SAGE: Similarity-Based Cleaning of Poisoned Training Data from Verified Examples

Chaeeun Han; Soodeh Atefi; Yevgeniy Vorobeychik; Aron Laszka

cs.LGOct 1, 2026

SAGE: Similarity-Based Cleaning of Poisoned Training Data from Verified Examples

Authors: Chaeeun Han, Soodeh Atefi, Yevgeniy Vorobeychik, Aron Laszka

Organizations: College of Information Sciences and Technology, Pennsylvania State University, University Park, PA, USA · Department of Computer Science and Engineering, University of Louisville, Louisville, KY, USA · Department of Computer Science and Engineering, Washington University in St. Louis, St. Louis, MO, USA

Abstract

As machine learning increasingly relies on public, untrusted data sources, data poisoning attacks, which inject malicious examples into training data to induce misclassification of a chosen target, pose a growing threat. Existing defenses either assume zero ground-truth information about which examples are poisoned, or they assume access to a large set of examples verified to be clean. Satisfying the latter assumption incurs significant cost since reliable verification can be very resource- or labor-intensive. This cost is particularly high for clean-label attacks, where poisoned examples are visually indistinguishable from clean data. Since requiring a large set of verified examples is impractical, we propose relying on a small set of verified examples including both clean and poisoned ones, i.e., each example verified either to be clean or poisoned through inspection by a forensic expert. The challenge is then to detect poisons based on a set of verified examples that is so small that most classification models would overfit. To address this challenge, we propose Similarity-based Approach for Ground-truth-driven Exclusion (SAGE), which trains a generic feature extractor on a separate dataset and then flags poisoned training examples using a non-parametric, similarity-weighted prediction based on the verified set. On standard benchmarks against seven clean-label attack methods, we demonstrate that having access to even a handful of verified poisoned examples provides a substantial advantage. We also find that the distribution of verified clean examples across classes matters more than the number of verified examples.

Figures & tables

CIFAR-10
Attack		No Defense		SAGE (Ours)		Deep $k$ -NN		Meta-Sift		EPIC		Confusion Training
Size	Method	Acc. ( $\uparrow$ )	ASR ( $\downarrow$ )	Acc. ( $\uparrow$ )	ASR ( $\downarrow$ )	Acc. ( $\uparrow$ )	ASR ( $\downarrow$ )	Acc. ( $\uparrow$ )	ASR ( $\downarrow$ )	Acc. ( $\uparrow$ )	ASR ( $\downarrow$ )	Acc. ( $\uparrow$ )	ASR ( $\downarrow$ )
$\epsilon$ = 8	FC	0.9460 $\pm$ 0.0008	15%	0.9258 $\pm$ 0.0017	0%	0.9389 $\pm$ 0.0034	0%	0.9233 $\pm$ 0.0003	15%	0.9465 $\pm$ 0.0008	0%	0.9474 $\pm$ 0.0042	5%
	BP	0.9457 $\pm$ 0.0007	100%	0.9366 $\pm$ 0.0012	0%	0.9471 $\pm$ 0.0002	20%	0.9155 $\pm$ 0.0002	25%	0.9466 $\pm$ 0.0008	10%	0.9416 $\pm$ 0.0046	45%
	GM	0.9487 $\pm$ 0.0006	75%	0.8980 $\pm$ 0.0025	0%	0.8973 $\pm$ 0.0123	10%	0.8907 $\pm$ 0.0009	20%	0.8787 $\pm$ 0.0048	10%	0.9040 $\pm$ 0.0065	10%
$\epsilon$ = 16	FC	0.9456 $\pm$ 0.0008	25%	0.9392 $\pm$ 0.0024	0%	0.9426 $\pm$ 0.0032	10%	0.9255 $\pm$ 0.0003	25%	0.9465 $\pm$ 0.0006	0%	0.9451 $\pm$ 0.0032	5%

TABLE I: Post-defense attack success rate (ASR) and clean test accuracy (Acc.) for clean-label triggerless poisoning attacks on CIFAR-10 and Tiny ImageNet. Results are averaged over 20 poisoned datasets for each attack and perturbation budget

\epsilon

. ASR is the fraction of successful attacks across the 20 poisoned datasets, while Acc. is reported as mean

\pm

standard deviation. For each attack, the best result among the defenses is shown in bold, and the second-best result is underlined.

