference on Learning Representations, 2021.
Amirata Ghorbani and James Zou. Data shapley: Equitable valuation of data for machine learning. In International conference on machine learning. 2019.
Antonio Ginart, Melody Y. Guan, Gregory Valiant, and James Zou. Making Al forget you: Data deletion in machine learning. In Advances in Neural Information Processing Systems (NeurIPS), 2019.
Shashwat Goel, Ameya Prablu, Amartya Sanyal, Ser-Nam Lim, Philip Torr, and Pounurangam Kumaraguru. Towards adversarial evaluations for inexact machine unlearning. arXiv:2201.06640 2023.
Shashwat Goel, Ameya Prabhu, Philip Torr, Ponmurangam Kumaraguru, and Amartya Sanyal. Corrective machine unlearning. Transactions on Machine Learning Research, 2024. URL
www.aaiwww....aaaaaeeeea /bs//
2402. 14015.
Aditya Golatkar, Alessandro Achille, and Stefano Soalto. Forgetting outside the box: Scrubbing deep networks of information accessible from input-output observations. In European Conference on Computer Vision, 2020.
Roger Grosse, Juhan Bac, Cem Anil, Nelson Elhage, Alex Tamkin, Amirhosscin Tajdini, Benoit Steiner, Dustin Li, Esin Durmus, Ethan Perez, Evan Hubinger, Kamilé Lukošiūté, Karina Nguyen, Nicholas Joseph, Sam McCandlish, Jared Kaplan, and Samuel R. Bowman. Studying Large Language Model Generalization with Influence Functions. arXiv:2308. 03296, 2023. URL httts::/ta/rrtt http//axxv...o/aaa//a////e aataaabs//000 2308. 230..03296.........
Tianyu Gu, Kang Liu, Brendan Dolan-Gavitt, and Siddharth Garg. Badnets: Evaluating backdooring attacks deep neural networks. arXiv: 170.00633,,,, 2019.
Chuan Guo, Tom Goldstein, Awni Hannun, and Laurens van der Maaten. Certified data removal from machine learning models. International Conference on Machine Learning (ICML), 2020.
Wenbo Guo, Lun Wang, Xinyu Xing, Min Du, and Dawn Song. TABOR: A Highly Accurate Approach to Inspecting and Restoring Trojan Backdoors in Al Systems, 2019.
Varun Gupta, Christopher Jung, Seth Neel, Aaron Roth, Saced Sharif--Malvajerdi, and Chris Waites. Adap- tive machine unlearning. Advances in Neural Information Processing Systems (NewrIPS), 2021.
Zayd Hammoudeh and Daniel Lowd. Training data influence analysis and estimation: A survey, Machine Learning, 2024.
Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep Residual Learning for Image Recognition. 2015.
Jian Huang, Junyi Chai, and Stella Cho. Deep learning in finance and banking: A literature review and classification. Frontiers of Business Rescarch in China, 2020.
Andrew Ilyas, Sung Min Park, Logan Engstrom, Guillaume Leclere, and Aleksander Madry. Datamodels: Predicting predictions from training data. arXiv preprinl Nii:2202.00022 2022.
Ruoxi Jia, David Dao, Boxin Wang, Frances Ann Hubis, Nick Hynes, Nezihe Merve Gürel, Bo Li, Ce Zhang, Dawn Song, and Costas J Spanos. Towards efficient data valuation based on the shapley value. In The 22nd International Conference on Artificial Intelligence and Statistics, 2019.
SungYub Kim, Kyungsu Kim, and Eunho Yang. Gex: A flexible method for approximating influence via geometric ensemble. Advances in Neural Information Processing Systems (NeurIPS), 2024.
Pang Wei Koh and Percy Liang. Understanding Black-box Predictions via Influence Functions. In Proceedings of the 34th International Conference Machine Learning, 2017.
14

---

Published in Transactions on Machine Learning Research (02/2026)
Pang Wei W Koh, Kai-Siang Ang, Hubert Teo, and Percy S Liang. On the accuracy of influence functions for measuring group effects. Advances in Newral Information Processing Systems (NewrIPS), 2019.
Alex Krizhevsky. Learning multiple layers of features from tiny images. 2009. URL https://api.
semanticscholar. Terg/CorusID:: 18268744
Meghdad Kurmanji, Peter Triantafillou, and Eleni Triantafillou. Towards unbounded machine unlearning. Advances in Neural Information Processing Systems (NeurIPS), 2023.
Nathaniel Li, Alexander Pan, Anjali Gopal, Summer Yue, Daniel Berrios, Alice Gatti, Justin D Li, Ann- Kathrin Dombrowski, Shashwat Goel, Long Phan, et al. The winpp benchmark: Measuring and reducing malicious use with unlcarning. arXiv:2403..088 032218 2024a.
Yige Li, Xixiang Lyu, Nodens Koren, Lingjuan Lyu, Bo Li, and Xingiun Ma. AntiBBackloor Learning: Train- ing Clean Models on Poisoned Data. In Advances in Newral Information Processing Systems (NewrIPS), 2021a.
Yige Li, Xixiang Lyu, Nodens Koren, Lingjuan Lyu, Bo Li, and Xingjun Ma. Neural Attention Distilla- tion: Erasing Backdoor Triggers from Deep Neural Networks. In International Conference on Learning Representations, 2021b.
Zhe Li, Wei Zhao, Yige Li, and Jun Sun. Do influence functions work on large language models? arXiv:2409.19900 2024b.
Kang Liu, Brendan Dolan-Gavitt, and Siddharth Garg. Fino-Pruning: Defending Against Backdooring Atlacks on Deep Neural Networks, 2018.
Taywon Min, Haeone Lee, Yongchan Kwon, and Kimin Lee. Understanding impact of human feedback via influence functions. In Proceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pp. 27471 27500. Association for Computational Linguistics, 2025. doi: 10. 10.18633vv120255.clll
1333.
Seth Neel, Aaron Roth, and Saeed Sharif--Mavajerdi. Descent-lo-delete: Gradient-based methods for ma- chine unlearning. In Conference on Learning Theory (COLT), 2021.
Elisa Nguyen, Johannes Bertram, Evgenii Kortukov, Jean Y Song, and Seong Joon Oh. Towards user-focused research in training data attribution for human-centered explainable ai. arXiv preprint orXiv:2409.16978 2024a.
Elisa Nguyen, Minjoon Seo, and Seong Joon Oh. A bayesian approach to analysing training data attribution in deep learning. Advances in Neural Information Processing Systems (NeurIPS), 2024b.
Sung Min Park, Kristian Georgiev, Andrew Ilyas, Guillaume Leclere, and Aleksander Madry. Trak: At- faabs/3303. 14186.
tributing model behavior at scale. arXiv:2303. 14186, 2023. URL
Martin Pawelezyk, Jimmy Di, Yiwei Lu, Gautam Kamath, Ayush Sekhari, and Seth Neel. Machine Unlearning Fails Remove Data Poisoning Attacks. arXiv:2406.17911 2024. URL https://arxiv.org abs/2406. 17216.
Garima Pruthi, Frederick Liu, Satyen Kale, and Mukund Sundararajan. Estimating training data influence by tracing gradient descent. Adounces in Neural Information Processing Systems (NewrIPS). 2020.
Stefan Schoepf, Jack Foster, and Alexandra Brintrup. Potion: Towards poison unlearning. 2rXiv:2406.09172 2024.
Sanjay Scotharaman, Shubham Malaviya, Rosni Vasu, Manish Shukla, and Sachin Lodha. Influence Basod Defense Against Data Poisoning Attacks in Online Learning. In International Conference on COMmuni- cation Systems & WETworkS (COMSNETS), 2022.
15

