Hard Work Does Not Always Pay Off: On the Robustness of NAS to Data Poisoning
Authors: Zachary Coalson
Huazheng Wang
Qingyun Wu
Sanghyun Hong
Venue: Accepted by TMLR ()

Abstract: We study the robustness of data-centric methods to find neural network architectures, known as neural architecture search (NAS), against data poisoning. To audit this robustness, we design a poisoning framework that enables the systematic evaluation of the ability of NAS to produce architectures under data corruption. Our framework examines four off-the-shelf NAS algorithms, representing different approaches to architecture discovery, against four data poisoning attacks, including one we tailor specifically for NAS. In our evaluation with the CIFAR-10 and CIFAR-100 benchmarks, we show that NAS is seemingly robust to data poisoning, showing marginal accuracy drops even under large poisoning budgets. However, we demonstrate that when considering NAS algorithms designed to achieve a few percentage points of accuracy gain, this expected improvement can be substantially diminished under data poisoning. We also show that the reduction varies across NAS algorithms and analyze the factors contributing to their robustness. Our findings are: (1) Training-based NAS algorithms are the least robust due to their reliance on data. (2) Training-free NAS approaches are the most robust but produce architectures that perform similarly to random selections from the search space. (3) NAS algorithms can produce architectures with improved accuracy, even when using out-of-distribution data like MNIST. We lastly discuss potential countermeasures.

Published in Transactions on Machine Learning Research (12/2025)
Hard Work Does Not Always Pay Off: On the Robustness of NAS to Data Poisoning
Zachary Coalson
calkonn@@orggonstttte..d
School of Electrical Engineering and Computer Science
Oregon State University
Huazheng Wang
huazheng, wang edu
School of Electrical Engineering and Computer Science
Oregon State University
Qingyun Wu
gingyun. ww@psu. edu
College of Information Science ond Technology
Penn Stale Universily
Sanghyun Hong
sanghypunhhongg@rrggnssaaa
School of Electrical Engineering and Computer Science
Oregon State University
Reviewed on OpenReview: /t openrevee.. net/ forum? id- Uhayg3Ia99
Abstract
We study the robustness of data-centric methods to find neural network architoctures, known as neural architecture search (NAS), against data poisoning. To audit this robustness, we design poisoning framework that enables the systematic evaluation of the ability of NAS to produce architectures under data corruption. Our framework examines four off-the-shelf NAS algorithms, representing different approaches to architecture discovery, against four data poisoning attacks, including one we tailor specifically for NAS. In our evaluation with the CIFAR-10 and CIFAR-100 benchmarks, we show that NAS seemingly robust to data poisoning, showing marginal accuracy drops even under large poisoning budgets. However, we demonstrate that when considering NAS algorithms designed to achieve a few percentage points of accuracy gain, this expected improvement can be substantially diminished under data poisoning. We also show that the reduction varies across NAS algorithms and analyze the factors contributing to their robustness. Our findings are: (1) Training based NAS algorithms are the least robust due to their reliance on data. (2) Training- free NAS approaches are the most robust but produce architectures that perform similarly to random selections from the search space. (3) NAS algorithms can produce architect ures with improved accuracy, even when using out-of-distribution data like MNIST, We lastly discuss potential countermeasures.
1
Introduction
Recent years have seen success stories of a data-centric approach to designing neural network architectures, namely neural architecture search (NAS) (Liu et al.] 2018b Real et al., 2019 Liu et al.] 2018a Zoph & Le 2017 Zoph al., 2018). Given a dataset and a prodefined search space of architectural choices, NAS algorithms iteratively explore architectures that optimize specifie objectives. A common objective is to maximize validation accuracy: during search, NAS selects architectures that perform the best on the data. This approach has shifted the paradigm from manual engineering to automated neural network design, facilitating the improvement of seminal architectures such as Transformers (So et al. 2019
Research has warned that approaches to "learning" system internals from external data may introduce a critical dak-data poisoning. A data poisoning adversary compromises subset the training data with the objective of inducing malicious outcomes. Most existing work on poisoning attacks focuses on adversaries who manipulate the training process of neural networks and induce multitudes of adversarial effects to trained

---

Published in Transactions on Machine Learning Research (12/2025)
models, such as performance degradation (Stcinhardt et al., 2017 Lu et al.
2022 2023
Zhao & Lao 2022
backdoors (Geiping et al. 2021: Huang et al. 2020 Shafahi et al., 2018 Aghakhani et al. 2021 or the leakage of sensitive information (Wen et al. 2024 Chen et al. 2022). However, to the best of our knowledge, it remains an open question whether an adversary can, by only compromising the with-t altering the search algorithm negale the benefits of NAS and cause it to produce "sub-optimal" architectures.
In this work, we address this knowledge gap by studying the following research question: How vulnerable are NAS algorithms to data poisoning attacks? We particularly focus on the performance improvements achieved by architectures produced by NAS and assess how data poisoning can undermine these gains. Poisoning adversaries can introduce adversarial distributional shifts, such that when the compromised data is used for architecture search, the victim NAS algorithm generates architectures that deviate significantly from optimal, leading to, for instance, degraded performance. This threat is particularly alarming because NAS is purely empirical, making it challenging to identify whether generated architectures are truly sub-optimal.
1.1 Contributions
We first present a framework for systematically studying the robustness of NAS algorithms against data poisoning, Designed for auditing, the framework operates under white-box assumption, in which the adversary knows the NAS algorithms. But, certain black- box poisoning attacks do not require such knowiedge. Our framework includes four attacks, one of which is specifically tailored for NAS. We also develop a testing methodology and a metric to quantify the performance gains of architcctures generated by NAS.
Second, we comprehensively evaluate NAS algorithms using our framework. To conduct a systematic comparison, we carefully choose four recent NAS algorithms that share similar search spaces but operate using different paradigms: training-based, training-free, and hybrid. We run each attack ten times, exceeding the standard practices established in prior work (Liu el al. 2019). We make the following intriguing findings:
(1) The NAS algorithms we examine are seemingly robust to data poisoning attacks, when evaluated using the standard metric, accuracy. But, when assessed with our proposed metric, their performance gains are significantly degraded- by as much as 156%.
(2) Training-basee NAS is the most vulnerable poisoning, whereas training- frree methods show the most resilience. However, when run on clean data, training-based methods produce architecturos with the highest accuracy, followed by hybrid approaches, while training- free methods achieve the lowest accuracy, suggesting a potential roblity-souustness trade-off.
(3) Our in-depth analysis raises open questions. Training-fre algorithms show insensitivity to the training distribution and generate architectures that perform comparably to those randomly selected from the search space, questioning their ability to find high-quality, dataset-specifie architectures.
(4) The NAS algorithms we examine, even when run on out-of-distribution data such as using MNIST for discovering CIFAR-10 architoctures still produce architectures that perform well, and in some cases, even outperform those found using CIFAR-10 itself.
We lastly review existing defenses against poisoning attacks, with focus on their applicability NAS. We evaluate (hree defenses and demonstrate that they are ineffective in mitigating the impact of data poisoning.
2 Preliminaries
Neural architecture search (NAS) is automated technique for designing neural network architectures. Given a datasct, search space, and objective, NAS algorithms itcratively sample architectures from the search space and select the best-performing candidates. The search space defines the possible archilectural choices, including layer types, configurations, and connections. The sampling process is designed to optimize the given objective, typically validation performance (Liu et al. 2019 Pham et al.) 2018 Zoph & Le (017). But recent studies incorporate additional objectives, such as latency and computational efficiency (Cai al.
2019
Tan et al. 2019 Lu et al. 2019 2020
2

---

Published in Transactions on Machine Learning Research (12/2025)
Differentiable NAS enhances efficiency by formulating architecture search a continuous optimization problem (Liu et al. 2019 Cai et al. 2019 Xu et. al. 2020). Instead of sampling discrete candidates, these algorithms train a supernet that encodes all possible architectures. The supernet includes architectural parameters that weight different operations in the forward pass. These operations are commonly fused as:
Σ exp (a!
(x)))
OEO Eo exp (a (a. d(x),
where O is the set of candidate operations, and (6.)) is a parameter that weights operation o between layers and j. This formulation enables the simultaneous bi-level optimization of architectural parameters and supernet weights. A final discretized architecture is derived by selecting the heghtet-weighhtd operations.
Training-free and hybrid NAS are more recent approaches that forgo architecture training and instead assess candidates with officint-to-commptee training-free metrics (He al. 2024: Chen et al. 2021| Shu let al.) 2)) These metrics estimate architecture quality based on expressivity (Xiong al.) 2020 trainability (Jacot et al. 2018), and other data-agnostic properties and can be computed orders of magnitude faster than full model training. Training-free NAS selects architectures solely based on these metrics, bypassing model training. Hybrid NAS balances efficiency and performance by incorporating limited training e.g., to
inform Bayesian
search (Shu et al. 2022b He et al. 2024 Shen el al. 2023).
Data poisoning is a training-time attack where the attacker injects carefully crafted poisoned samples into the victim's training data to induce the models trained on the compromised data to behave maliciously. A typical objective of poisoning atlacks is indiscrininate performance degradation (Steinhardi al. 2017 Zhao
& Lao 2022 He et al.)
2023
Lu et al. 2023 while targeted attacks cause misclassification of specific test Geiping et al. 2021), increase privacy or teach models to misclassify inputs
samples (Shafahi et al.
2018
Aghakhani et al.
2021 Huang ct al.
2020
leakage of sensitive training data (Wen et al.
2024
Chen et al.) 2022].
with a learned trigger pattern (known as backdooring) (Gu et al.
2019 Liu et al. (018c). Our work studies
indiscriminate attacks in a new setting: we deviate NAS algorithms from finding optimal architectures.
3
The Auditing Framework
3.1
Threat Model
We consider data-poisoning adversary that exploits the inherent "data-centric" vulnerability of NAS. The attacker aims to degrade the performance of architectures produced by the victim's NAS algorithm when it is on tampered data. By manipulating the data used in the scarch process, the adversary can mislcad NAS into selecting suboptimal architectures. This is particularly problematic because there is no oracle that can determine the best or worst architectures NAS can discover before running the search. As a result, the victim must trust that the identified architecture is optimal, even if it has been manipulated.
Capabilities. We assume that the tacker has the capability to compromise the dataset used for running NAS algorithms. Recent studies demonstrate that large-scale data poisoning practical (Carlini al. 2024). e.g., an attacker can host malicious images publicly accessible websites, such GitHub Pages, to increase the likelihood that the victim will collect and use these poisoned samples. The scale makes it challenging to manually filter out, suspicious samples. We denote the attacker's poisoning budget as p. Prior studies typically consider < 1%, which we adopt as our practical budget. We further explore stress-testing scenarios where the adversary compromiscs up to 50% of the dataset to reveal cach attack's 's worst-case outcomes.
Knowledge. Because we focus on auditing, we assume a white-box adversary with knowledge of the victim's 's NAS algorithm. However, we emphasize that only one of the four poisoning attacks we evaluate requires this assumption, while the remaining three can operate in a black-box manner.
3.2 (Our) Data Poisoning Attacks
We conduct our evaluation on image classification benchmarks, where existing poisoning attacks against models trained for this task are broadly categorized into two types: dirly-label attacks, which manipulate
3