Attack	No Defense		SAGE (Ours)		Activation Clustering		SPECTRE		Confusion Training		FLARE
Attack	Acc. ( $\uparrow$ )	ASR ( $\downarrow$ )	Acc. ( $\uparrow$ )	ASR ( $\downarrow$ )	Acc. ( $\uparrow$ )	ASR ( $\downarrow$ )	Acc. ( $\uparrow$ )	ASR ( $\downarrow$ )	Acc. ( $\uparrow$ )	ASR ( $\downarrow$ )	Acc. ( $\uparrow$ )	ASR ( $\downarrow$ )
CIFAR-10
Narcissus	0.9521 $\pm$ 0.0004	0.9120 $\pm$ 0.0010	0.9281 $\pm$ 0.0030	0.1310 $\pm$ 0.0017	0.9023 $\pm$ 0.0020	0.0431 $\pm$ 0.0025	0.9045 $\pm$ 0.0006	0.1235 $\pm$ 0.0290	0.9149 $\pm$ 0.0010	0.0987 $\pm$ 0.0061	0.5364 $\pm$ 0.0294	0.0452 $\pm$ 0.0011
Wicked-BadNets	0.9467 $\pm$ 0.0006	0.8970 $\pm$ 0.0035	0.9494 $\pm$ 0.0022	0.2720 $\pm$ 0.0048	0.9469 $\pm$ 0.0006	0.8915 $\pm$ 0.0067	0.9425 $\pm$ 0.0055	0.8959 $\pm$ 0.0174	0.9475 $\pm$ 0.0049	0.8065 $\pm$ 0.0074	0.5507 $\pm$ 0.0392	0.0699 $\pm$ 0.0469
Wicked-Blended	0.9471 $\pm$ 0.0002	0.9383 $\pm$ 0.0007	0.9467 $\pm$ 0.0007	0.4620 $\pm$ 0.0030	0.9447 $\pm$ 0.0029	0.9381 $\pm$ 0.0014	0.9428 $\pm$ 0.0047	0.5608 $\pm$ 0.0758	0.9408 $\pm$ 0.0042	0.5675 $\pm$ 0.0054	0.4586 $\pm$ 0.0040	0.1023 $\pm$ 0.0762
Wicked-SIG	0.9451 $\pm$ 0.0007	0.9372 $\pm$ 0.0018	0.9401 $\pm$ 0.0022	0.3400 $\pm$ 0.0157	0.9407 $\pm$ 0.0056	0.9382 $\pm$ 0.0262	0.9400 $\pm$ 0.0054	0.7613 $\pm$ 0.0475	0.9452 $\pm$ 0.0041	0.7612 $\pm$ 0.0038	0.4941 $\pm$ 0.0354	0.0717 $\pm$ 0.0206

TABLE II: Post-defense clean test accuracy (Acc.) and attack success rate (ASR) for four clean-label backdoor attacks on CIFAR-10. Results are mean

\pm

std over 10 runs. For each attack, the best result among the defenses is shown in bold, and the second-best result is underlined. Note that FLARE’s low ASR comes at the cost of excessively low clean accuracy.

Fig. 1: Effect of verified-set composition on poison recall and false positives. The upper panel reports the number of poisoned images identified, and the lower panel reports the number of clean images removed. Solid lines denote class-balanced sampling of verified clean examples. Dashed lines denote unstratified random sampling.

Appendix figures & tables2 assets

Supplementary material from the paper’s appendix.

Appendix

Dimension	Scale $\tau$	Loss	Accuracy
64	13.5630	2.3252	0.7020
128	13.0431	2.2413	0.7146
256	13.0456	2.0417	0.7328
512	13.0370	2.1955	0.7242

Appendix

TABLE IV: Effect of the feature-extractor output dimension

d

. Cross-entropy loss and accuracy are measured on the clean CIFAR-100 test set using the similarity-weighted prediction rule in Equation ( 3 ).

$\|R\|$	Scale $\tau$	Accuracy
22	0.0000	0.5166
100	1.2895	0.6386
200	3.5260	0.7350
500	2.0171	0.6867

Appendix

TABLE V: Effect of the reference-set size

|R|

used during feature-extractor training. Accuracy is measured on the clean CIFAR-100 test set using the similarity-weighted prediction rule in Equation ( 3 ).

Explore similar work

Empirical Evaluation of Data Poisoning Attacks in Supervised Learning
Sep 10, 2026Toshif Khan, Muhammad AbusaqerPoisoning Training Data
Minot State University · Department of Math, Data & Technology Minot State University Minot, ND, 58707 · Trustworthy Language Intelligence Lab, Minot State University
Are Targeted Data Poisoning Attacks as Effective as We Think?
Sep 8, 2025William Xu, Chenyu Zhang, Yihan Wang +5Poisoning Hard
Waabi AI · University of Waterloo · Carnegie Mellon University +3
Checkerboard: A Simple, Effective, Efficient and Learning-free Clean Label Backdoor Attack with Low Poisoning Budget
May 2, 2026Yi Yang, Jinyang Huang, Binbin Liu +5Clean Label Backdoor Attack Black-Box Adversarial Attacks
School of Computer Science and Information Engineering Hefei University of Technology Hefei, Anhui, China · School of Information Science and Technology University of Science and Technology of China Hefei, Anhui, China · Faculty of Business Data Science Kansai University Japan +3

Sep 10, 2026, cs.CRJ/K move · Enter open · S save

Empirical Evaluation of Data Poisoning Attacks in Supervised Learning

Toshif Khan, Muhammad Abusaqer

Minot State University · Department of Math, Data & Technology Minot State University Minot, ND, 58707 · Trustworthy Language Intelligence Lab, Minot State University

Poisoning Training Data Attack-Success Rate Empirical Study

Open paper AskPDF arXiv

Data poisoning corrupts training data to degrade a model or to plant attacker-controlled behavior. This study evaluates two representative training-time attacks, label flipping and backdoor poisoning, on MNIST and Fashion-MNIST with three baseline classifiers: Logistic Regression, Linear SVM, and Random Forest. Clean training is compared with poisoning rates of 5%, 10%, and 20% using clean-test accuracy, macro-precision, macro-recall, macro-F1, and, for backdoors, attack success rate. Label flipping caused clear degradation, largest for Logistic Regression and Linear SVM, while Random Forest stayed comparatively stable. Backdoor poisoning reached attack success rates from 0.9667 to 1.0000 on both datasets and all three models while often keeping clean-test performance near baseline. The results separate indiscriminate poisoning, which shows up in standard metrics, from targeted backdoor poisoning, which stays comparatively stealthy while embedding highly effective malicious behavior, and they support security-oriented evaluation beyond conventional clean-test metrics.

Abstract

Explore similar work

Empirical Evaluation of Data Poisoning Attacks in Supervised Learning

Are Targeted Data Poisoning Attacks as Effective as We Think?

Checkerboard: A Simple, Effective, Efficient and Learning-free Clean Label Backdoor Attack with Low Poisoning Budget