---

Published in Transactions on Machine Learning Research (02/2026)
Ayush Sckhari, Jayadev Acharya, Gautam Kamath, and Ananda Theertha Suresh. Remember what you want to forget: Algorithms for machine unlearning. In Advances in Newral Information Processing Sys- tems (NeurIPS), 2021.
Mohsen Soori, Behrooz Arezoo, and Roza Dastres. Artificial intelligence, machine learning and deep learning in advanced robotics, review. Cognitive Robotics, 2023.
Jacob Steinhardt, Pang Wei W Koh, and Percy S Liang. Certified Defenses for Data Poisoning Attacks. Advances in Neural Information Processing Systems, 2017.
Guanhong Tao, Guangyu Shen, Yingqi Liu, Shengwei An, Qiuling Xu, Shiqing Ma, Pan Li, and Xiangyu Zhang. Better Trigger Inversion Optimization in Backdoor Scanning. In Conference on Computer Vision and Pattern Recognition (CVPR), 2022.
Brandon Tran, Jerry Li, and Aleksander Madry. Spectral Signatures in Backdoor Attacks. In Advances in Newral Information Processing Systems (NeurIPS), 2018.
Bolun Wang, Yuanshun Yao, Shawn Shan, Huiying Li, Bimal Viswanath, Haitao Zheng, and Ben Y. Zhao. Neural Cleansc: Identifying and Mitigating Backdoor Attacks in Neural Networks. In IEEE Symposium on Securily and Privacy (IEEE SBP), 2019.
Ren Wang, Gaoyuan Zhang, Sijia Liu, Pin-Yu Chen, Jinjun Xiong, and Meng Wang. Practical Detection of Trojan Neural Networks: Pata-Limited and Data-Free Cases. In Europeon Conference on Computer Vision, 2020.
Yi Zeng, Won Park, Z. Morley Mao, and Ruoxi Jia. Rethinking the Backdoor Attacks' Triggers: Frequency Perspective. In International Conference on Computer Visions (ICCV), 2021.
Yi Zeng, Si Chen, Won Park, Z. Morley Mao, Ming Jin, and Ruoxi Jia. Adversarial Unlearning of Backdoors via Implicit Hypergradient. In International Conference on Learning Representations, 2022.
16

---

Published in Transactions on Machine Learning Research (02/2026)
A Connections to Existing Work
Data Attribution: A Brief Overview
The problem of training data attribution (TDA) has been explored using various approaches such influence functions (Koh & Liang, 2017; Koh et al., 2019), Shapley value-based estimators (Ghorbani & Zou, 2019), empirical influence computation (Feldman & Zhang, 2020), and predictive datamodels (Park et al., 2023).
Broadly, TDA methods can be categorized into three groups: retraining- based methods, gradient- based methods, and predictive attribution models (see Hammoudeh & Lowd (2024) for a survey). Retraining based methods systematically retrain models with and without specific training samples and observe changes in the model's outputs (Ghorbani & Zou, 2019; Jia et al., 2019; Feldman & Zhang, 2020). While these methods yield relatively accurate influence scores, they are computationally prohibitive for moderately large models, as the number of retrains often grows with the size of the training data. Gradient-based methods, such as influence functions (Cook& & Weisberg, 1980), are computationally cheaper but often produce less reliable influence estimates for complex models (Basu et al., 2021).
Influence functions approximate the effect of individual training samples on a model's predictions by measur- ing how a prediction changes when a sample's weight is slightly perturbed. They were introduced to machine learning by Koh & Liang (2017) and have since been refined (Grosse et al., 2023; Kim et al., 2024; Pruthi et al., 2020). In data poisoning contexts, Seetharaman et al. (2022) used influence functions to mitigate degradation caused by previously identified poisoned data (Steinhardt et al., 2017). Building on this, we explore how advanced influence functions like EK-FAC (Grosse et al., 2023) can identify training examples disproportionately contributing to anomalous predictions in poisoned models.
Another approach, predictive data attribution, focuses on predicting model behavior directly based on train- ing data (Myas et al., 2022; Park et al., 2023). While this approach can provide accurate influence estimates, the cost of training predictive models remains significant limitation.
Unlearning: A Brief Overview
Machine unlearning, first proposed by Cao & Yang (2015), enables ML models to "forget" specific data points by removing their influence. This concept has gained importance with data protection regulations such as GDPR in the EU, which enforce the "right to be forgotten." Ideally, unlearning produces models equivalent to retraining from scratch after excluding the target data (Cao & Yang, 2015; Bourtoule et al., 2021; Gupta et al., 2021). However, retraining is computationally expensive, leading to the development of approximate unlearning methods (Ginart el al., 2019; Guo et al., 2020; Neel el al., 2021). These methods are often inspired by concepts from differential privacy, with the relevant ((e, 8) d)-prabbeee unlearning definition formalized in Sckhari ct al. (2021).
Recently, the scope of machine unlearning has expanded beyond privacy to address post-hoc system degra- dation, such as harmful knowledge removal (Li et al., 2024a) and adversarial attacks (Pawelezyk et al., 2024; Goel et al., 2024; Schoopf et al., 2024). In corrective unlearning, Pawelezyk et al. (2024) demonstrated the difficulty of mitigating strong poisons like Witches' Brew, while Goel et al. (2024) highlighted challenges when the complete set of manipulated data is unknown. These complexities underscore the inherent difficulty of the setting we address in this work.
Data Poisoning Attacks Data poisoning attacks are a significant threat to ML systems due to their ease of deployment and difficulty in detection. Even minor modifications to training data can lead to successful attacks on models trained on large datasets (Carlini et al., 2024). In this paper, we consider three forms of targeted data poisoning attacks: backdoor attack (Gu et al., 2019) that adds a small patch in the corner of attacked images and modifies their labels to target label, a smooth trigger attack (Zeng et al., 2021) that adds a trained pattern which is both hard to identify either in raw image domain or frequency domain, and Wilches' Brew (Geiping et al., 2021), which adds a trained imperceptible pattern on allacked images without modifying labels. Note that the first two attacks modify the victim images' labels, while Witches' Brew a clean-label attack. In this work, we do not consider indiscrimitive attacks which exhibit much weaker test-phase stealthiness as they degrade overall model performance, instead of forcing specific malicious predictions.
17