---

Published in Transactions on Machine Learning Research (12/2025)
the labels of training samples, and clean-label attacks, which subtly modify images while preserving labels. A naive attacker may not employ a sophisticated strategy but instead randomly manipulate either labels or images. In contrast, an advanced adversary leverages carefully-designed poison-crafting algorithms to maximize the impact of their poisoning samples. We consider these axes comprehensively and include the Tollowing four poisoning altacks in our framework:
Dirty-label poisoning attacks. The first attack we consider is random label-flipping (RLF), which flips training data labels to randomly chosen alternatives. RLF serves as measure of the impact of label noise NAS performance (Northeutt al. 2021
In contrast, & sophisticated adversary may flip labels in a manner that maximizes performance degradation. To Lest against, this adversary, we also develop confidence-based label-fipping (CLF). CLF atlacks select labels to flip based on the confidence of pre-trained (surrogate) neural network. We first rank all the training samples based on the surrogate model's prediction probabilities-icc. the logit value of each sample's most likely class. Next, we flip the labels the least likely classes. By compromising samples that surrogate model classifies with high confidence, CLF increases task complexity, making it more difficult for NAS to effectively "learn" optimal architectures compared to RLF. We show the detailed algorithm in Algorithm
Algorithm Confidence- Based Label-Flipping
Require: Surrogate model F()), training images and labels (#4, y:) poisoning budget 1: Initialize empty array for logits: Z f-
2: for i 1,2...... . do
2; + f F(z;)
// store logits of 8th training example 6: Sort 2 by max(2;) for all 2;), ) in decrcasing order // sort by maximum logit to find the most confident. samples
(oppend(zz,,
end for
7: Initialize array for poisons: P +- 0
8: for
Tp do (z/,, Z,
10: argminn
// //set set new label to least confident class
11: Zappend((1/:12)
12: end for
13: return poisoned samples P
Clcan-label poisoning attacks. We first consider Gaussian noise, which represents the weakest form of a clean-label attack. adds Gaussian random noise ~ (O, o²I) 1) to datasels. While not typically classified as a data poisoning attack, it has been extensively studied as an image-level corruption (Hendrycks Dietterich 2019 Rusak et al.) 2020p. To ensure meaningful perturbations without overly degrading image quality, we set to 16 and bound the noise using an -oom of 16-pixels.
We also employ gradient canceling (GC) [Lu et al. 2023 the current state-of-the-art, clean-label, indiscrimi- nate attack. It first utilizes the GradPC framework (Sun et al. 2020) to generate a set of target parameters (weights and biases) that are close to the model's original parameters, yet lead to degraded performance. GC then crafts poisoning samples that, when injected into the training data, manipulate the training dynamics. They induce gradient updates that counteract those from clean data, effectively forcing the model to converge to the target parameters generated by GradPC.
Moreover, we adapt the existing GC attacks for NAS, introducing NAS-specific GC, which varies the victim's NAS algorithm. For training-free free and hybrid NAS, instcad of crafting poisoning samples based on predefined larget model parameters, we generate them using the parameters of the final architectures trained on clean data. For training-bast based NAS algorithms, we adapt GC to target the architecture parameters from which gradient-basod poisoning can be derived. This ensures that the poisoning process directly influences the architecture selection process, rather than targeting a sred-trained model. Here, we assume the attacker knows the victim's 's NAS algorithm and its selection process.
4

---

Published in Transactions on Machine Learning Research (12/2025)
Algorithm Gradient Canceling Lu et al. (2023)
Require:
Victim model {F(.). 0), training images and labels (#i, M:) poisoning budget perturbation bound E, number of optimization steps S.
1:
Randomly sample a subset P S {I,, y4 )i=1 of size up as poisons
Initialize perturbation mask: E Rupxe
// C the size of one image
Compule Gelean + n >i=1 VoLxo (F (x:),
for t = 1, S do
5: Apply poison mask: P' t- (x; + + A.)E 1
6: Compute Padv + PP] Σ DEP (o
7: Compute loss: L f- 21((1 - p) Jelean + p- gadv 12
// " "cancels" clean gradients with poisons
Update A with a step of Adam and project onto | 00 S
end for
10:
return poisoned samples (z: + Di, Wi).EP
We present the final attack in Algorithm 2 We adopt the official GC implementation (uu et al. 2023 with a few minor modifications. The original work uses SGD with momentum for optimization, but we employ Adam (Kingma & Ba 2017) as we find it consistently produces lower-loss poisons. It also does not consider the standard perturbation bounds in the clean-label literature (Huang et al. 2020 Geiping et al. 2021 Aghakhani et al. 2021). To achieve consistency with prior work, we introduce an l. -orm bound moderated by the hyperparameter E, We did not observe substantial differences in attack success when using 16.
For TE-NAS, RoBoT, and NSGANetV2, F(-) is fully trained architecture from the search space, and 0 its weights and biases. To craft poisons P-DARTS, F(-) is set to converged supernet and 0 its architectural parameters controlling the weight of operations. In both cases, we first perturb the target parameters 0 using GradPC (Sun et al., 2020), which performs bounded parameter updates that increase the cross-entropy loss to decrease performance. We refer readers to the original work (Lu el al., 2023 for more details.
3.3 Testing Methodology and Metric
Methodology. Our primary objective is to evaluate the impact of data poisoning on architectures produced by NAS algorithms. To achieve this, we carefully design our testing methodology to isolate the impact of poisoning samples on the architecture selection process while ensuring that model training remains unaffocted. In all our experiments, we run NAS algorithms on the lampered data to select architectures but we train the generated architectures from scratch using clean data. This approach makes sure that any observed degradation in performance is attributable solely to the influence of poisons NAS, rather than the training process iisef-iie., model parameters are not affected by poisons.
Metrics. The standard metric for assessing the impact of poisoning attacks is classification accuracy (or accuracy). A straightforward approach to measuring attack effectiveness is to evaluate the accuracy of architectures produced by NAS algorithms after being trained from scratch on clean data. However, accuracy alone is not sufficient metric to fully capture the impact. of data poisoning architectures. NAS algorithms are not designed to transform poor architectures into good architectures; rather, they aim to refine good architectures into great ones. Even without NAS, existing architectures (or archilectures randomly sampled from the search space) already achieve over 95% accuracy on CIFAR-10, 10, and the improvements reported in prior work are typically a few percentage points, c.g., from 95% to 97%. To better quantify the impact of poisoning attacks on the improvement NAS provides, we design an additional metric Almprovement (Almp.): the percentage point change in accuracy between the architecture produced by NAS algorithm running on tampered data and an architecture randomly sampled from the same search space. Almp. better captures how poisoning attacks degrade the intended performance gains of NAS.
3.4 Selection of NAS Algorithms
We consider NAS algorithms based on the following criteria: (1) Comprehensiveness we ensure the in- clusion of diverse NAS approaches: training-hased, training-free, and hybrid algorithms; (2) Recency and
5

---

Published in Transactions on Machine Learning Research (12/2025)
representativeness prioritize NAS algorithms that have been recently introduced and are gaining popu- larity; and (3) Computational efficiency beecaue because running NAS algorithms can take from a few to hundreds of GPU hours, we select those that can be efficiently run within a few hours on single GPU.
P-DARTS (Chen et al., 2019) is a training-based algorithm that builds upon the seminal work DARTS Litt ett al. 2019). It employs a differentiable supernet and optimizes architechurll parameters which determine the importance of different operations via gradient descent. The key advance from DART'S is a progressive scarch strategy, which gradually increases the supernet's 's layer count, allowing the search to occur in space more representative of final architectures. Both P-DARTS and DARTS are popular differentiable NAS, but DARTS [Liu ct al. 2019) suffers from computational complexity and training instability (Chen et al. 2019 Xu et al. 2020 Chu et al.
2021 P-DARTS addresses these problems and runs faster than DARTS.
VS (Lu et al. 2020 is a bhining-based method that deploys an evolutionary algorithu (EA) to gencrate candidate architectures. It integrates two surrogate models: an upper-level surrogate that predicts architecture performance
guide the NSGA-II (Deb et al.] 2002) evolutionary search, and a lower-level weight-sharing supernet for efficient training and evaluation of candidate architectures. NSGANetV2 is also
multi-objective and optimizes multiple networks simultaneously with different performance size trade-offs. It
is substantially more efficient than initial EA-based approaches Lu et al. (2019); Real et al. (019 while offering improved performance, making it tractable to consider in our study.
TE-NAS (Chen et al. 2021) is a training-free algorithm that evaluates a network's performance based on arainability and expressivity. Trainability is measured using the condition number of the neural tangent kernel [Jacot et al. 2018), while expressivity is quantified by the number of linear regions in the activation space. These metries guide an itcrative pruning process
NAS supernet until a final, discretized architecture is produced. Recent studies (He et al., 2024 Shu et al. 20226 find TE-NAS to be one of the most elfective training- free algorithms, which, along with its popularity, makes it strong candidate for our study.
RoBoT (ee et al. 2024) is a hybrid NAS that combines training-free metrics with Bayesian optimization (BO). It first samples archilectures from the search space and computes multiple training-free metrics. BO then optimizes a weighted combination of these metrics based on validation accuracy (measured after a few training epochs) as the objective function. The architecture with the highest weighted score is chosen. We choose RoBoT for our study as it is the most recent and effective hybrid NAS. It also employs BO framework similar to prior works (Shen et al.) 2023 Shu et al. 2022b), making it representative.
4 Empirical Evaluation
Now we utilize our framework to audit the robustness of NAS against data poisoning.
4.1 Experimental Setup
Hardware and software. We use PythorJ with PyTore for all experiments, with version varying depending on the NAS algorithm. We run experiments on a system with a 48-core Intel Xeon Processor, 768GB of memory, and 8 NVIDIA A40 GPUs.
NAS algorithms. We use the official PyTorch implementation of all NAS algorithms (Chen et al. 2021 He et al. 2024 Chen et al. 2019 Lu et al. 2020 introduced in $3.4 We use the same hyperparameters as the original works and add functionality for inserting poisons before searching. To obtain fully trained network, we the NAS search algorithm on the poisoned training data, save the final architecture, and retrain the architecture from scratch for 600 epochs on clean data. We retrain all architectures using the P-DARTS (Chen et al. 2019 training implementation with the default hyperparameters.
NAS scarch space. We adopt the popular DARTS search space [Lu et al. 2019), which is defined by three factors: the number of internal nodes, the incorporation of prior states, and the set of candidate operations. These factors are used to build a cell, which is stacked to build the final architecture after searching. The
Python: https://www.pythoo..o
PPyTorch:
6

