Let the Neurons Die: Exploiting ReLU-Induced Model Degradation

Kexin Li; Wenjun Qiu; Joshua Abraham; Aditi Maheshwari; David Lie

cs.LGSep 28, 2026

Let the Neurons Die: Exploiting ReLU-Induced Model Degradation

Authors: Kexin Li, Wenjun Qiu, Joshua Abraham, Aditi Maheshwari, David Lie

Organizations: University of Toronto, Toronto, Ontario, Canada

Abstract

Rectified linear unit (ReLU) networks can suffer from dying neurons, where units with persistently negative pre-activations produce zero outputs, blocking gradients through their activations. To exploit this failure mode, we present three training-time availability attacks based on data ordering and poisoning. We begin with the basic dynamic data-ordering attack (DOA), which greedily constructs a training prefix by selecting the next example that minimizes the target layer's post-update weight sum, aiming to push ReLU units toward negative pre-activations without modifying training samples or labels. We then develop two poisoning attacks, IG-DOA and IG-SKA, which use gradient inversion to synthesize class-conditioned samples by matching reference gradients in adverse model states constructed through data ordering or soft knockout, respectively. Soft knockout rearranges weights across adjacent layers to concentrate negative contributions. On a fully connected ReLU network trained on MNIST, ordering 100 of 60,000 training examples reduces test accuracy from 96% to 95% after only five epochs. Adding 200 poisoned samples from a single class reduces test accuracy to approximately 86-88% after five epochs in most evaluated conditions, compared with approximately 96% under clean training. These results demonstrate that ReLU-targeted data ordering and poisoning can impair learning without directly modifying the victim model's parameters.

Figures & tables

Epoch	Clean	20	50	75	100
0	92.96	93.02	92.73	91.95	92.06
1	95.45	94.77	94.20	93.77	93.82
2	95.35	95.31	94.85	94.59	94.42
3	95.62	95.42	95.15	95.23	94.85
4	95.93	95.39	95.67	95.27	95.04

Table 1 : MNIST test accuracy (%) under DOA . The numbered columns indicate the number of examples in the ordered prefix.

# Ordered	Ordered (%)	$\Delta_{0}$	$\Delta_{4}$
0	0.000	0.00	0.00
20	0.033	$-0.06$	0.54
50	0.083	0.23	0.26
75	0.125	1.01	0.66
100	0.167	0.90	0.89

Table 2 : Ordered-prefix size and accuracy deficit relative to clean training. Fractions use the original

60{,}000

training examples as the denominator. Deficits are in percentage points; positive values indicate lower accuracy under attack. Bold values mark the largest deficit in each epoch column.

Explore similar work

Sep 7, 2026cs.AI

Leveraging Imperfect Restoration for Data Availability Attack

The abundance of online data is at risk of unauthorized usage in training deep learning models. To counter this, various Data Availability Attacks (DAAs) have been devised to make data unlearnable for such models by subtly perturbing the training data. However, existing attacks often excel against either Supervised Learning (SL) or Self-Supervised Learning (SSL) scenarios. Among these, a model-free approach that generates a Convolution-based Unlearnable Dataset (CUDA) stands out as the most robust DAA across both SSL and SL. Nonetheless, CUDA's effectiveness against SSL is underwhelming and it faces a severe trade-off between image quality and its poisoning effect. In this paper, we conduct a theoretical analysis of CUDA, uncovering the sub-optimal gradients it introduces and elucidating the strategy it employs to induce class-wise bias for data poisoning. Building on this, we propose a novel poisoning method named Imperfect Restoration Poisoning (IRP), aiming to preserve high image quality while achieving strong poisoning effects. Through extensive comparisons of IRP with eight baselines across SL and SSL, coupled with evaluations alongside five representative defense methods, we showcase the superiority of IRP. Code: https://github.com/lyumingzhi/IRP

Yi Huang, Jeremy Styborski, Mingzhi Lyu +2

College of Computing and Data Science, Nanyang Technological University, Singapore · Rapid-Rich Object Search (ROSE) Lab, Interdisciplinary Graduate Programme, Nanyang Technological University, Singapore

Black-Box Adversarial Attacks Restoration

Ask PDF

Sep 10, 2026cs.CR

Empirical Evaluation of Data Poisoning Attacks in Supervised Learning

Data poisoning corrupts training data to degrade a model or to plant attacker-controlled behavior. This study evaluates two representative training-time attacks, label flipping and backdoor poisoning, on MNIST and Fashion-MNIST with three baseline classifiers: Logistic Regression, Linear SVM, and Random Forest. Clean training is compared with poisoning rates of 5%, 10%, and 20% using clean-test accuracy, macro-precision, macro-recall, macro-F1, and, for backdoors, attack success rate. Label flipping caused clear degradation, largest for Logistic Regression and Linear SVM, while Random Forest stayed comparatively stable. Backdoor poisoning reached attack success rates from 0.9667 to 1.0000 on both datasets and all three models while often keeping clean-test performance near baseline. The results separate indiscriminate poisoning, which shows up in standard metrics, from targeted backdoor poisoning, which stays comparatively stealthy while embedding highly effective malicious behavior, and they support security-oriented evaluation beyond conventional clean-test metrics.

Toshif Khan, Muhammad Abusaqer

Minot State University · Department of Math, Data & Technology Minot State University Minot, ND, 58707 · Trustworthy Language Intelligence Lab, Minot State University

Poisoning Training Data Attack-Success Rate Empirical Study

Ask PDF

Sep 8, 2025cs.LG

Are Targeted Data Poisoning Attacks as Effective as We Think?

Targeted data poisoning attacks manipulate model predictions on specific test samples by injecting malicious data into training. Yet existing evaluations report average attack success rates over randomly selected targets, obscuring true worst-case effectiveness. We argue that the right evaluation focuses on the hardest samples to poison. The same reasoning applies to defense: since targeted attacks leave no footprint at the distribution level, defenders should proactively identify the most vulnerable samples and apply targeted countermeasures. Given a test dataset, this paper identifies both the easiest and hardest to poison examples based on only clean model information. Specifically, we offer coarse evaluations using clean training dynamics, and fine-grained classification on poison class using poison distances and budgets. Our experiments show these metrics reliably stratify samples by poisoning vulnerability, enabling both rigorous worst-case evaluation and proactive vulnerability-aware defense.

William Xu, Chenyu Zhang, Yihan Wang +5

Waabi AI · University of Waterloo · Carnegie Mellon University +3

Poisoning Hard Worst-Case

Ask PDF