---

Published in Transactions on Machine Learning Research (02/2026)
Data Poisoning Defences Defenses against data poisoning often involve trigeer-pattern reverse engincering using clean data (Wang et al., 2019; Guo et al., 2019; Tao et al., 2022; Dong et al., 2021; Wang et al., 2020). These methods require additional steps such as input pre-filtering, neuron pruning, or fine-tuning (Liu et al., 2018; Chen et al., 2019; Li et al., 2021b; Zeng et al., 2022). Other approaches, like Anti-Backdoor Learning (Li et al., 2021a) and BaDLoss (Alex et al., 2024), necessitate tracking model updates and clean training samples, adding complexity to the defense process.
In contrast, our method requires access only to the trained model and single poisoned test example without need to know any train poisons attack patterns, offering simpler yet effective defense mechanism.
B Experiment Details
B.1 Poisoned Training Sample Is Not a Reliable Target for Sifluence-Baseed Unlearning
Given that small subset of poisoned training data- commonly referred to as a forget sot (Goel et al., 2024), could be identified as the prerequisite for unlearning, a natural question arises: why A Influence focus on identified affected test sample rather than simply using a poisoned training sample?
One overlooked fact is for some covert attack like Witches' Brew, the attack pattern is different between training and testing, which is not. the case for Frequency Trigger and BadNet. Moreover, the clean-label attack manner and the imperceptible perturbations make notoriously difficult to identify training poisons for such attacks. However, we emphasize that, regardless of how clever and stcalthy an attack is designed, its primary goal to alter model predictions on specific test points, making anomalies more apparent after deployment. Hence we think that having one identified test point is generally more feasible than identifying poisoned training point in this context and better suited for influence-based based analysis, which attributes model behavior to particular training instances.
What's more, as demonstrated in Table 9, taking Witches' Brew as an example, we find that even when defenders can reveal a poisoned training sample, the poisoned behavior cannot be reliably mitigated, while we show that A Inftuence, utilizing an identified poisoned test point, can systematically undo the attack's impact.
This underscores fundamental limitation of how inffuence functions work: influence functions inherently rely on clear causal relationships, where specific training samples directly impact corresponding test-time anomalies. However, in poisoned learning scenarios, such causality is often obscured: while the training poisons as a whole shifts model behavior, it's causal effect with one individual poisoned sample in it could be more ambiguous. This intuition that using a poisoned training sample as the larget is less reliable than using an affected test point, further supported by our empirical findings (as shown in table 9, influence-based methods fail to unlearn poisons when guided by a poisoned train point). We hope this observation provides useful insights for how target selection impacts causal tracing effectiveness in inftuenco-based unlearning.
Based on the above observations, we suggest that using an identified poisoned test point for influence-aased unlearning. Although when the attack pattern is consistent between training and testing (e.g. Frequency Trigger (Zeng et al., 2021) and BadNet (Gu et al., 2019)), using a poisoned training sample as the target also work, We argue that defenders should not assume such prior knowledge, e-g. what attack performed and what the attack pattern is, which rarely available in practice. Hence using a poisoned test point is more reliable and generalizable across different atlack scenarios.
Finally, although it's not the focus of this paper, here discuss approaches to get such test point, realistic sconarios include: (i) whitchat adversarial rescarch teams conducting jailbreaking-style tests to expose failure modes; (ii) Companies internally syalematically st stress-estting for vulnerabilities; and (iii) Companies using anomaly detection algorithms to monitor user interactions for abnormal behavior. Note that determining whether a test point harmful or benign relies on the developer's domain expertise, this largely unexplored area is increasingly necessary due to massive training datasots and the rise of opaque open-source base models, offering promising directions for future research.
18

---

Published in Transactions on Machine Learning Research (02/2026)
B.2 Predefined Set for Image Augmentations
We employ a predefined set of standard image augmentation techniques: Flip, Rotation, Color Jitter, Elastic Transformation, Blur, Inversion, Color Switch, and Random Affine transform. For each transform, one augmentation is randomly selected from this set and applied to the affected test image.
B.3
Attack Methods
The attack target and victim class are chosen at random for each trial. We shall now discuss the details for each attack method below. The relevant code is additionally publicly available in our repository.
BadNet For CIFAR datasets, we add a 3 x 3 checkboaar-ppatereeed black patch (pixel values set to zero) at the bottom-right corner of each 32 32 image. For the Imagenette dataset, we utilize larger square 22 x 22 black patch to ensure successful injection the poison. The mumber of poisoned images varies by dataset: 500 for CIFARIO, 350 for CIFARI00, and 858 for Imagenette.
Smooth Trigger The smooth trigger is generated for each dataset following the algorithm proposed in (Zeng et al., 2021). The number of poisoned images similarly varies by dataset: 500 for CIFAR10, 125 for CIFAR100 and 300 for Imagenette. Since the poison is more powerful, of poisoned samples.
able to poison the model with less number
Witches' Brew The adversarial pattern is generated according to the method described in (Geiping et al., 2021). The number of poisoned images similarly varies by dataset: 500 for CIFAR10, 125 for CIFAR100 and 947 for ImageNette respectively. To ensure successful poisoning Imagenette, we set we set eps=32, which is twice the value used for CIFAR1O and CIFAR100 (eps=16).
B.4 Hyperparameters for Detection Methods
The hyperparameters are optimized through a grid search process to find the best possible values, following the process from Goel et al. (2024). Specifically:
ActClust We set the number of components, Noomp = 3, for all experiments. ActClust quite robust a method, and we find that value of performs consistently best across all experiments.
SpecSig SpecSig involves two hyperparameters: the spectral threshold, used identify significant singular values, and the contribution threshold, used to identify significant data point contributions. SpecSig is sensitive to both parameters. Typically, we select the best spectral threshold by grid search per dataset from the values 4, 6, 8, 10 and the contribution threshold from 7, 9, 11, 13. Higher values indicate a stricter constraint, resulting in fewer detected examples.
Freq For datasets with different image sizes, we train a specialized classifier following the methodology described in (Zeng et al., 2021).
EK-FAC We typically begin with threshold value of 0 and select the best threshold among values (0, 10, 100, 500). Higher threshold values imply stricter filtering constraints, leading to fewer detected examples.
TRAK For this method, we evaluate a range of threshold values (0, 1, 2, 3, 4, 5) and choose the one yiclding optimal results. In our experiments, a threshold of frequently performs best. Higher threshold values imply stricter filtering constraints, leading to fewer detected examples.
Ours Similar EK-FAC, starting with a threshold of 0 is generally effective where we search over (0, -1, -5, -10, 110).. Lower threshold values and smaller notl indicate stricter filtering constraints. For Nhol, We normally search over 0, 1, 2, 3, with proving to be effective in most cases.
B.5 Hyperparameters for SSD
Among the five unlearning methods considered, SSD particularly sensitive hyperparameters but is computationally efficient. This allows for lots of runs to select the optimal unlearning result. For each ex- periment, we evaluate all possible combinations of two SSD hyperparameters, the weight selection threshold,
19