---

Published in Transactions on Machine Learning Research (12/2025)
candidate operations are: {none, 3x3 max pooling, 3x3 average pooling, skip connection, 3x3 separable convolution, 5x5 separable convolution, 3x3 dilated convolution, 5x5 dilated convolution), where none denotes the absence of a connection between two nodes. Following prior work, we search over architectures with four internal nodes, each of which incorporates the previous two states (i.c., candidate operations from those stales are applied to the internal nodes). The original work estimates that this search space contains ~10 possible architectures, without accounting for graph isomorphisms.
Poison crafting. We run our evaluation with CIFAR-10 and CIFAR-100 (Kizhevskyy, 2009 To craft poisons, we randomly select {1, 10, 50%% of the training data and run the poisoning attacks from $32 In our CLF attack, we use ResNet-18 (He et al., 2016) model trained on each dataset as the surrogate classifier. The larget parameters for GC depend on the NAS algorithm. For TE-NAS, RoBoT, and NSGANet we use the weights and biases of the final architectures, while for P-DARTS, we use the architectural parameters of the supernet. For both, we set the highest-accuracy networks on clean data (across 10 trials) as the target and craft poisons for 250 steps. Following the standard setting in prior work (Huang et al. 2020; Geiping eet al. 2021: Aghakhani et al.) 2021). we apply fo-m bounds of e = 16 to all clean-label perturbations. Appendix shows examples of the crafted poisons and their clean counterparts from CIFAR-10.
Table 1: Robustness of NAS to data poisoning on CIFAR-10 and CIFAR-100. We report the accuracy (Acc.) and percentage-point change from random sampling (AImp.). p is the poisoning budget. Each cell contains the mean and standard deviation. We underline and bold statistically significant results.
Polsoning Astack
CIFAR-10
CIFAR-100
P-DARTS
RoBoT
TE-NAS
P-DARTS
RoBoT
TE-NAS
Acc.
Almp-
Acc.
Almp-
Acc.
Almp.
Acc.
Almp-
Acc.
Almp-
Acc.
Almp-
None
97.32 a 0.07
0.58
96.99 a: 0.20
0.25
96,80 a: 0.40
0.07
$2.58
1.88
8L.68
0.41
0.98
81.40
0.78
0.71
Gausslan Noise
1%
97.33 :: 0.12
0.60
97.10
0.10
0.36
96.01 :: 0:20
0.17
52.80
0.20
2.19
81 05.65.1
0.02
0.96
82.02
0:58
1.33
10%
97.17
0:18
0.44
97.08 + 0.12
0.35
96.87 + 0.16
-0.07
$2.38
0.35
1.69
81.51
+ 0.75
0.81
81.09
0.37
0.99
50%
0.11
0.53
0.04
96.71
0:31
-0.02
82.40
1.70
81.25
0.56
82.08
1.39
1%
97.19
0.15
0.46
97.01 #: 0.15
0.28
96.85 : 0.28
0.12
92.68
0.40
1.99
81.82
4: 0.46
1.12
81.83
0.47
1.14
GC
10%
97.21
4: 0.18
0.48
97.20
0.18
0.47
96.86
1: 0.23
0.13
52.39
1.70
81 69
0.99
81.61
0.64
0.91
60%
97.15
0:15
0.12
97:13
1: 0.08
0.40
95.01
1: 0:31
0.18
52.32
0.45
1.62
81.94
0.83
1.25
81.47
0.02
0.77
1%
97.
#: 0.23
0.50
97:13 +: 0:23
0.39
$2.73 0.33
2.03
81 63
0.26
0.93
RIF
10%
0.19
0.21
$2.18
1.48
50%
96.77
0:38
0.04
97.04 +: 0.18
0.30
79.64 + 1.88
-1.05
81.04
#: 0.71
0.34
1%
97.11
0.20
0.38
97:03 0:31
0.30
82.60 0.50
1.91
81.70
0.45
1.000
CLF
10%
07:27
+ 0.11
0.54
95.88
0.08
0.15
92.66
0.30
1.96
0.48
0.71
50%
97.04
0.29
0.31
97.15 1 0.04
0.12
$1.59 1: 0,88
0.89
81.89
1. 0.28
1.19
4.2 Effectiveness of Data Poisoning Attacks
We first sample 10 random architectures from the DARTS search space and train them from scratch on CI and CIFAR-100, achieving average lest-time accuracies of 96. 73% and 80.70% respectively. These serve as our random sampling baseline for computing the Almp, metric. We then conduct our data poisoning attacks on each NAS algorithm across 10 trials and report the accuracy (Acc.) and the percentage-poing difference in accuracy relative to random sampling (Almp.). A poisoning attack is considered to be effective if it reduces Almp below the level achieved under clean data. To evaluate whether this effect is statistically significant, we conduct one-sided Welch's t-tests comparing the mean accuracies of poisoned architectures to their clean countepparss (No Attack) at a significance level of a = 0.05. The null hypothesis states that poisoning does not reduce accuracy, and we reject it when p S 0.05. For each model, we control the false discovery rate (FDR) at a 0.05 using the Benjamini-Hochhee denote statistically significant results by underlining and bolding them. Results for P-DARTS, TE-NAS, and RoBoT are shown in Table I As NSGANetV2 is substantially more compute-intensive reiiiiiierrurinnnnggee ~ 5x more search time than P-DARTS- -WRTS-WC.TTO WC run subset of our evaluation and report the results in Appendix A
(BH) procodure applied to all p-values. We
NAS is seemingly robust to data poisoning. Our results show that NAS appears to be robust to data poisoning: in the instances where Acc. is reduced, it drops by only 2.01-2.93% points. The state-of -ae---o--hhhatrre the- indiscriminate poisoning attack roduces Acc. by 155% points on standard neural networks (Lu et al. 2023), , suggesting that NAS is 5-1500x more resilient. However, comparing this degradation to the benefit NAS provides over random sampling reveals that several attacks significantly reduce the expected improvement.
7

---

Published in Transactions on Machine Learning Research (12/2025)
Specifically, the best-performing algorithm, P-DARTS, offers only a 0.58% and 1.88% point improvement over random sampling for CIFAR-10 and CIFAR-100, 100. Across both datasets, the RLF and CL. attacks induce statistically significant reductions in Almp., lowering it to 0.38 at the practical budget of p = 1% and to -1.05 to 0.89 under stress-testing scenarios (p 2 10%). These drops correspond to a 34-156% reduction in the benefit. provided by NAS. While poisoning causes small absolute drops in accuracy, these reductions can be substantial relative to the gains these algorithms typically provide.
Label-flipping attacks are effective against training-based NAS. The impact of label-flipping attacks varies widely across NAS algorithms. For P-DARTS, random label-flipping (RLF) does not significantly change Almp. for p I 10%. However, at p = 50%, Almp. drops to 0.04 on CIFAR-10 and -1.05 on CIFAR-100 statistically significant reductions that either eliminate P-DARTS's benefit or make it perform worse than random sampling. Confidence- based tabel-flipping (CLF) appears slightly more effective across all poisoning budgets, achieving statistically significant drops in ATmp. to 0.38 when p 1% and 0.31- 0.89 when p = 50%. However, it does not degrade performance to random sampling: at high poisoning budgets, random label noise appears more detrimental than targeted flips. RoBoT shows greater robustness, with no reductions that reach statistical significance. Since TE-NAS is inherently robust to label-flipping, training- based algorithms like P-DARTS are especially vulncrable to this attack vector.
Clean-label attacks are not effective. We find that Gaussian noise does not lower ATmp. at the practical poisoning budget of p = 1%. This is expected, as Gaussian noise tends to improve the generalization and robustness of neural networks when added to training data (Bishop) 1995 Franceschi et al. 2018 Rosenfeld et al., 2020). However, excessive noise can degrade NAS performance: at p == 10%, Almp. drops to 0.44 for P-DARTS CIFAR-10, a statistically significant result. Surprisingly, Gradient canceling (GC), the targeted clean-label attack, is largely ineffective. The changes in Almp. are small across most algorithms, and in several cases we observe slight increases. Our adapted P-DARTS implementation, which directly targets the architectural parameters, performs best achieving statistically significant reductions in Almp, to 0.42-0.46 on CIFAR-10 when = 1% and 50%-thong still underperforming label-flippig. A possible explanation for this result. is the usage of data augmentationn (e.g., random crops and horizontal flips) used Lo improve generalization (Perez & Wang 2017). All NAS algorithms in this study employ data augmentations,
which reduce the effectiveness of clean-label attacks (Geiping et al.] 2021 Schwarzschild et al. 2021 Borgnia
et al. ) We quantify the impact of data augmentations on NAS-specifie GC in Appendix B and discuss
additional limitations and opportunities for advancing NAS-specific data poisoning in $6.2
The utility-robusstess tradeoff. NAS robustness to data poisoning correlates with reliance on training algorithm, experiences the largest reductions in Almp. (up to
data. P-DARTS, the most 2.93) and is the only algorithm for which poisoning produced a statistically significant. effect. It is also the only algorithm where data poisoning completely negated the expected improvement over random sampling (RLF with p- 50%). In contrast, RoBoT and TE-NAS are far more robust: both exhibit only minor, non-significant Almp. reductions and, in most cases, maintain performance comparable to the clean setting. Interestingly, when we examine the Almp. of these algorithms on clean data, we see that higher data reliance correlates with greater performance. P-DARTS is best with a Almp. of 0.58, compared to 0.25 for RoBoT and 0.07 for TE-NAS, which barely outperforms random sampling. These findings suggest a utilltyyrroustnesss tradeoff:: higher data reliance improves performance but increases susceptibility to data poisoning.
5 Understanding the Robustness
This section analyzes the factors that influence the robustness between different NAS algorithms. We first examine how poisoning affects the architectures produced by NAS algorithms and what makes an architecture "sub-optimal". Next we analyze the robustness of the training- free metrics used in hybrid and training-free NAS. We finally test the ability of NAS to generalize to out-of-distribution data.
5.1 Impact of Data Poisoning on NAS Architectures
To explore the extent to which data poisoning affects NAS and why certain poisoned architectures perform worse, we conduct a qualitative analysis using architectures found in 4.. on CIFAR-10. In Figure] 1 we
8

