How Robust Are Randomized Smoothing Based Defenses to Data Poisoning?

1. 01What problem does this paper attempt to solve?

   The authors study whether data poisoning can weaken the robustness guarantees of randomized smoothing certified defenses, and propose a clean-label poisoning attack targeting an entire target class.

   Core question: Can certifiably robust classifiers withstand training-data poisoning—the effect of training-data quality on certified robustness has been largely unstudied.

   • Setting and motivation: Randomized smoothing (RS)-style certification methods scale to deep networks, and victims use robust training methods such as GA, MACER, and SmoothAdv to obtain certified guarantees; but the authors argue that data-hungry training pipelines are easy to poison (e.g., web-scraped or crowdsourced data).
   • Shortcomings of existing attacks: The authors report that traditional poisoning optimized against standard training fails once the victim switches to certified robust training (Table 1: CIFAR10 standard-training accuracy drops from 92.71% to 0.36%, but under GA/MACER it is almost unchanged), which the authors say creates a false sense of security.
   • Core observation: The authors' theoretical analysis (for the linear classifier case) holds that poisoning moves the smoothed classifier's decision boundary closer to the target-class points, thereby reducing the certified radius.
   • Paper contribution: Proposes PACD (Poisoning Against Certified Defenses), a clean-label poisoning attack based on constrained bilevel optimization, whose goal is to reduce the average certified radius (ACR) of the entire target class rather than the accuracy on a few target points.
   • Threat model:
     • Goal: Reduce the victim model's certified robustness (ACR) over the entire target class, with a concomitant reduction in certified accuracy.
     • Knowledge: The paper assumes the attacker knows the robust training method and certification procedure used by the victim (the attack is optimized for a specific method); transferability when training methods differ is also evaluated.
     • Capability: Can only modify the features of target-class samples by adding imperceptible small perturbations (l∞ norm, MNIST ε=0.1, CIFAR10 ε=0.03), without changing labels (clean-label).
     • Victim system: Deep classifiers trained from scratch with GA, MACER, or SmoothAdv and certified with randomized smoothing.

   Collapse this answer

2. 02What related research exists?

   Related work falls into three categories: randomized smoothing certification and robust training, data poisoning against standard training, and bilevel optimization solution methods.

   Randomized smoothing certification and robust training

   • Cohen et al. [8] proposed randomized smoothing (RS) certification and Gaussian data augmentation (GA) training, making certification scale to deep networks; Lecuyer et al. [20] and Li et al. [21] are early noise-based certification methods.
   • Salman et al. [29] (SmoothAdv) use adversarial training against the smoothed classifier to increase the certified radius; Zhai et al. [36] (MACER) directly maximize the certified radius and train faster. The poisoning targets of this paper are precisely these three methods.
   • Other certification methods such as Raghunathan et al. [28], Gowal et al. [13], Huang et al. [15], and Xu et al. [35] are considered by the paper to be difficult to scale to deep networks or large datasets.

   Data poisoning

   • Poisoning works such as Biggio et al. [3], Jagielski et al. [17], Steinhardt et al. [32], and Zhu et al. [37] aim to reduce model accuracy; Shafahi et al. [31] (Poison Frogs) and Huang et al. [16] (MetaPoison) are clean-label poisoning aimed at a few target points.
   • Ghiasi et al. [11] propose an attack that at test time uses large lp perturbations to fool robust classifiers and gives incorrect certificates; the paper notes that this work differs in that it poisons at training time and the perturbations are imperceptible.

   Bilevel optimization

   • Domke [9], Pedregosa [27], Franceschi et al. [10], Maclaurin et al. [22], Shaban et al. [30], Mehra and Hamm [24], and others propose gradient methods for solving bilevel optimization; this paper uses ApproxGrad, which approximately solves a linear system.
   • Mei and Zhu [25], Muñoz-González et al. [26], Carnerero-Cano et al. [6], and others use bilevel optimization for poisoning against standard training; this paper applies this framework to attack RS certified defenses.

   Baselines and benchmarks: The comparison baselines are watermarking (the watermarking method used by Shafahi et al. [31] for clean-label attacks, with opacity 0.1 and clipped to the same l∞ distortion) and traditional poisoning optimized against standard training (Table 1); the benchmarks are MNIST and CIFAR10.

   Authors' positioning: The authors claim that, to their knowledge, this is the first clean-label poisoning attack that can reduce certified robustness guarantees, and that it targets training methods that improve certified robustness rather than standard training.

   Collapse this answer

3. 03How does the paper address this problem?

   PACD formulates poisoning as a constrained bilevel optimization: the upper level minimizes the certified radius of the soft smoothed classifier, and the lower level simulates the victim's robust training; it is solved with ApproxGrad.