---

Published in Transactions on Machine Learning Research (02/2026)
which controls how protective the selection should be, and the weight dampening constant which defines the level of parameters protection. Specifically, choose the weight selection threshold from values 2, 10, 50 and the weight dampening constant from 0.01, 0.1, 1.
C
Results for Ablating Image-Only and Label-Only Augmentations
Frequency Trigger
Witches' Brew
BadNet
Accuracy(9))
100
86.1
100
100
100
100
CIFAR10
75
75
-75
50
50
50
-30
25
-25
Polsod
Ane Bannd
Aldt tmo Dvly
Best quabni-brpp
(han)
Bell Geld
6iter tlabek
4-ent (Dunc)
0
B-ter tino Ovip
0.4
bund (labri
(more accurate -)
100
100
100
1000
100
better camming)
Test Accuracyy
CIFART 0O
25
66.4
75
75
58.4
75
75
75
50
50
50
50
:50
35.3
25
25
22
4-08t (Okun
dial rmng Depp
Bddd Olad
dder Dhll)
&dd Clazei-nnn)
A-en Dhard
0
A rmp Del
detel (tabet...om
87
and Habel
Accuracy (Retraining)
unlearning)
(Updated)
[Upcated]
Figure 6: Poison Success Rate and Test Accuracy. This table shows both poison unlearning effectiveness and model utility. A method is considered successful if the poison success rate is below 5%. Label augmentations are instrumental towards identifying poisons, even in the clean-label poison cases. Figure structure from (Pawelezyk et al., 2024).
We show in Figure that Label-Only augmentations are effective in removing the data poisoning (lower poi- son success rate), while Image- Only augmentations perform poorly in this regard. However, demonstrated in Table 2, Label-Only augmentations lead to the unnecessary discard of many clean samples, whereas image augmentations significantly reduce the false positive rate, preserving clean data and improving detection precision. Therefore both label and image augmentations are crucial to the effectiveness of the A-Influence method.
D Scaling Experiments
D.1 Will More Identified Poisoned Test Samples Improve Detection?
Setup. For attack methods such as Witches' Brew, only a single affected test point is identified. However, in cases where multiple test points can be identified, such as with BadNet Patch and Smooth Trigger attacks, we explore ways to enhance performance using two infuennc-basel methods: A Influence and EK-FAC, on the ImageNette dataset. Specifically,, we show results when selecting five and ten test points to identify corresponding input points and determine their intersection the poisoned data across both methods. This is done similarly to the A Influence algorithm by retaining points with influence higher than the tolerance threshold, hence EK-FAC is additionally labeled (boosted).
Results. We showcase performance in Table 4 for BadNet poison and Table 5 for frequency trigger poison respectively. We observe a consistent trend: as the set of identified poisons increases, the precision improves significantly, leading to a substantial reduction in false positives and ultimately higher test accuracy.
Conclusions. Overall, identifying multiple poisoned test points enables more precise detection of poisons in the training set when using A Influence-like aggregation algorithms across test poisoned points. The
20

---

Published in Transactions on Machine Learning Research (02/2026)
Table 4: ImageNette BadNet. For BadNet poison on the ImageNette dataset, increasing the number of identified test points significantly improves the precision. This enhancement leads to notable reduction in false positives, thereby achieving higher overall test accuracy.
Influence Methods
Precision(1) TPR(1) Poison Success Rate (1)
Test Accuracy
identified test point
EK-FAC
22.1%
99.1%
0.3%
68.7%
A-Influence
49.0%
100%
0.8%
79.7%
5 identified test points
EK-FAC
25.9%
98.8%
0.3%
73.3%
EK-FACYboosteed
34.2%
98.5%
0.8%
75.4%
A I-flluencee
66.7%
100%
0.5%
80.0%
10 identified test points
EK-FAC
26.6%
98.8%
0.3%
75.8%
EK-FAC(boosted)
48.9%
97. 2%
1.6%
77.8%
A-Influence
67.2%
100%
0.8%
79.9%
Table 5: ImageNette Frequency Trigger. For frequency trigger poison the ImageNette dataset, increasing the number of identified test points significantly improves the precision. This enhancement leads to notable reduction in false positives, thereby achieving higher overall test accuracy.
Influence Methods Precision()) TPR(1) Poison Success Rate (L) Test Accuracy (1)
1 identified test point
EK-FAC
10.5%
99.3%
72.4%
Influence
25.8%
99.3%
75.4%
identifled test points
EK-FAC
12.8%
99.0%
0%
74.4%
EK-FAC(boosted)
21.8%
99.0%
0.3%
74.0%
A-Influence
27.5%
99.3%
0.3%
76.6%
10 identified test points
FK-FAC
12.9%
99.3%
0%
74.1%
24.2%
99.3%
0.3%
73.6%
A-Iulunence
28.7%
99.3%
0.3%
75.0%
number of such test points that can be identified in practice often depends on the specific deployment scenario.
D.2 Hyperparameters for ImageNette
To accommodate Imagenette's larger image sizes and increased complexity, we increase the patch size for BadNet poisoning, use a more intense trigger pattern for frequency-based poisoning, and poison a greater fraction of training images (10%). Additionally, for the Witches' Brew method, we relax the perturbation constraint, setting e = 32 instead of = 16.
E
Does AInfluence Perform the Best Across Unlearning Algorithms?
Setup. The probe was conducted across various detection methods; however, instead of employing the exact unlearning algorithm, we use popular alternative algorithm called SCRUB which involves gradient ascent. We similarly measure the performance as well as the success rate of the poison removal were evaluated. Note the TPR rate and precision do not change.
The evaluation results in Figure 7 shows that A Influence outperforms other methods, unlearning poisons in all six cases with minimal performance loss. In contrast, EK-FAC, ActClust, and SpecSig per- formed randomly, achieving unlearning primarily because even a randomly initialized model would not retain poisoning. Performance drops were primarily due to SCRUB's sensitivity to false positives from its gradient
Results.
21