---

Published in Transactions on Machine Learning Research (12/2025)
Clean Architecture (Accuracy: 97.43%
Poisoned Architecture (Accuracy: 96.30 06.30%
22-22
Cx
C2
Cx
C2
2
2
G
Cx-
3
Normal Cell
Reduction Cell
Normal Cell
Reduction Cell
convolution
skip connect
pooling
Figure 1: Comparison of clean and poisoned architectures. We visualize the best-performing architec- ture found using clean data (left) and the worst-performing architecture found using poisoned data (right) with the P-DARTS algorithm. Cg is the output of cell k, and the numbered squares are the internal nodes (layers). The worst-performing archilecture was found using RLF poisons with budget of 50%.
visualize the best architecture found by P-DARTS on clean data (based on Acc.) and compare it to the worst. architecture found on poisoned data ( RLF with p 50%). We omit visualizations for TE-NAS and RoBoT because none of the poisoning attacks resulted in a statistically significant reduction in Acc.
The clean architecture, with an Acc. of 97. 97,43%, consists primarily of convolutions in the normal cell and pooling operations in the reduction cell. This is expected, as the normal cell designed to extract features, followed by the reduction cell reducing their dimension. It also includes just two skip-connections, as they facilitate better learning in deeper networks (He et al. 2016) but can degrade performance used in excess (Chen et al. 2019). The poisoned architecture has similar normal cell with the same number of convolutions and skip-connestions. However, the ~1% point lower Acc. can likely be attributed to its reduction cell, which has only one pooling operation and, instead, mostly skip-comnections. This architecture was produced on heavily label- flippel data, so the introduction of contradictions between features and their associated classes may have caused P-DARTS to select more skip-connections as they have less propensity to introduce error. While this result highlights just one instance of a sub-optimal architecture induced by data poisoning, it shows that these attacks are capable of substantially altering the architecture selection process.
5.2 Training- Free Metrics are Robust
Table 2: Sensitivity of training-free metrics. For each data poisoning attack, we report the average change in each training-free metric across 100 randomly sampled architectures. We use p-50% for all attacks.
Poisoning Attack
TE-NAS
RoBoT
ANTK
R.
grad norm
snip
grasp
fisher
Gaussian Noise
2.18 51.11%
2.27 + 9.03%
-0.69 + 0.76%
-0.54 + 0.67%
1.08 +: 10.59%
2.57 + 1.31%
GC
65.42 1 679.35%
3.38 1 8.95%
-0.47 : 0.67%
-0.36 + 0.60%
0.52 +: 5.03%
2.22 4: 1.21%
RLF
0.00 + 0.00%
0.13 + 9.45%
-5.62 + 2.10%
-5.85 + 2.02%
-7.49 + 54.39%
0.32 + 1.43%
CLF
0.00 + 0.00%
0.89 1 9.04%
-5.04 1 4.27%
-6.66 + 3.52%
-11.14 +:2 119.65%
-1.87 + 4.37%
We hypothesize that the resilience of training-free and hybrid NAS to data poisoning results from the insensitivity of training-free free metrics to distribution shifts. If the values of these metrics are not sufficiently altered under poisoning, the algorithms that deploy them will not be affected. To test this hesot, we evaluate the sensitivity of all training-Fi free m used by TE-NAS and RoBoT to our data poisoning attacks. We first sample 100 random architectures from each search space. We then compute all training-free metrics on these architectures using 1000 randomly sampled clean data points from CIFAR-10. Then, we recompute the metrics data points from the poisoned datasets and record the change as percentage. By comparing metric values using the same architecture, we isolate the change caused by the data. We consider poisoning budgets of 50% to assess the robustness in the worst case. Table 2 shows our results.
We omit metrics that do use any data.
9

---

Published in Transactions on Machine Learning Research (12/2025)
We find that the training-free metrics are largely insensitive to data poisoning: differences range from 0 1-%5 and remain below 10% in all but two cases. For TE-NAS, NNTK is the most sensitive, increasing by 65.42% on average by GC, though its high standard deviation indicates instability that may not be a direct consequence of the poisons. For RoBoT, the metrics are less affected, with the largest deviation being -11.14% for grasp by CLF. Label-fipping attacks lend to have a larger impaci than clean-label, except. for fisher, which is altered by 2.57% by Gaussian noise. In all, these metric changes are unlikely to significantly alter the algorithms that leverage them, accounting for their comparative robustness to training- based methods.
5.3 NAS Generalizes to But-of-Distributicn Data
If NAS generalizes well to -uttof-distribution (OOD) datasets, this may explain why poisoning attacks which effectively introduce OOD data points are less effective. To quantify this generalization, we run the three NAS algorithms from $3.4 on several OOD training datasets to produce architectures and then train these architectures on CTFAR-10 (the original data). Following our main evaluation, we use Almp. to measure the performance and use the same random sampling Acc. of 96.73%. Here, we aim to test whether searching on OOD datasets produces architectures with lower accuracy (compared to searching CIFAR-10). Accordingly, as in $42 we measure significance using one-sided Welch's t-tests at a significance level of a 0.05 (using the BH procedure for FDR control); the null hypothesis is that scarching on OOD datascts docs not degrade final accuracy. Table 3 presents our results on the MNIST (Deng) 2012), FashionMNIST (Xiao et al. 2017 and SVHN (Netzer et al. 2011 datasets; CIFAR-10 is included as the baseline expected improvement.
The generalization ability of NAS varies substantially across algorithms. TE-NAS generalizes best, with Almp. ranging from 0.07 0.22 and no statistically sig- nificant drops compared to searching on CIFAR-10. Interestingly, these bene- fits are equivalent to or exceed running TE-NAS on in-dislribution training data (CIFAR-10) 10), suggesting that the training distribution need not align with the target task. RoBoT also generalizes well with no statistically significant reductions, al- though it only improves over CIFAR-10 when training on SVHN. P-DARTS performs worst, never exceeding its in-distribution Almp., with all three OOD datasets leading to statistically significant degradation as low as -0.08% points below random sampling. Unlike training-free free and hybrid NAS, P-DARTS requires in-distribution data to achieve optimal results.
Table 3: Out-of-distribution search results. For each train- ing dataset, we report the percentage-point change in accuracy compared to random sampling (Ammp.) with the standard devia- tions. All architectures are re-trained from scratch on CIFAR-10. Statistically significant results are bolded and underlined.
Training
P-DARTS
RoBoT
TE-NAR AS
Dataset
Aoc.
Almp.
Acc.
Almp.
Aoc.
Almp-
CIFAR-10
97.32
0.07
0.58
96.99
0.20
0.25
96.80
0.40
0.07
MNIST
97.14 4 0.12
0.41
96.94
0.36
0.21
96,80 :: 0.27
0.16
FashionMNIST
97.09 + 0.21
0.36
96.58 + 0.20
0.15
96.80 + 0.41
0.07
SVHN
96.65
-0.08
0.22
0.27
0.19
0.22
We hypothesize two factors behind this finding: (1) the OOD datasets share low-level features that guide NAS toward general-purpose feature extractors (e.g., convolutional ional and pooling operations), and (2) training- free and hybrid NAS algorithms tend to generalize well because they evaluate architectures based on
representational capacity and trainability rather than performance (Chen et al.) 2021 Shu et al. 2022a This makes these algorithms inherently less sensitive to distribution shifts, explaining their robustness to data poisoning attacks and other OOD datasets. However, this robustness comes at a cost: P-DARTS achieves substantially higher Almp. than RoBoT and TE-NAS when trained on in-distribution data.
6 Discussion
6.1 Potential Countermeasures
We now discuss polential countermeasures Many defenses have been proposed against data poisoning al lacks on machine learning. A common approach is outlier detection (Paudice et al. 2018 Steinhardt et al. 2017). which leverages the insight that poisoned samples are distinct from clean data. However, knowledgeable attackers (Koh et al. (202)) and clean-label constraints (Geiping et al. 2021) bypass these defenses by crafting indistinguishable poisons from benign data. Other works seek to enhance the robustness of the model through
10

---

Published in Transactions on Machine Learning Research (12/2025)
training, offering either certifiable guarantees on test-time accuracy (Hon et al. 2024 Rosenfeld et al.
2020
Levine & Feizi 2021) or strong empirical results against existing attacks (Hong et al. 2020 Liu et al. 2022)
While effective, certifiable defenses incur significant performance drops, and empirical approaches cannot guarantee robustness against adaptable adversaries. More importantly, it is unclear how countermeasures designed to defend against data poisoning during training transfer to the architecture selection process performed by NAS. Prior defenses focus solely on the final test accuracy of models trained on poisoned data, specifically the quality of the learned weights and biases. In contrast, NAS prioritizes architectural quality.
To assess the applicability of data poisoning defenses on NAS, we evaluate three compatible countermaasures on CIFAR-10. The first, diffusion denoising (Hong et al. 2024), is a certified defense that uses off-the-shelf diffusion models to remove adversarial perturbation tioos. Because it operates before training, its certification is independent of the specific training process, making it suitable for non-standard poisoning scenarios such as NAS. The second is loss-based sanitization (Koh et al. 2021), which removes training examples that are not well-fit by separate classifier trained on the full datasct. The intuition that poisons will have higher loss because they differ significantly from clean data points. Third, given our finding that label noise is the most. harmful attack vector, we also propose relabeling the training data via unsupervised clustering. Specifically, we extract the final-layer features of the CIFAR-10 training set from pre-trained neural network, cluster them with K-Means (Lloyd] 1982p. and assign a common label to each cluster. This process creates entirely new training labels, eliminating adversarial label flips. Althongh cluster-based relabeling may see limited practicality since it requires a large-scale pretrained feature extractor it serves as a valuable conceptual tool for examining whether NAS can better recover from structured rather than adversarial label noise.
Table 4: Data poisoning countermeasures. The AImp. across defenses. All attacks use p 50%.
Statistically significant results are bolded and underlined.
Defense
Attack
P-DARTS
RoBoT
TE-NAS
Acc.
Almp.
Acc.
Almp.
Acc.
Almp.
Cluster-Based Relabeling
RLF/CLF
97.16 + 0.17
0.42
96.98 + 0.18
0.24
Gaussion Noise
97.29 0.14
0.56
97.11
0.03
0.38
96.86 + 0.29
0.12
Diffusion Denoising
GC
97.20 + 0.30
0.47
96.91 = 0.10
0,18
96.74 + 0.34
0.01
Gaussian Noise
97.12 0.17
0.39
97.08 + 0.09
0.34
96.72 + 0.33
-0.01
GC
97.15 + 0.14
0.42
97.05 : 0.00
0.32
97.04 +: 0.35
0.31
Loss-Based Sanitization
RLF
97.28 + 0.14
0.55
97.15 + 0.10
0.42
CLF
97.11 0.21
0.37
97.05 = 0.01
0.32
Results. We evaluate diffusion denoising against Gaussian noise and Gradient canceling (GC) with p= 50%. The denoising parameter a is set to 0.1, as the original study finds it offers the best tradc-off between robustness and performance. For loss-based sanitization, we first train a Re (He et al. 2016) on each poisoned dataset from $ (with p 50%). Following Koh et al. [022] we then discard the top 50% of training examples in each class with the highest training loss. For our relabeling defense, we extract features with a ResNet-152 model pre-trained discards the original labels, inherently defending against RLF and CLF at any attack budget. To assess effectiveness, we compare the mean accuracy of defended models against poisoned baselines using a one-sided Welch's t-test at a significance level of a = 0.05. The mull hypothesis assumes that applying the defenses to poisoned datasets does not improve accuracy. Results across ten trials are shown in Table 4
ImageNet (Deng et al.) 2009) and group them into 10 clusters. Relabeling
The defenses show limited effectiveness. Loss-based sanitization performs best, achieving statistically significant improvements in Almp. for both P-DARTS and RoBoT against RLF. However, its effectiveness against other attacks drops, indicating less applicability to clean-label or targeted scenarios. Cluster- based relabeling yields statistically significant improvement in Almp. for P-DARTS, but significantly underperforms clean training (Almp. of 0.42 vs. 0.58). While it may mitigate label noise, the new labels are likely loo inaccurate to restore performance. Diffusion denoising leads to significant improvement only for RoBoT under Gaussian noise (increasing ATmp. from 0.30 to 0.38), suggesting it is more effective against random perturbations than targeted attacks. However, considering the clean-label attacks were ineffective against RoBoT in $1.2 further investigation is needed to determine the precise impact of this defense.
11