   Overall approach: model poisoning as a constrained bilevel optimization problem, where the upper level optimizes poison points to minimize the certified radius of the target class and the lower level is the victim's robust training process; a differentiable "soft" smoothed classifier approximates the non-differentiable certified radius, and ApproxGrad is then used to compute an approximate hypergradient.

   Problem Formulation

   • The attacker adds a poison set Dpoison to the clean data Dclean; each poison point is obtained by adding a perturbation to a target-class base point, subject to kδi k∞ ≤ ε and unchanged labels (clean-label).
   • Bilevel problem: min_{u∈ U} R(D_val; θ^∗), s.t. θ^∗ = argmin_θ L_robust(D_clean ∪ D_poison; θ); the upper-level R is a certified robustness measure, and the lower-level L_robust is the victim's robust training loss.
   • The authors state that this formulation is general: replacing the lower-level loss and the upper-level certification procedure adapts it to other training methods and certification methods.

   Differentiable Upper-Level Objective

   • The certified radius of the hard smoothed classifier is non-differentiable, so the authors approximate it with a soft smoothed classifier g̃ (similar to the approach of [29, 36]), whose soft certified radius r̃ is differentiable.
   • The upper-level objective is the average soft certified radius R̃ over the target-class validation set Dval (a differentiable version of ACR).

   Lower Level for the Three Training Methods

   • GA [8]: the lower level uses the Gaussian-augmented cross-entropy loss L_GaussAug; the full attack procedure is in Algorithm 1.
   • MACER [36]: the lower level is replaced by L_macer (classification loss plus the robust loss of the soft smoothed classifier); poison generation uses k=2 noise samples.
   • SmoothAdv [29]: the lower level is a minimax adversarial training objective; the authors use an approximation—first generate adversarial examples against the current model with PGD, then use them as training data for GA-style training, regenerating adversarial examples at each bilevel step.

   Solving and Generation

   • Solved with ApproxGrad (Appendix B Algorithm 2): the inner level is approximately trained for T1 steps and the linear system is approximately solved for T2 steps, and the hypergradient is projected to satisfy the l∞ constraint; hyperparameters P=50, T1=T2=10 (T1=1 for SmoothAdv).
   • Poison points are initialized as clean points of the target class; to prevent overfitting to a particular local minimum, the lower-level variables are reinitialized every several upper-level iterations, which the authors state keeps the poison effective against retrained models.
   • For the linear classifier case the authors give an analytical solution (Theorem 1): the optimal poison is to shift the target-class points as a whole by the maximum perturbation ε, thereby moving the decision boundary; Corollary 2 gives that poisoning an α proportion of points is equivalent to poisoning all points with ε=αε̃.

   Success Criteria

   • Main metrics: ACR on clean target-class test points and approximate certified accuracy (ACA, the proportion with certified l2 radius greater than 0), compared with clean data and the watermark baseline; additionally, the average l2 distortion of PGD against the smoothed classifier measures empirical robustness.

   Collapse this answer

4. 04What experiments did the paper conduct?

   On MNIST and CIFAR10, poisoning GA, MACER, and SmoothAdv all reduced the target-class ACR; the authors claim a reduction of more than 30%, and that the poisoning transfers across training methods and architectures.

   Experimental Setup

   • Models tested: convolutional network on MNIST (two convolutional layers plus fully connected); Resnet-20 on CIFAR10; Appendix D.4 additionally tests Resnet-56 and Resnet-110; Appendix D.1/D.2 use logistic regression for toy experiments.
   • Datasets: MNIST (55000 training, 5000 validation, 10000 test) and CIFAR10 (45000 training, 5000 validation, 10000 test); the main experiment target classes are digit 8 and class "Ship" respectively, and Appendix D.3 covers all 10 classes.
   • Baselines: training on clean data; watermarking poisoning (opacity 0.1 overlaying images of other classes and clipping to the same l∞ distortion).
   • Metrics: ACR (average certified radius over correctly classified points, with misclassified and abstained points counted as 0) and ACA; certification uses the CERTIFY procedure of [8] (n0=100, n=100000, α=0.001).
   • Settings: the same σ (0.25/0.5/0.75) is used for attack, retraining, and evaluation; ε=0.1 (MNIST), 0.03 (CIFAR10); results are reported on 500 randomly sampled target-class test points, averaged over 5 random initializations (3 for some appendix experiments).
   • Review method: no human or LLM review; all are metric computations.