---

Published in Transactions on Machine Learning Research (02/2026)
Frequency Trigger
Witches' Brew
Bad
100
100
100
1000C
100.0
l05
100.
100
100
100
better unlearning)
Test Accuracy(%) (more accurate
$1.0
Po Poicon Successt
CIFARTO
73
75
75
50
50
50
50
28 2.
32
73
domnt (Durd)
Frested
Actraust
Speciio
dviet (Dam))
IKTAC
Antruus
5-4d (Dua))
Eniic
TRat
CIFART 00 Test Accuracy (mare accurate
100
100
100
2205
1020
100.
103.
1000
100
1.00
100
Polson % better unlearming)
75
75
72.4
50
50
25
0o Lieo
1100 05.00
0. 10
12
1400
33
02
Add (Duns)
Actouu
Speccig
Aeitt (Dun)
Freeded
Actiaus
Sperdiig
Avidd (Dhmn)
Accuracy
Poison Success
Figure 7: Poison Success Rate and Test Accuracy. with SCRUB Unlearning algorithm. This table shows both poison unlearning effectiveness and model utility. A method is considered successful if the poison success rate is below 5%, marked by v, with unsuccessful methods marked by x. A-Influence is successful in 6/6 cases, while the rest fail by not be distinguishable from a randomly initialized model. In contrast, A-Influence has only minor drops test. accuracy. Figure structure from (Pawelczyk et al., 2024).
ascent step. FreqDef avoided randommess but failed to unlearn poisons in cases. Notably, A Influence minimized false positives, maintaining consistent and reliable outcomes.
Conclusions. Infulunncc proves be remarkably robust even across unlearning methods which highly sensitive to false positives. It achieves 6/6 poison removal rate while incurring only minor performance losses due to false positives.
F Comparing Prior Knowledge Requirements Across Detection Methods
While A Influence requires no prior knowledge about the attack implementation, several baseline methods rely, to varying degroes, on cortain assumptions about the attack characteristics. We summarize these assumptions and their limilations below:
1. Frequency-Basee Based Detection (FreqDef) implicitly assumes that poisoning attacks introduce modifications that manifest detectable artifacts in the frequency domain.
Limitation. This assumption may not hold for attacks specifically designed to evade frequency analysis. In our experiments, the Frequency Trigger attack is deliberately crafted to be imperceptible in both spatial and frequency domains, resulting in FreqDef achieving very low TPR (3.2% on CIFAR10, 2.4% on CIFAR100, as shown in Table 1) and high PSR (99.3% on CIFAR10, 93.0% on CIFAR100, as shown in the first column of Figure 3).
2. Activation Clustering (ActClust) relies two strong assumptions: (i) Poisoned samples form separable cluster in the activation space (ii) This cluster is typically smaller than the clean cluster (i.e., poisoning budget is limited).
The method will naturally misidentify clean samples as poisons if an allacker increases the poisoning budget such that poisoned samples become the majority. Furthermore, for some attacks, poisoned samples might have activation patterns similar to clean data, violating the clustering assumption, which may partially explain why the Witches' Brew attack is hard to detect by ActClus (as shown in the second column of Figure 3).
Limitation.
22

---

Published in Transactions on Machine Learning Research (02/2026)
3. Spectral Signature (SpecSig) assumes that, in the activation space, backdoor trigger tends to leave behind a detectable trace in the spectrum of the covariance of feature representation learned by the model.
Limitation. The effectiveness of SpecSig depends on whether the attack trigger indeed produces such spectral patterns As shown in the first column of Figure 3, the Frequency Trigger attack is such a method hard to be detected by SpecSig.
G The Precision Challenge in Poisoning Detection
Despite the poisoning removal effectiveness achieved by A Influence across various datasets and attack methods, the precision of all methods still remains relatively low. This reflects fundamental challenge of poisoning detection: clean samples can exhibit characteristics similar to poisoned samples. This is not only true for the baseline methods, but also for influence-based methods: have high influence scores due to (i) the interconnected nature of learning, which means both that some clean samples might indeed help the model understand an abnormal prediction and even though the poison successfully changes the prediction, other clean signals and features, learned from clean data are still present and contribute to the forward pass of the model (ii) the approximation error of influence functions. Thus, high influence alone does not necessarily indicate poisoning and that's why we propose Influence better separate poisoned samples from clean samples based on Influence Collapse.
think clean samples can also
To further improve precision, we suggest two possible directions:
Aggregated Filtering Mechanism. In addition to A Influeence apply more filtering mechanisms to "purify" the detected set. For instance, use a clean validation set as an additional attribution target of influence functions. Samples flagged by A Influence but showing high positive influence on clean predictions may likely be false positives and could be filtered out. Other non-influence-based filtering mechanisms are also worth considering.
Monitor Influence Change Across Different Attribution Targets. Similar to A - Influence, rather than using static influence scores, tracking how influence changes across different and carefully designed attribution largets might. be worth paying altention to for future research. We believe this shift from "what is the influence?" to "how does influence change?" provides more informative signal. We hope this methodology will inspire better influence-based detection work in the future.
H Robustness to Varied Trigger Patterns
We now provide additional experiments to evaluate our method's robustness when the defender's identified test point contains trigger different from those in the poisoned training set. Specifically, for the BadNet allack on CIFAR-10, we lested two scenarios:
Normal Case. The test point trigger matches the training data triggers (both located in the bottom-right corner)
Varied Trigger Case. The training data triggers are in the bottom-right corner, while the test point trigger is in the upper-left corner
Table 6: Robustness to Varied Trigger Patterns. Performance of A Influence when the test trigger location varies. We report (Test Accuracy / Poison Success Rate) for unlearning performance.
#Suspicious Precision
TPR
EU
CF
SSD
Scrub
BadT
Normal
2815
17.6%
99.1%
91.8% / 0.0%
33.0%
0.0%
17.4%
0.1%
81.7% / 0.0%
91.2%
68.8% 26.8%
Varied Trigger
1978
24.6%
97.2%
92.4% / 0.0%
93.0%
0.0%
12.0%
0.0%
91.2% / 0.0%
91.9%
As shown Table 6, Delta-Influence demonstrates strong robustness in both scenarios and most unlcarning methods (EU, CF, Scrub) successfully remove the poisoning effect in both cases, with test accuracy well maintained. These results align with our findings in Section 4 of the main paper.
23