---

Published in Transactions on Machine Learning Research (12/2025)
6.2 Future Work
Expanding our auditing framework. While we make significant effort to ensure the representativeness of our fnveetork-ivessting over 15,000 GPU hours in our main ovaluation-evaauatiii -valuating broader range of NAS algorithms and attacks could further enhance the generalizability of our findings. In particular, incorporating more nin-differentiable, training- based algorithms-suut as reinforcement learning- based approaches (Zoph & Baker et. al., 2017 Pham et al. 2018) would allow us to assess additional methods with high data reliance. Furthermore, while our work focuses on the empirical characterization of data poisoning attacks in NAS scttings, future rescarch could develop stronger thcoretical foundation, for example, by extending the framework from Lu el al. (2023) to the search phase of NAS. Such foundation would enable the principled design of NAS-specific data poisoning attacks, potentially overcoming the limitations revealed in our study.
Le 2017
Improving NAS-specific data poisoning attacks. Whilc our NAS-specific GC attack induces statistically significant accuracy drops in P-DARTS, it faces several limitations. First, it assumes a white- box setting in which the adversary knows the victim's NAS algorithm- which may not hold in real-world scenarios. Second, it underperforms label-flipingg attacks, which we attribute to three factors: (1) NAS pipelines commonly use data augmentations, which hinder clean-label poisoning success (Geiping et al., 2021 Borgnia et al., 2021 Schwarzschild et al. 2021): ) (2) in many algorithms (including P-DARTS), the supernet evolves during search, which reduces transferability since craft poisons static model; (3) GC targets continuous architectural parameters, but NAS ultimately selects discretized archilecture that may not preserve the targeted "sub-optimality." These limitations reveal several opportunities for improving NAS-specific data poisoning- such as incorporating differentiable data augmentations (Geiping et al. 2021) or regularization to encourage producing diar-disceetized architectures which which we view as an exciting direction for future work.
Alternative data poisoning scenarios. As poisoning during the training phase of neural networks has been extensively studied (Zhao et al., 2025), our auditing framework is specifically designed evaluate the novel component of NhS-the architecture selection process in isolation. To this end, we poison only the search phase and retrain the resulting architectures on clean data. In practice, however, the same dataset is often used for both search and training, introducing an additional opportunity for poisoning. Simultaneously corrupting the architecture discovery and the subsequent parameter learning could induce greater performance degradation, making these attack vectors more impactful. Moreover, such settings enable more complex attack goals- such as targeted misclassification (Huang et al. 2020 Geiping et al., 2021 Shafahi et al., 2018 Aghakhani et al.] (022) or backdooring (Liu et al.) 2018c] Gu et al., 2019] which require manipulating model parameters rather than the architecture. Because this scenario entails a distinct framework and research scope, we regard it as a valuable direction for future work toward a deeper understanding of NAS's robustness.
7 Conclusion
Our work demonstrates that the performance gains achieved by architectures produced through NAS algorithms are not robust to data poisoning attacks. To systematically study this vulnerability, we design an auditing framework that enables the execution of various NAS algo on datasets compromised by poisoning attacks, including an attack specifically tailored for NAS. Our framework also implements a testing methodology and a specialized metric to effectively evaluate robustness.
In our evaluation, we first find that accuracy alone insufficient for quantifying vulnerability: it makes NAS algorithms appear robust to data poisoning because their reported performance gains over random search are often marginal. However, our proposed metric, Almp., shows that data poisoning can reduce the benefit of NAS by up to 156%, revealing a much higher level of susceptibility. We also show that NAS algorithms that rely heavily on data are inherently more vulnerable, whereas those with reduced data dependence are more robust. but with performance comparable to random sampling. Moreover, our results challenge the validity of the performance improvements achieved by NAS. Surprisingly, we observe that running NAS on completely out-of-distribution datasots such as MNIST- and then training the produced architectures on CIFAR-10 can yield higher accuracy than running NAS directly on CIFAR-10. These findings raise fundamental questions about the effect iveness and reliability of NAS "data-centrie" paradigm for neural architecture design.
12

---

Published in Transactions on Machine Learning Research (12/2025)
Broader Impact Statement
In recent years, dala-centric approaches to finding optimal neural network architectures have emerged, namely neural architecture search (NAS). This paper proposes a data poisoning framework for NAS algorithms as an auditing tool for their robustness to underlying data distribution shifts in adversarial settings. While our results suggest that data poisoning only inflicts marginal drops in the accuracy of models produced by these algorithms, this can practically invalidate their effectiveness with respect to the improvement they provide over hand-crafted or even randomly sampled architectures.
Releasing this work and its accompanying framework may pose dual-use risks, as adversaries could potentially exploit our methods to compromise NAS for example, degrading architectures deployed in reliabilityccritiall domains such as autonomous driving Liu 2020 or medical diagnostics (Sarvamangala & Kulkarni 2022), where even small accuracy losses can have significant consequences. We also do not assess robustiness beyond accuracy, where adversaries might instead target other NAS objectives such as latency or model size. Nevertheloss, we believe the potential benefits of releasing our framework far outweigh these risks. It enables systematic investigation of NAS vulnerabilities to data poisoning and supports the development of more robust defenses. Furthermore, since the most severe degradations occur only under large poisoning budgets (p 2 10%), the current real-world risk remains limited, while the expected research benefit is substantial.
Overall, we envision this research to raise awareness regarding the vulnerabilities associated with NAS and data-centric approach. By demonstrating how an altacker could potentially compromise NAS through the data it uses, we illuminate the importance of verifying training data and promote further research.
Acknowledgments
We thank the anonymous reviewers for valuable feodback. We thank Fuxin Li for his feedback on our findings. This work is partially supported by the Google Faculty Research Award 2023. The findings and conclusions in this work are those of the author(s) and do not necessarily represent the views of the funding agency.
References
Hojjat Aghakhani, Dongyu Meng, Yu-Xiang Wang, Christopher Kruegel, and Giovanni Vigna. Bullseye polytope: A scalable clean-label poisoning allack with improved transferability. In 2021 IEEE European Symposium on Security and Privacy (EuroSE1P), pp. 159-178, 2021. doi: LLLL10/EErrSSS519222222222
Bowen Baker, Otkrist Gupta, Nikhil Naik, and Ramesh Raskar. Designing neural network architectures
using reinforcement learning. In International Conference on Learning Representations, 2017. URL
net/ffouum/dd-Slceevee http:://pparrvieerreae///utttsts
Chris M Bishop. Training with noise is equivalent tikhonov regularization. Neural computation, 7(1): 108-116, 1995.
Eitan Borgnia, Valeriaa Cheropanova, Liam Fowl, Amin Ghiasi, Jonas Geiping, Micah Goldblum, Tom Goldstein, and Arjun Gupta. Strong data augmentation sanitizes poisoning and backdoor attacks without an accuracy tradeoff. In ICASSP 2021 2021 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), pp.
2021. doi: TTA1109/CCASSP3332222220011.11 242.444182
Han Cai, Ligeng Zhu, and Song Han. ProxylesNASS: Direct neural architecture search on target task and hardware. In International Conference on Learning Representations, 2019. URL. hhttt:tt////e //pperev/opeeeeview
net/forrum?id::yyJBBB...
Nicholas Carlini, Matthew Jagielski, Christopher A. Choquette-Choo, Daniel Paleka, Will Pearce, Hyrum Anderson, Andreas Terzis, Kurt Thomas, and Florian Tramer. Poisoning Web-Scale Training Datasets is Practical In 2024 IEEE Symposium on Security and Privacy (SP), pp. 407-425, Los Alamitos, CA. USA, May 2024. IEEE Computer Society. doi: 10. 10.11199SSPPP0 202.0220....22001799. URL https://do1 ieeecooputeessciieyyyooom www./o..gg..... wttp:////....0//////232220000/
13

---

Published in Transactions on Machine Learning Research (12/2025)
Wuyang Chen, Xinyu Gong, and Zhangyang Wang. Neural architecture search imagenet in four gpu hours: A theoretically inspired perspective. In International Conference on Learning Representations, 2021.
Xin Chen, Lingxi Xie, Jun Wu, and Qi Tian. Progressive differentiable architecture search: Bridging the depth gap between search and evaluation, 2019.
Yufei Chen, Chao Shen, Yun Shen, Cong Wang, and Yang Zhang. Amplifying membership exposure via data poisoning. Advances in Neural Information Processing Systems, 35:29830 29844, 2022.
Xiangxiang Chu, Xiaoxing Wang, Bo Zhang, Shun Lu, Xiaolin Wei, and Junchi Yan. {DARTS)-: Ro- bustly stepping out of performance collapse without indicators. In International Conference on Learning Representations, 2021. URL
K. Deb, A. Pratap, S. Agarwal, and T. Meyarivan. A fast and elitist multiobjective genetic algorithm: Nsga-ii. IEFE Transactions on Evolutionary Compulation, 6(2):182-188 197, 2002. doi: 10. 0011099423599000
Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei. Imagenet: A large-scale hierarchical image database. In 2009 IEEE Conference on Computer Vision and Pattern Recognition, pp. 248- 255, 2009. doi: N0.1109/CVPR.2000.5222 580.560888....
Li Deng. The mnist database of handwritten digit images for machine learning research [best of the web]. IEEE Signal Processing Magazine, 2966):14 2012. doi: 20.1109/MSP.2012.2221
Jean-Yves Franceschi, Albussein Fawzi, and Omar Fawzi. Robustness of classifiers to uniform lp and gaussian noise. In Amos Storkey and Fernando Perez-Cruz (eds.), Proceedings of the Twenty-First International Conference on Artificial Intelligence and Stalistics, volume 84 of Proceedings of Machine Learning Research, pp. 1288. PMLR, 09 11 Apr 2018 URL https::/ mlr, wptpss//////raneeeeeeeeeeee html
Jonas Geiping, Liam H Fowl, W. Ronny Huang, Wojciech Czaja, Gavin Taylor, Michael Moeller, and Tom Goldstein. Witches' brew: Industrial scale data poisoning via gradient matching. In International Conference on Learning Representations, 2021. URI. http::///ggaaureeee...ee//eeeeea
Tianyu Gu, Brendan Davan-Gavitt, and Siddharth Garg. Badnets: Identifying vulnerabilities in the machine learning model supply chain, 2019. URL
http///awwww.orr////////////// 06733
Hao He, Kaiwen Zha, and Dina Katabi. Indiscriminate poisoning attacks on unsupervised contrastive learning. In The Eleventh International Conference on Learning Represenlations, 2023. URL https //operreiie met/fformmidd-fee dWWEE--
Kaiming Hc, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In
Proceedings of the IEEE conference on compuler vision and pattern recognition, pp. 770 778, 2016.
Zhenfeng He, Yao Shu, Zhongxiang Dai, and Bryan Kian Hsiang Low. Robustifying and boosting training free neural architecture search. In The Twelfth International Conference on Learning Representations, 2024.
Dan Hendrycks and Thomas Dietterich. Benchmarking neural network robustness to common corruptions and perturbations. In International Conference on Learning Representations, 2019. URL https:///penrreview net:/forumm?dccshJJei1icog
Sanghyun Hong, Varun Chandrasekaran, Yigitcan Kaya, Tudor Dumitras, and Nicolas Papernot. On the effectiveness of mitigating data poisoning attacks with gradient shaping. CoRR, abs/2002.114999 11497, 2020. URL httpp://aaxxv..or//bb//////// 114977
Sanghyun Hong, Nicholas Carlini, and Alexey Kurakin. Diffusion denoising as a certified defense against clean-label poisoning, 2024. URL
14