---

Published in Transactions on Machine Learning Research (02/2026)
Controlled Detection Budget Analysis
Table 7: Controlled Detection Budget.
Comparison of detection and unlearning performance when
controlling the number of suspicious samples to be approximately equal (~2800).
Method
# #Suspicious
Precision
TPR
Test Acc
PSR
A - Influence (Ours)
2815
17.6%
99.1%
91.8% / 0.0%
EK-FAC
3048
0.3%
1.8%
91.0%
99.7%
TRAK
3172
0.06%
0.4%
91.2% / 99.7%
Frfq
2958
12.0%
71.0%
91.4%
/ 78.3%
SpecSig
2563
13.2%
67.8%
91.9%
/ 86.6%
Table 8: Number of Suspicious Samples. We provide the detailed number of suspicious samples identified by each method reported in Table of the main paper.
Method
CIFARIO
CIFARI00
Frequency Trigger
Witches' Brew
BadNet
Frequency Trigger
Witches' Brew
BadNet
SpecSig
33962
34571
12264
19600
14667
22239
ActClust
22523
22238
21568
20833
23000
21066
FreqDef
4000
4588
4519
3000
5444
5659
TRAK
25214
24901
24632
24200
30000
24999
EK-FAC
17241
10875
11982
13444
14750
7656
Influence (Ours)
3759
2939
2815
4310
3714
909
In addition to the results presented in Table 1 of the main paper, we report the exact number of suspicious samples identified by each detection method in Table 8. As we can see, different methods identify vastly different numbers of suspicious samples. To further analyze the detection performance under a controlled setting, we conduct additional experiments where we fix the number of detected suspicious points to be approximately equal across all methods by manually tuning their for BadNet on CIFAR-10, we controlled the number of detected suspicious samples (#Suspicious) to approx- imately 2,800 across all detection methods, then applied the Exact Unlearning (EU) method for unlearning. Note that do not. include Activation Clustering (ActClustt in this controlled experiment because its clustering- based approach does not allow such fine- tueeggrined control. The results demonstrate that even when all methods flag a similar number of suspicions samples, A Influence significantly outperforms basclines in both precision (17.6%) and TPR (99.1%), achieving complete poison removal (PSR = 0.0%) while maintain- ing high test accuracy (91.8)). In contrast, EK-FAC and TRAK exhibit extremely low precision (0.3% and 0.06%) and fail to identify true poisons (PSR > 99%), while FreqDef and SpecSig achieve moderate perfor- mance but still cannot adequately remove poisoning (PSR 78.3% and 86.6%). This controlled comparison further validate A Influence's superior performance.
As shown in Table 7,
J Compute Resources and Time Cost Analysis
We used a single NVIDIA A100-80GB GPU for all experiments. Note that A Influence has higher com- putational cost compared to non-influence-basel baseline methods (e.g. Activation Clustering) because the influence function computation itself is time-costing In practice, CIFAR-10 with n4 50 transfor- mations, detection averages 33 minutes per affected test point (39.6 seconds per transformation).
We believe such computational cost is acceptable for corrective unlearning scenarios for several reasons. First, detection a one-time time cost triggered only when anomalies are observed. Second, the time can be substantially roduced through engincering optimizations: (i) parallclizing influence computations across transformations (which are independent), and (ii) leveraging ongoing improvements in influence function implementations. Third, and most importantly, preventing deployment of poisoned models justifies the computational invest-
24

---

Published in Transactions on Machine Learning Research (02/2026)
ment-333 minutes for detection is negligible compared to the potential damage of undetected backdoors in
safety-critical systems. We emphasize that our focus is on detection effectiveness rather than computational optimization and believe that the trade-off between computational cost and detection accuracy strongly favors accuracy in security-critical scenarios.
According Grosse al. (2023), the per-query time complexity of EK-FAC is:
( t=1
where L is the number of layers, Me is the input dimension, and Pt is the output dimension of layer L. The computational cost of TRAK is approximately:
M x [model_training time + cetflent_compuuatiinn time),
where M denotes the number of trained models.
Additionally, the time complexities of ActClut and SpeeSig are O(Nk2 and O(Nd²) respectively. Here, N represents the number of training samples, d is the dimension of the target layer, and k is the reduced dimension. For the FreqDef, the computational overhead is negligible, depending primarily inference time once the detector model is trained.
We kindly refer readers to the original papers for more detailed analyses of the computational complexities of these baseline methods.
K The Causal Pitfall of Targeting Poisoned Training Sample
Setup. We investigate whether directly using known poisoned training sample as the attribution target for influence functions can still effectively detect and unlearn poisons (although such availability can be hard to achieve for attacks like Witchos' Brew).
Results. As shown Table 9, for CIFAR-10, when the attribution target. is a training poison, A Influence fails to achieve successful unlearning. This is indicated by the Poison Success Rate remaining at 100%, which significs that the attack remains fully effective. This inconsistent performance demonstrates that poisoned training samples are unreliable attribution largets for influence-based delection.
Table 9: Failed Unlearning When Targeting Known Poisoned Training Point. Comparison of using affected Test point versus known Train poison the attribution target.
Identified Point TPR(f) Poison Success Rate (4)
Test Accuracy (1)
CIFAR10
Test Train
19.4%
0%
91.0%
8.4%
100%
90.3%
CIFAR100
Test Train
62.4%
0%
71.9%
84.0%
0%
71.9%
Conclusion. These results justify our choice of using the attribution target from the deployment phase (ie., test point) instead of training phase. The latter approach yields inconsistent unlearning performance because the causal dependency among poison peers weaker than the collective influence all poisons on an affected test point. Our choice therefore grounded in a causal perspective: the goal is to find training examples responsible for a specific erroncous prediction, making the prediction itself the logical starting point.
25

---

Published in Transactions on Machine Learning Research (02/2026)
L Limitations
A -Influence is based on influence functions and hence inherit their drawbacks. Possible attacks like those are only injected during test phase can evade our delection. Also, specially designed adversarial attacks against influence functions can hinder the effectiveness of our method. However, to our best knowledge, there are currently no poisoning attacks specifically designed to evade influence function-basse detection. We hypothesize this may be because such an attack would face fundamental tension: (1) To successfully cause abnormal prediction (the attack's objective), poisoned samples must significantly contribute to the affected test point's prediction matter how the attack method is designed. Hence they, naturally, have high influence scores. (2) However, to evade influence-based detection, they would need to maintain low infiuence scores on that same test point. Reconciling these causal contradictory requirements might be inherently challenging. Nevertheless, we believe investigating robustness against potential adaptive attacks that might attempt to manipulate influence scores remains an interesting and important direction for future research.
26


Reviews:
[{"review_id": "HqpNsKS9hd", "reviewer": "Reviewer_ZEF4", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "No", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "This paper introduces a method for identifying compromised training samples based on the phenomenon of influence collapse. It proposes a Trojan behavior mitigation algorithm that unlearns identified corrupted samples. Specifically, the paper suggests measuring changes in influence function values after applying multiple transformations to a single captured Trojan example. The authors observed that for Trojan-corrupted training samples, the influence function value significantly decreases after transformation, unlike in clean examples. This phenomenon is termed influence collapse. The proposed algorithm identifies Trojaned training data points by examining the proportion of predefined transformations that exhibit influence collapse. Finally, the paper proposes eradicating Trojan behavior by unlearning the identified suspicious data points.\n\nEmpirical studies were conducted using three publicly available datasets under three different backdoor attack scenarios. Multiple detection baseline methods were compared to demonstrate the advantages of the proposed method. Additionally, ablation studies were performed to further support the contributions of the research.", "claims_and_evidence_yn": "No", "claims_explanation": "To thoroughly evaluate the contribution of the proposed method, I would appreciate further clarification on several points:\n\nTrigger Variability in Attacks: It is common for attackers to employ multiple triggers rather than a fixed one. For instance, in the BadNet attack, triggers are typically placed randomly on the four corners of corrupted images with position jittering, rather than being fixed. How does the algorithm perform when the captured Trojan examples have triggers that differ from those used in the rest of the training set? \n\nImpact of Filtering Threshold: It appears that precision, rather than recall or AUC, is the key driver of mitigation performance in fixing Trojaned network. This leads to my second question: What is the total number of data points identified by each baseline method? It seems that $\\Delta$-Infl identifies fewer data points than other methods but with higher precision. What would be the outcome if all methods identify the same sets of corrupted data by adjusting the filtering threshold and then unlearned roughly the same number of suspicious data points, instead of selecting hyper-parameters by optimizing Precision/TPR/AUROC on a validation set?\n\nRelevance of the Unlearning Algorithm: The unlearning algorithm appears somewhat peripheral to the main contribution of the study. As shown in Table-1, while $\\Delta$-Infl exhibits superior precision, it underperforms in AUC compared to baseline methods across several settings, complicating the interpretation of results. It is important to consider that some mitigation algorithms might prioritize a high recall detector over a high precision one. A straightforward heuristic approach could involve fine-tuning the Trojaned network on the complementary set, rather than unlearning the detected set.", "audience_yn": "Yes", "audience_explanation": "The paper addresses AI security and the mitigation of backdoor attacks on neural networks, a critical topic in contemporary AI research. This subject is likely to be of significant interest to the TMLR audience.", "requested_changes": "I would appreciate the inclusion of the following ablation study results to enhance the paper:\n\nDetection of Corrupted Points with Varied Triggers: it would be valuable to conduct experiments on detecting corrupted points where the unique captured Trojan example has a trigger different from those used in the rest of the dataset. For instance, how does the algorithm perform if the defender's example has a trigger on the bottom right corner, while all other triggers in the corrupted database are located in the upper left corner? Similarly, how does the algorithm respond if the defender's example uses a trigger generated with low-pass filter 1, whereas others use low-pass filter 2?\n\nAblation on Filter Threshold: Please report the number of suspicious data points identified by each method. Instead of tuning the filtering threshold on a validation set, consider selecting a threshold to identify approximately the same number of corrupted data points across methods. Varying this predetermined number could provide better insights into the transition of performance.\n\nFinetune on complementary set: It would be advantageous for the authors to investigate fine-tuning the Trojaned model on the complementary set, rather than solely concentrating on unlearning the detected set. Conducting this ablation study could help mitigate bias in selecting an unlearning algorithm that favors a high-precision detector over a high-recall detector. This analysis should be performed in comparison with the strongest competitors listed in the baseline.", "broader_impact_concerns": "Not relevant", "additional_comments": "", "extra_scores": {}, "extra_text": {}}, {"review_id": "vn7uZiKCiD", "reviewer": "Reviewer_zZff", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "This paper presents a defense against poisoning attacks that combines data attribution, an explainability method, with machine unlearning to identify and remove the poisoned training instances that negatively influence a prediction on a given test instance. In particular, the proposed method, called $\\Delta$-influence, consists of three steps, consists of three steps, given only one suspicious test instance: for each training sample, apply the influence function method, manipulating the test instance through label flipping and a set of input transformations (e.g., rotation), thereby creating an ensemble of influence scores, one for each transformation; (ii) if more than a certain fraction of these scores are negative, classify the corresponding training instance as poisoned; (iii) use an unlearning method to remove the flagged poisoned instances.