---

Published in Transactions on Machine Learning Research (12/2025)
W. Romny Huang, Jonas Geiping, Liam Fowl, Gavin Taylor, and Tom Goldstein. Metapoison: Practical general-purpose clean-label data poisoning. In H. Larochelle, M. Ranzato, R. Hadsell, M.F. Balcan, and H. Lin (eds.), Advances in Neural Information Processing Systems, volume 33, pp. 12080 12091. Cur- ran Associates, Inc., 2020. URL Beef2:700022357735577485577---:
hctp://.g...rrrsp...pppppperr pdf
cc/paper fww.s/llllsppeeeee ffless/paper/2220//111
Arthur Jacot, Franck Gabriel, and Clement. Hongler. Neural tangent. kernel: Convergence and gen- eralization in neural networks. In S. Bengio, H. Wallach, Н. Larochelle, K. Grauman, N. Cesa- Bianchi, and R. Garnett (eds.), Advances in Newral Information Processing Systems, volume 31. Cur- ran Associates, Inc., 2018. URL https://proceedii
Diederik P. Kingma and Jimmy Ba. Adam: A method for stochastic optimization, 2017. URL https:
//arxiv.org/abs////
Pang Wei Koh, Jacob Steinhardt, and Percy Liang, Stronger data poisoning attacks break data sanitization 01811000741
defenses, 2021. URL
Alex Krizhevsky. Learning multiple layers of features from tiny images. Technical report, 2009.
Alexander Levine and Soheil Feizi. Deep partition aggregation: Provable defenses against general poisoning attacks. In International Conference Learning Representations, 2021. URL htttps://openrevlee..u
forum YD=-YGG2PPGG
Chenxi Liu, Barret Zoph, Maxim Neumann, Jonathon Shlens, Wei Hua, Li-Jia Li, Li Fei-Fei, Alan Yuille, Jonathan Huang, and Kevin Murphy. Progressive neural architecture search. In Proceedings of the European Conference on Computer Vision (ECCV), September 2018a.
Hanxiao Liu, Karen Simonyan, Oriol Vinyals, Chrisantha Fernando, and Koray Kavukeuoglu. Hierarchical representations for efficient architecture search. In International Conference Learning Representations, 2018b. URL
Hanxiao Liu, Karen Simonyan, and Yiming Yang. DARTS: Differentiable architecture search. In International Conference on Learning Representations, 2019. URL https::/ http://ww..ee.ooommm////////ttrr
Jinqiao Liu. Survey of the image recognition based on deep learning network for autonomous driving car. In 2020 5th International Conference on Information Science, Computer Technology and Transportation (ISCTT), pp. 6. IEEE, 2020.
Tian Yu Liu, Yu Yang, and Baharan Mirzasoleiman. Friendly noise against adversarial noise: A powerful defense against data poisoning attack. In S. Koyejo, S. Mohamed, A. Agarwal, D. Belgrave, K. Cho, and A. Oh (ods.), Advances in Neural Information Processing Systems, volume 35, pp. 11947-11959. Curran Associates, Inc., 2022.
Yingqi Liu, Shiqing Ma, Yousra Aafer, Wen-Chuan Lee, Juan Zhai, Weihang Wang, and Xiangyu Zhang Trojaning attack on neural networks. In 25th Annual Network And Distributed System Security Symposium (NDSS 2018). Internet Soc, 2018c.
S. Lloyd. Least squares quantization in pem. IEEE Transactions on Information Theory, 28(2):129-137, 1982. doi: 10.1109/TTIT.192210666
Yiwei Lu, Gautam Kamath, and Yaoliang Yu. Indiscriminate data poisoning allacks on neural networks. Transactions on Machine Learning Research, 2022. ISSN 2835-8856. URL https://openrevier.. net/ Forum?id=x4hmIshie
Yiwei Lu, Gautam Kamath, and Yaoliang Yu. Exploring the limits of model-targeted indiscriminate data poisoning attacks. In Proceedings of the 40th International Conference on Machine Learning, ICML'23. JMTR.org, 2023.
15

---

Published in Transactions on Machine Learning Research (12/2025)
Zhichao Lu, Ian Whalen, Vishmu Boddeti, Yashesh Dhebar, Kalyanmoy Deb, Erik Goodman, and Wolfgang Banzhaf. Nsga-net: Neural architecture search using multi-objective genetic algorithm, 2019.
Zhichao Lu, Kalyanmoy Deb, Erik Goodman, Wolfgang Banzhaf, and Vishnu Naresh Boddeti. Nsganetv2:
Evolutionary multi-objective surrogate-assisted neural architecture search, 2020.
Yuval Netzer, Tao Wang, Adam Coales, Alessandro Bissacco, Baolin Wu, Andrew Y Ng, et al. Reading digits in natural images with unsupervised feature learning. In NIPS workshop on deep leorning and unsupercised feature learning, volume 2011, pp. 4. Granada, 2011.
Curtis Northcutt, Lu Jiang, and Isaac Chuang. Confident learning: Estimating uncertainty in dataset labels. J. Artif. Int. Res., 70:1373- 1411, may 2021. ISSN 1076-9757. doi: 10.1613/jair...22125 URL
https://doi. 1613 12125
Andrea Paudice, Luis Linioz-Gozzller András György, and Emil C. Lupu. Detection of adversarial training examples in poisoning attacks through anomaly detection. ArXiu, abs/1802.0304) 2018. URL
Luis Perez and Jason Wang. The effectiveness of data augmentation in image classification using deep learning, 2017. URL
04621
Hieu Pham, Melody Guan, Barret Zoph, Quoc Le, and Jeff Dean. Efficient neural architecture search via parameters sharing. In Jemnifer Dy and Andreas Krause (eds.), Proceedings of the 35th International Conference on Machine Learning, volume 80 Proceedings of Machine Learning Research, pp. 4093-4104 4104. PMLR, 10 15 Jul 2018.
Esteban Real, Alok Aggarwal, Yamping Huang, and Quoc V. Le. Regularized evolution for image classifier architecture search. In Proceedings of the Thirty-Thiin Third AAAT Conference on Artificial Intelligence and Thisty-First Innovative Applications of Artificial Intelligence Conference and Ninth AAAI Symposium on Educational Advances in Artificial Intelligence, LAAT19/TAAT19/FAAA 978-1-57775 11881-57733-809-11 doi: 10.1609/ 1.16699/aaii.eea 33014780
AAAT Press, 2019. ISBN URL https:///oi. http::///oooo.gg///// 10, 1609/ v33101
Elan Rosenfeld, Ezra Winston, Pradeep Ravikumar, and Zico Kolter. Certified robustness to label-flipping attacks via randomized smoothing. In International Conference on Machine Learning, pp. 8230-8241. PMLR, 2020.
Evgenia Rusak, Lukas Schott, Roland S. Zimmermann, Julian Bitterwolf, Oliver Bringmann, Matthias Bethge, and Wieland Brendel. A simple way to make neural networks robust against diverse image corruptions. In Computer Vision ECCV 2020: 16th European Conference, Glasgow, UK, August 23 28, 2020, Proceedings, Part III, pp. 53 69, Berlin, Hcidelberg, 2020. Springer- Verlag. ISBN 978-3-030-58579-2. 4. URL
doi: 10.1007 /977//97-3300 017783-030--83 -880-58580-8
DR Sarvamangala and Raghavendra Kulkarni. Convolutional neural networks in medical image under- standing: survey. Evolutionary intelligence, 15(1):1-22, 2022.
Avi Schwarzschild, Micah Goldblum, Arjun Gupta, John P Dickerson, and Tom Goldstein. Just how toxic data poisoning? unified benchmark for backdoor and data poisoning attacks, 2021. URL
attps://arxivv wttpvvv..rrrab///000.5./ 12557
Ali Shafahi, W. Ronny Huang, Mahyar Najibi, Octavian Suciu, Christoph Studer, Tudor Dumitras, and Tom Goldstein. Poison frogs! targeted clean-label poisoning attacks on neural networks. In S. Bengio, H. Wallach, H. Larochelle, K. Grauman, N. Cesa-Bianchi, and R. Garnett (eds.), Advances in Neural Information Processing Systems, volume 31. Curran Associates, Inc., 2018. URL httpps///rroeeedingg Paper .pff
Yu Shen, Yang Li, Jian Zheng, Wentao Zhang, Peng Yao, Jixiang Li, Sen Yang, Liu, and Bin Cui. Proxybo: Accelerating neural architecture search via bayesian optimization with zero-cost proxies, 2023. URL https://arxiv.. wttp://..wrgg/b///....ooo
16

---

Published in Transactions on Machine Learning Research (12/2025)
Yao Shu, Shaofeng Cai, Zhongxiang Dai, Beng Chin Ooi, and Bryan Kian Hsiang Low. NASI: Label- and data-agnostic neural architecture search at initialization. In International Conference on Learning Representations, 2022a. URL https://openrrviiet
Yao Shu, Zhongxiang Dai, Zhaoxuan Wu, and Bryan Kian Hsiang Low. Unifying and boosting gradient- based training-froe free neural architecture scarch. Advances in Neural Information Processing Systems, 35: 33001-33015, 2022b.
David So, Quoc Le, and Chen Liang. The evolved transformer. In International Conference on Machine Learning, pp. 5877-5888 PMLR, 2019.
Jacob Steinhardt, Pang Wei W Koh, and Percy S Liang. Certified defenses for data poisoning attacks. In I. Guyon, U. Von Luxburg, S. Bengio, H. Wallach, R. Fergus, S. Vishwanathan, and R. Garnett (ods.), Advances in Neural Information Processing Systems, volume 30. Curran Associates, Inc., 2017. URL https://proceeding.. httproceednnngn.euiiips.ss. nwwripu wtt.r/pppcc/pppp....llle///ppppp filp////a/aapee/////////////// B7721106650e0007777772222211d112
pdr
Xu Sun, Zhiyuan Zhang, Xuancheng Ren, Ruixuan Luo, and Liangyou Li. Exploring the vulnerability of deep neural networks: A study of parameter corruption. In AAAT Conference on Artificial Intelligence, 2020. URL
Mingxing Tan, Bo Chen, Ruoming Pang, Vijay Vasudevan, Mark Sandler, Andrew Howard, and Quoe V. Le. Mnasnet: Platform-aware neural architecture search for mobile, 2019.
Yuxin Wen, Leo Marchyok, Sanghyun Hong, Jonas Geiping, Tom Goldstein, and Nicholas Carlini. Privacy backdoors: Enhancing membership inference through poisoning pre-trained models. In The Thirty-eights Annual Conference on Neural Information Processing Systems, 2024. URL https://openrevier net/
forum?1d=KppBAWWbrr
Han Xiao, Kashif Rasul, and Roland Vollgraf. Fashion-mnist: novel image dataset for benchmarking machine learning algorithms, 2017. URL https://arxiv wwg//bo/////////../..ooooe absa 1bbb/170007777
Huan Xiong, Lci Huang, Mengyang Yu, Li Liu, Fan Zhu, and Ling Shao. On the number of lincar regions of convolutional neural networks. In International Conference on Machine Learning, pp. 2020.
PMLR,
Yuhui Xu, Lingxi Xie, Xiaopeng Zhang, Xin Chen, Guo-Jun Qi, Qi Tian, and Hongkai Xiong. Pe-darts:
Partial channel connections for memory-efficiet architecture search, 2020.
Bingyin Zhao and Yingjie Lao. Clpa: Clean-label poisoning availability attacks using generative adversarial nets. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 36, pp. 2162-9170) 2022.
Pinlong Zhao, Weiyao Zhu, Pengfei Jino, Di Gao, and Ou Wu. Data poisoning in deep learning: A survey, 2025. URL httts::/aaxiii wrw//bo//////0//eooo 22759
B. Zoph, V. Vasudevan, J. Shlens, and Q. V. Lo. Learning transferable architectures for scalable image recognition. In 2018 IEEE/CVF Conference on Compuler Vision and Pollern Recognition (CVPR), pp. 8697-8710) Los Alamitos, CA, USA, jun 2018. TEEE Computer Society. doi: 10.1109/CVPR.20188000 URL https: wewecconttttereeciieee........ http//00.100////..2111.00 00907
Barret Zoph and Quoe Le. Neural architecture search with reinforcement learning. In International Conference on Learning Representations, 2017. URL http:://oganeeeeeee.eeee//oroded
17