\n\nThe experimental evaluation considers two computer vision datasets, five defenses against poisoning and three poisoning attacks from prior work. The evaluation is comprehensive and compares the proposed defense against existing methods, it assesses its performance under different attacks and includes ablation studies to quantify the impact of the input transformations and the effect of unlearning only the detected poisoned instances on model accuracy and robustness. The results highlight that the proposed method is more effective at identifying the correct poisoned instances than other defenses, although the overall efficacy of the framework also depends on the chosen unlearning algorithm.", "claims_and_evidence_yn": "Yes", "claims_explanation": "The experimental evaluation is comprehensive and effectively supports the effectiveness of $\\Delta$-Influence compared to popular baselines for detecting and unlearning poisoned instances in the training set. The proposed method is more precise in detection, as demonstrated by its higher true positive rate and precision relative to the baselines, and it also has a more desirable effect on the affected classifier, since it effectively removes the poisoning impact without inducing a significant loss in accuracy. Moreover, the ablation study quantifies in a clear way the contribution of the different components of the method, such as the use of input transformations and the choice of unlearning algorithm.", "audience_yn": "Yes", "audience_explanation": "The scientific community is concerned about the effects of data poisoning and the potential ineffectiveness of unlearning against such attacks. A technique that can accurately identify and remove poisoned training data from just one compromised test instance and that outperform the other state-of-the-art methods would certainly be of interest to the scientific community that reads TMLR.", "requested_changes": "I would suggest the following additions to the paper, which are desiderata rather than conditions for acceptance:\n- In Section 3.2, in the “Conclusion” paragraph, it is stated that the proposed method requires no prior knowledge about the poisoning attack. This is correct, but it would be even better to clarify, for comparison purposes, which of the other baselines do require knowledge about the attack. Such a clarification would further highlight the merits of the proposed method.\n- It would be helpful to provide some intuition regarding the results in Table 1. Why is the true positive rate of all baselines, not only the proposed method, below 50%? Can we derive any insights that might guide future improvements in detection methods? While the proposed method obtains a higher true positive rate than the baselines, providing an explanation for this point would be a nice addition to the paper.\n- The paper states as a limitation that adversarial attacks against influence functions can hinder the effectiveness of the proposed method (Appendix F). Demonstrating the robustness of the method against some of these attacks could further strengthen the work, although this is not necessary and could be left for future investigation (another paper ;) ).", "broader_impact_concerns": "No impact concerns to signal.", "additional_comments": "I invite the authors to address the following typos and editorial issues:\n- Please check the use of parentheses in:\n   - _Pawelczyk et al. (2024)_, page 1.\n   - _(Chundawat et al., 2023))_, page 5.\n- On page 1, the sentence “_To address this limitation, we introduce ∆−Influence, a novel approach that enhances influence_” appears to present the method for the first time, although ∆−Influence has already been introduced earlier in the text. I would suggest rephrasing this sentence here.\n- The domain of the pair $z = (x, y)$ in Section 2.1 should be defined.", "extra_scores": {}, "extra_text": {}}, {"review_id": "h8mJIS4CWY", "reviewer": "Reviewer_2vCv", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "No", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "**Summary**: This paper studies the detection of targeted data poisoning attacks and backdoor attacks. Given a test sample affected by poisoning, the authors propose using a modified influence function to identify the corresponding poisoned samples in the training set. Specifically, they introduce the delta-influence function, which measures the difference in influence between a transformed test sample and its original version. The authors demonstrate the detection capability of their proposed method across three attacks and two datasets, comparing it against other detection methods and influence functions. They further remove the identified poisoned samples using existing unlearning methods.\n\n**Key Strengths**: The paper addresses an important problem: detecting poisoned data under a unique threat model that assumes a given affected test sample. The problem is well-motivated by the gap in the unlearning literature, where identifying poisoned data is a prerequisite but remains understudied. The proposed delta-influence function is interesting and well-justified. The experiments convincingly demonstrate that the proposed method outperforms other detection methods.\n\n**Key Weaknesses**: (1) The paper is not truly about unlearning; (2) The threat model is not well-defined and does not appear particularly practical; (3) The paper is restricted to targeted attacks only; (4) The experimental setting is vague and several takeaways are unclear.\nI will elaborate on these points in detail below.", "claims_and_evidence_yn": "No", "claims_explanation": "**[1. Data poisoning attacks]**: The paper studies a small subset of data poisoning attacks (one targeted attack and two backdoor attacks) and overlooks many other data poisoning attacks in the literature. Specifically, the paper assumes that each attack affects only one test sample (or those containing a trigger), which is not applicable to indiscriminate attacks that affect the entire test set. The authors should clearly identify the attack vectors studied and discuss the potential generalization of their observations to other attacks, including those effective against generative models.\n\n**[2. Threat model]**: The threat model and assumptions underlying the detection process are not formally defined. The authors assume that the defender has access to a small set of affected test points, but how would one determine whether a test sample is affected by data poisoning or simply reflects a model deficiency? Moreover, targeted attacks and backdoor attacks present different challenges. For targeted attacks, does the defender know the true label? For backdoor attacks, does the defender know the trigger?\n\n**[3. Necessity of the proposed method]**: Following the previous point, if a defender already possesses such knowledge about the test set, why would the proposed pipeline (influence function, detection, unlearning) be necessary? Since these attacks do not significantly affect model accuracy, simply correcting the misclassifications or removing the identified triggers would address the problem.\n\n**[4. Unlearning]**: The title of the paper, \"Unlearning Poisons via Influence Functions,\" suggests a new unlearning algorithm using influence functions. However, the paper is fundamentally about detecting poisons using influence functions, with unlearning as a natural next step (though whether this step is necessary still requires discussion). I believe the current presentation, especially the title, is misleading and needs to be revised.\n\n**[5. Experimental Details]**: \n- It is unclear how the authors select the poisoned test samples and determine the number of samples to consider. This raises the question of whether the results are biased. Specifically, the results in Figure 4 appear very different from the observations in Pawelczyk et al., and I wonder whether the authors chose the same test samples.\n- The caption for Table 1 discusses PSR, which does not appear in the table. This is very confusing.\n- The attribution analysis of the Witches' Brew poisoning subset is interesting, but it would benefit from generalization to a larger number of test samples.\n- The authors should also include the time complexity of the proposed method compared to other baseline methods to justify its feasibility.", "audience_yn": "Yes", "audience_explanation": "The paper would be of interest to audiences interested in detecting targeted data poisoning attacks and backdoor attacks.", "requested_changes": "1. Include a literature review on data poisoning attacks, specify the studied types of attacks, and justify the choice.\n\n2. Define the threat model and assumptions properly, and justify why the proposed method is necessary.\n\n3. Adjust the presentation and titles, tune down the claim on \"unlearning with influence function\".\n\n4. Add descriptions on how the test samples are selected and how many trials of experiments are performed (e.g., error bars).\n\n5. Revise the caption of Table 1.\n\n6. Specify the setting of Table 3.\n\n7. Include time complexity to justify feasibility.", "broader_impact_concerns": "NA", "additional_comments": "", "extra_scores": {}, "extra_text": {}}]

Author rebuttal:

Decision: Accept (poster)