---

Published in Transactions on Machine Learning Research (12/2025)
A Data Poisoning Results for Evolutionary NAS
In this section, we evaluate our framework on the evolutionary NAS algorithm NSGANetV2 (Lu al. 2020 Following Lu al. (2020), we sample the four best architectures from each search run's 's Pareto front. Due to resource constraints, we evaluate only the architecture with the third-highest FLOP count (the "large" configuration). Because N2GANetV2 uses custom search space, we first establish a random-sampling baseline of 97.90% Acc. obtained from 10 randomly sampled architectures. We then apply the poisoning setup and evaluation procedure from
reporting Acc. and Almp. across all atlakks and budgets in Table 5
Table 5: Robustness of V2 to data poisoning. The Acc. and Almp. across poisoning budgets. Statistically significant results are bolded and underlined.
Poisoning Attack
p
Acc.
ATmp.
None
98.06 + 0.19
0.17
1%
97.97 + 0.14
0.08
Gaussian Noise
10%
97.90 1 0.18
0.00
50%
97.87 + 0.16
-0.02
1%
97.99 + 0.19
0.09
GC
10%
98.02 + 0.25
0.12
50%
97.85 + 0.20
-0.04
1%
98.02 0.07
0.12
RLF
10%
97.93 0.21
0.03
50%
97.97 + 0.18
0.07
1%
98.01 + 0.22
0.11
CLF
10%
97.98 0.20
0.09
50%
97.71 + 0.23
-0.19
NSGANet exhibits a statistically significant drop in Almp. only under CLF with p= 50%, indicating that it is more robust than the other training- based algorithm, P-DARTS. However, performs worse on clean data (Almp. of 0.17 vs. 0.58), further supporting the atility-robustin trade-off described in $4.2 Overall, the results for NSGANetV2 reinforce our main findings: training-basck NAS remains more vulnerable to data poisoning than non-training- bassdd methods (which show statistically significant performance degradation), and tabel-flipping attacks outperform clean-label attacks.
B Impact of Data Augmentations on NAS-Specific Gradient Canceling
In 4.22 we hypothesize that our NAS-specific gradient canceling (GC) attack may be partially mitigated by data angmentations, as prior work has shown these to be effective countermeasures against clban-label attacks (Geiping et al. 2021 Schwarzschild al. 2021 Borgnia et al., 2021). To test this hypothesis, we evaluate GC on P-DARTS without applying data augmentations to the CIFAR-10 training data during the search phase. For comparison with the accuracies reported in 44.2 the resulting archilectures are trained from scratch on clean data with data augmentations applied. We assess statistically significant performance drops using the same procedure as in 4.2 significant results are underlined and bolded. Table 0 reports
the Acc. and Almp. for P-DARTS across E (1, 10, 50)%.
NAS-specific GC is more effective when data angmentation is not applied during the P-DARTS search. Although the same poisoning budgets from $4.2 are statistically significant (1% and 50%), the drop in ATmp. is up to 2.2x greater. This affirms our hypothesis that data augmentations are an effective countermeasure against targeted clean-label poisoning attacks on NAS.
18

---

Published in Transactions on Machine Learning Research (12/2025)
Table 6: Effectiveness of NAS-specific GC without data augmentations. The Acc. and Almp. for P-DARTS across poisoning budgets. Statistically significant results are bolded and underlined.
Poisoning Attack
Acc.
Ammp
None
97.19 + 0.15
0.46
1%
96.99 0.27
0.26
GC
10%
97.11
0.11
0.38
50%
96.84 + 0.23
0.11
C
Visualization of Poisoned Images
Here, we provide a visualization of poisons crafted using Gaussian noise (Noisc) and Gradient canceling
(GC)
(Lu et al. 2023 Figure 2
shows several examples; all poisons are crafted with &o bounds of 16.
Horse
Dog
Deer
Automobile
Bird
Frog
Clean
Noise
GC
Figure Visualization of poisons. A comparison of six randomly drawn images in CIFAR-10. Clean refers to clean samples, GC is the gradient canceling attack Lu et al. (2023). and Noise is Gaussian noise. The her at tacks we employ, random and confidence-basse label flipping, use clean images but modify labels.
19


Reviews:
[{"review_id": "osCVIjF6b2", "reviewer": "Reviewer_suW9", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "No", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "The paper investigates the robustness of neural architecture search (NAS) methods against data poisoning attacks, a relatively underexplored topic. The authors introduce an auditing framework that consists of four poisoning strategies, including a novel adaptation of gradient canceling specifically for NAS, and evaluate their impact across three representative NAS methods: training-based, training-free, and hybrid approaches. A key methodological contribution is the use of a new metric, delta (of improvement), which measures the performance gain of NAS over random sampling, enabling a more precise assessment of how poisoning undermines the marginal improvements NAS typically achieves. Through systematic experiments on CIFAR-10, the findings reveal that while the accuracy drops under poisoning are small, the actual benefits of NAS can be diminished by up to 93%, with training-based methods proving the most vulnerable and training-free methods the most resilient but least useful. The findings also highlight a utility-robustness tradeoff, as methods that rely more heavily on data achieve greater gains but are more susceptible to poisoning, and show that NAS surprisingly generalizes even when searching on out-of-distribution datasets such as MNIST.\n\n\nThe strengths of the paper lie in its clear framing of an overlooked issue, the development of a principled evaluation framework, and the empirical work on running multiple attacks across different NAS paradigms with statistical testing. The introduction of delta improvement is a useful step toward better evaluation of NAS vulnerabilities beyond raw accuracy. However, the work also has notable weaknesses. The study is limited to a narrow scope of methods and datasets (CIFAR-10 within the DARTS search space), raising questions about generalizability. The proposed NAS-specific attack is only a minor modification of existing methods, and most attacks prove relatively ineffective in absolute terms. The defense analysis is shallow, with only two countermeasures tested, both showing limited success. Finally, the reliance on marginal NAS improvements (fractions of a percentage point) as the core signal of vulnerability risks appears to be overstating the practical impact of the findings. Overall, the paper makes a useful first step in connecting NAS and data poisoning but is constrained by methodological and evaluative limitations.", "claims_and_evidence_yn": "No", "claims_explanation": "The evidence provided in the paper is limited in scope and does not convincingly support the broad claims that NAS is fundamentally unreliable under data poisoning. The experiments are confined to CIFAR-10 and the DARTS search space, which are saturated benchmarks where random architectures already achieve very high accuracy. As a result, the observed performance drops are marginal in absolute terms, even though the proposed delta Improvement metric appears to inflate their relative impact. The new poisoning attack tailored for NAS is only a small modification of existing methods and proves largely ineffective, with most attacks failing to produce meaningful degradation. Furthermore, only three NAS algorithms are tested, excluding major families such as evolutionary or reinforcement learning–based NAS, which undermines the generality of the findings. The defense analysis is similarly small, evaluating only two countermeasures with predictable outcomes. Overall, while the paper identifies an important question, the narrow setup, reliance on marginal effects, and lack of compelling results mean the claims need to be more convincing or clearly substantiated.", "audience_yn": "Yes", "audience_explanation": "Although NAS has matured in recent years, with much work shifting toward training-free, hybrid, or hardware-aware methods, its security and reliability under adversarial conditions remain underexplored. This paper touches on that gap by examining how data poisoning can undermine the marginal gains typically reported by NAS. Even though the evaluation is limited in scope and the practical impact is debatable, some individuals in TMLR’s audience, especially those working on NAS, AutoML, or robustness, would find it useful to see empirical evidence that NAS’s improvements may be fragile under adversarial data. The findings may not change practice immediately, but they highlight potential vulnerabilities and open questions about the long-term reliability of NAS as a data-centric paradigm.", "requested_changes": "1. The evaluation could be broadened to include larger and more challenging datasets such as CIFAR-100, Tiny-ImageNet, or an ImageNet subset, since relying solely on CIFAR-10 may overstate or understate the practical impact of poisoning.\n\n\n2. It would strengthen the paper to incorporate additional NAS algorithms, particularly evolutionary and reinforcement learning–based methods, so that the conclusions better reflect the broader NAS landscape.\n\n\n3. Extending the analysis across multiple search spaces (e.g., NAS-Bench-201 or latency-aware mobile spaces) rather than restricting to the DARTS space would help ensure that the findings are not space-specific.\n\n\n4. The study could place more emphasis on realistic poisoning budgets in the 0.1–1% range and treat extreme settings like 50% poisoning as stress-test scenarios rather than representative cases.\n\n\n5. Evaluating poisoning during both the search and training phases would make the threat model more realistic, since in practice the same dataset often underlies both.\n\n\n6. The NAS-specific gradient canceling attack would benefit from a clearer theoretical foundation and a principled comparison against stronger baselines such as gradient matching.\n\n\n7. It would be useful to re-run clean-label attacks with and without data augmentations to better quantify how augmentation choices blunt or amplify attack effectiveness.\n\n\n8. The ΔImprovement metric should be more carefully justified, ideally by reporting both absolute accuracy changes and ΔImp., and by comparing against other baselines such as top-k random search.", "broader_impact_concerns": "The paper includes a Broader Impact Statement, but key issues are underdeveloped. While framed as an auditing study, it introduces NAS-specific poisoning attacks without addressing the dual-use risks this creates. The claims about NAS unreliability are overstated given that the observed accuracy drops are marginal and the evaluation is restricted to CIFAR-10 and a single search space. The discussion should more explicitly acknowledge dual-use implications, avoid overgeneralization, and consider the consequences of adversarial NAS manipulation in high-stakes domains.", "additional_comments": "**Final Note:** Overall, this submission addresses an important but underexplored question of how NAS behaves under data poisoning. The paper is timely, given the increasing reliance on automated model design, and the auditing perspective is worthwhile. That being said, the current work has some limitations that reduce its impact. The experimental scope is narrow (CIFAR-10, a single search space, and only three NAS algorithms), making it difficult to generalize the conclusions. The proposed NAS-specific attack is relatively weak, and the evidence for practical risk is limited, as most attacks yield negligible accuracy degradation. The introduction of the delta of Improvement is interesting, but at times it appears to be used mainly to inflate the perceived severity of the results, since relative reductions are emphasized even when absolute changes are tiny. The writing also tends to overstate findings, for example, claiming NAS is unreliable, without adequate empirical backing. Addressing these issues would significantly strengthen the contribution, both in rigor and in practical relevance.", "extra_scores": {}, "extra_text": {}}, {"review_id": "6iKuRvifwO", "reviewer": "Reviewer_9ibG", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "This paper investigates an important and novel question: how susceptible neural architecture search (NAS) methods are to data poisoning. The authors propose a systematic auditing framework that injects poisons into the data used during the search phase. They implement four poisoning strategies (random label flips, confidence-based label flips, Gaussian noise, and a NAS-specific gradient-canceling attack) and introduce a new metric, ∆Improvement, which measures the drop in performance gain of NAS versus a random baseline. Three representative NAS methods are evaluated: a training-based differentiable NAS (P-DARTS), a training-free NAS (TE-NAS), and a hybrid NAS (RoBoT). Experiments on CIFAR-10 reveal that raw accuracy degrades only marginally under poisoning, but the relative gain from NAS can be greatly diminished (up to 93% loss in ∆Imp). In particular, training-based NAS suffers the most from label-flip poisons, while training-free NAS is largely unaffected (but its architectures offer little benefit above random). A surprising finding is that searching on completely out-of-distribution data (e.g. using MNIST to search architectures for CIFAR-10) can still produce high-performing models. Finally, the authors test two defenses (diffusion denoising and unsupervised relabeling) and find them largely ineffective at restoring the NAS gains.\n\n**Major Strengths:** The paper tackles a gap in the literature by combining two active areas (NAS and data poisoning). The experimental methodology is thorough: it uses repeated trials, proper baselines (random search), and statistical tests to ensure robustness. Introducing the ∆Improvement metric is a clear, justified idea to capture “gain loss” beyond raw accuracy. The results yield non-trivial insights: there is a clear utility–robustness trade-off (high-accuracy NAS are more vulnerable, while low-utility NAS appear robust), and the out-of-distribution search finding is intriguing. The paper is well-organized and the figures/tables effectively illustrate the claims.\n\n\n\n**Key Weaknesses:** The scope of evaluation is somewhat narrow. All experiments use CIFAR-10 and a single cell-based search space. It remains unclear if the findings generalize to larger datasets (like ImageNet) or other search spaces. As the authors themselves note, non-differentiable NAS (e.g. evolutionary or RL-based) were not tested. The poisoning threat model is limited: only the search-phase data is poisoned, while final training uses clean data. In practice, NAS often uses the same dataset for search and training; poisoning both could have stronger effects. The newly introduced “NAS-specific” gradient attack requires white-box knowledge and, as shown in Table 1, has a negligible impact compared to simpler label flips. Also, the out-of-distribution result, while interesting, is not fully explained and may be counterintuitive. Overall, while the experiments are extensive, additional analysis or ablations (e.g., on different tasks or search settings) would strengthen the claims.", "claims_and_evidence_yn": "Yes", "claims_explanation": "The claims are backed by a solid set of experiments and well-chosen baselines. The authors use a proper random-search baseline (accuracy ≈96.73%) and compute ∆Improvement to quantify NAS’s gain. They run 10 trials per condition and employ statistical tests to verify significance, which lends confidence to their observations. The key finding that label-flip poisoning can collapse NAS’s improvement by up to 93% is directly evident in Table 1 and discussed in the text. Likewise, the relative behaviors of P-DARTS, RoBoT, and TE-NAS are consistently supported by data (e.g. Table 1 shows training-free TE-NAS has ∆Imp~0.1 under attacks, versus large drops for P-DARTS). The paper’s methodological argument for the ∆Imp metric is clear and justified. The theoretical content is minimal, but the experimental evidence is complete and transparent. A caveat is that all tests are on CIFAR-10; thus some extrapolation is needed to generalize beyond this dataset.", "audience_yn": "Yes", "audience_explanation": "The paper lies at the intersection of machine learning security and automated model design, both of which are relevant to TMLR’s readership. The question of whether data-driven NAS methods can be fooled by poisoned data is novel (the authors cite it as an “open question”) and has practical significance for anyone relying on NAS in untrusted environments. The findings have immediate implications: they suggest that a standard NAS pipeline might be sabotaged by tampering with its data, and they expose a surprising phenomenon of out-of-distribution search effectiveness.", "requested_changes": "- **[Critical] Expand the experimental evaluation.** The current results are limited to CIFAR-10 and one search space. To strengthen the claims, the authors should include at least one additional dataset or domain. For example, an ImageNet (or subset) experiment, or even a different image benchmark (e.g. CIFAR-100), would help verify that the robustness patterns generalize. They should also consider testing a non-differentiable NAS method (e.g. an RL-based or evolutionary algorithm) as suggested in the text. Without these, conclusions about “NAS in general” remain speculative.\n\n\n- **[Critical] Clarify or analyze the out-of-distribution (OOD) search result.** The paper reports that using MNIST/SVHN to search for CIFAR-10 architectures can yield comparable or even higher ∆Imp. This counterintuitive finding deserves deeper analysis. The authors should provide more discussion (or additional experiments) to explain why OOD search works so well (e.g. is it due to shared feature motifs or simply randomness?). In particular, it would help to include standard deviations or significance levels for the OOD results in Table 3, and to clarify under what conditions the advantage is statistically meaningful.\n\n- **[Critical] Re-examine the “NAS-specific GC” attack.** The tailored gradient-canceling (GC) attack is novel, but the paper shows it has little effect on NAS (Table 1). The authors should either improve its strength or more clearly state its limitations. For example, GC requires detailed knowledge of the NAS process. The authors might explicitly discuss the practicality of this assumption. If GC remains weak, they could consider more targeted attacks (perhaps leveraging the alternative “poison both search and train” scenario mentioned as future work). At minimum, the write-up should highlight why GC underperforms label flips here.\n\n\n- **[Suggested] Strengthen the defense evaluation.** The two defenses (diffusion denoising and cluster relabeling) are a good start, but currently offer limited insight. The authors should clarify the practicality of cluster-based relabeling (for instance, requiring an ImageNet-pretrained model and enough unlabeled data). It would also be useful to compare with other common defenses (e.g. standard data sanitization or robust training approaches) if feasible. At least, the paper should more explicitly acknowledge that cluster relabeling is somewhat artificial.", "broader_impact_concerns": "The authors provide a Broader Impact statement highlighting the importance of data integrity in NAS pipelines. This is appropriate, but it is somewhat one-sided: it warns about vulnerabilities and the need to verify data, yet it does not consider the dual-use aspect. In particular, the paper should acknowledge that the developed poisoning methods (and the insight that NAS is vulnerable) could be exploited by malicious actors to intentionally degrade models (e.g. in shared training dataset scenarios). Similarly, while raising awareness is a positive aim, the authors should ensure that publishing detailed poisoning algorithms does not unduly facilitate attackers. On the other hand, the work could spur beneficial developments (like robust NAS algorithms or data validation tools). Lastly, there is no discussion of impacts beyond model accuracy (e.g. whether poisoned NAS might induce biases or fairness issues); while this may be beyond the scope, a note stating that “we do not evaluate fairness or security beyond accuracy” would clarify the impact boundaries.", "additional_comments": "", "extra_scores": {}, "extra_text": {}}, {"review_id": "6g2N52RWgh", "reviewer": "Reviewer_aggA", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "As neural architecture search (NAS) algorithms are purely data-centric approaches, they could be vulnerable to poisoned data. This issue, however, remains unsolved. To this end, this paper takes the first step to investigate this issue, specifically, “how vulnerable are NAS algorithms to data poisoning attacks?”. They propose a complete pipeline to answer this question, including defining the threat model, designing data poisoning attacks, and evaluating the influence of the attack with newly proposed metrics. Results show that NAS algorithms are somewhat robust to data poisoning attacks.", "claims_and_evidence_yn": "Yes", "claims_explanation": "The claims made in this paper—the vulnerability of NAS to data poisoning attacks—are basically supported with evaluations on the CIFAR-10 dataset and three different types of NAD algorithms using the employed dirty-label and clean-label attacks. Please see more concerns in “Additional Comments”.", "audience_yn": "Yes", "audience_explanation": "NAS algorithms are widely deployed in searching for optimal neural architectures. As these algorithms are purely data-driven, they could be very vulnerable. Thus, the problem investigated by this paper, i.e., the vulnerability of NAS algorithms, is well-motivated and of significance, especially for the NAS and trustworthy AI communities.", "requested_changes": "This paper only evaluates the proposed attacks on the CIFAR-10 dataset. It would be appreciated if the authors could increase evaluations on more datasets, which could make the paper's claims more convincing. — I am unfamiliar with NAS, not sure whether CIFAR-10 is typically the only benchmark that this community will use.", "broader_impact_concerns": "None.", "additional_comments": "1. This paper is the first to explore the vulnerability of NAS algorithms against data poisoning attacks. I think this problem is well-motivated and interesting. \n\n2. The proposed pipeline to explore the vulnerability of NAS algorithms, including defining the threat model, designing data poisoning attacks, and evaluating the influence of the attack with newly proposed metrics, defines a complete framework for future research.\n\n3. It seems the authors consider $\\triangle Imp$ using the absolute difference between the accuracy of NAS’s architecture and the accuracy of a random architecture. But shouldn’t we consider a relative difference rather than the absolute difference here? since the accuracy of a random architecture could be very random.\n\n4. My first concern is that, according to the presented results (Table 1), it seems the NAS algorithms themselves are not effective since $\\triangle Imp$ is 0.58% at most **when there is no attack**. Given the ineffectiveness of NAS, the results under attacks would be **uninteresting** in the sense that any attack leading to $\\triangle  Imp <0.58%$ can be claimed effective, which is not persuasive. (Recall in data poisoning attacks on image classification models, we typically claim an attack is effective when it reduces ACC from about 100% to about 0%). \n\n5. My second concern is that, it seems the attacks are not effective in the sense that the existence of poisoned data may sometimes let NAS find better architectures (as $\\triangle  Imp$ is higher), and increasing the poisoning rate does not always worsen NAS performance (which is different from the typical findings in data poisoning attacks on image classification models).\n\n6. Overall, this paper proposes a novel and well-motivated **scenario**—data poisoning attacks on NAS; but, it seems the **performance drop** (i.e., effectiveness of attacks) is not obvious when confronted with the attacks. Nevertheless, the findings could be interesting to related communities.", "extra_scores": {}, "extra_text": {}}]

Author rebuttal:

Decision: Accept (poster)