   Main Results

   Under all three robust training methods, the certified robustness of the target class decreases after poisoning (according to Table 2, 3, 4, Clean→Poisoned):

   Swipe horizontally to read the table

   Training method	Dataset	σ	ACR Clean→Poisoned	ACA(%) Clean→Poisoned
   GA (Table 2)	CIFAR10	0.25	0.521→0.059	85.76→26.84
   GA (Table 2)	CIFAR10	0.5	0.634→0.221	75.04→42.28
   GA (Table 2)	MNIST	0.25	0.896→0.325	98.92→71.96
   MACER (Table 3)	CIFAR10	0.25	0.593→0.379	83.84→72.41
   MACER (Table 3)	MNIST	0.25	0.915→0.431	99.64→79.81
   SmoothAdv (Table 4)	CIFAR10	0.25	0.504→0.271	78.76→55.78
   SmoothAdv (Table 4)	MNIST	0.25	0.896→0.672	99.16→93.21

   • The authors state that poisoning lowers the target-class ACR of GA on CIFAR10 from 0.52 to 0.06, which they consider to show GA's vulnerability to poisoning; for MACER the authors state the ACR drop exceeds 30%, and retraining uses k=16 while poison generation uses only k=2, so increasing the number of noise samples cannot eliminate the attack effect.
   • The watermark baseline has ACR close to clean data in most settings (e.g., in Table 2 with CIFAR10 σ=0.25, Watermarked is 0.470), on which basis the authors state that bilevel optimization poisoning is more effective than watermarking.
   • The authors point out that ACR and ACA are correlated; although the attack targets the certified radius, it also lowers certified accuracy.

   Transferability Experiments

   • Across training methods: poison data optimized with one method still lowers certified robustness when retrained with the other two methods (Figure 4, MNIST σ=0.5, CIFAR10 σ=0.25; the figure caption gives the k setting for each method, and the specific bar chart values are not labeled in the text). The authors state that poison generated against GA is also effective against other methods.
   • Across architectures: poison generated against Resnet-20 still lowers the target-class ACR on Resnet-56 and Resnet-110 (Figure 7, CIFAR10 "Ship", GA σ=0.5, 3 initializations).
   • The authors state that poisoning is robust across training methods, model architectures, and evaluation metrics (RS certification or empirical robustness).

   Mechanism and Empirical Robustness Analysis

   • Decision boundary shift: Table 5 reports the average l2 distortion required for PGD to generate adversarial examples against the smoothed classifier, which drops from 1.754 to 0.132 for CIFAR10 σ=0.25 and from 3.271 to 1.339 for MNIST σ=0.25; the authors state this supports the hypothesis that "poisoning moves the decision boundary closer to target-class points."
   • Toy validation: Appendix D.2 validates with logistic regression on two-dimensional isotropic Gaussian data, where the numerical solution matches the analytical solution (Table 6: for σ=0.25, ACR drops from 0.4047 to 0.3585, and the analytical prediction drops from 0.4243 to 0.3546).

   Other Ablations and Analyses

   • Perturbation budget ε (Figure 3, GA, σ=0.25): the larger ε is, the lower the target-class ACR, but the easier the poison points are to spot by visual inspection; the authors use ε=0.1 in the main experiments.
   • Weight regularization (Table 7, MNIST digit 8, ε=0.1, 3 initializations): without GA, large regularization (1E-1) gives a post-poisoning ACR of 0.68 (0.01 without regularization), but clean accuracy drops from 99% to 92%; with GA, large regularization lowers the clean model's ACR from 1.48 to 0.85, and the authors state that using large regularization together with GA is inadvisable.
   • Single-point poisoning (Appendix D.6): poisoning 1% of the CIFAR10 data (500 bird images, ε=0.06), the average certified radius over 5 target points drops from 0.63 to 0.26.
   • Other target classes (Appendix D.3, Figure 6): poison is generated separately for all 10 classes of MNIST and CIFAR10, and the authors state that the ACR of all classes decreases.
   • Negative result: Table 1 shows that poison optimized against standard training is essentially ineffective against GA/MACER/SmoothAdv training (e.g., under CIFAR10 GA the accuracy is 88.38%, versus 88.84% for clean), which is the starting point this paper aims to address rather than a failure of this paper's attack.

   Collapse this answer

5. 05What are some points that can be further explored?

   The authors explicitly state that bilevel optimization is computationally expensive and leave ImageNet poisoning for future work; the experiments cover only two datasets and randomized smoothing certification.

   Limitations and future directions noted by the authors

   • Computational scalability (Section 4): The time complexity of ApproxGrad is O(V T); for datasets like ImageNet that require optimization over many batches, solving the bilevel problem is computationally difficult, and the authors explicitly leave poisoning on ImageNet for future work.
   • Lack of analytical analysis for the nonlinear case (Section 3.4): The authors state that direct analytical analysis for nonlinear classifiers is infeasible; they give theoretical results only for linear classifiers, and for the nonlinear case there are only empirical observations of decision-boundary movement.
   • The paper has no dedicated Limitations section; the above are the limitations and future directions explicitly stated in the main text and conclusion.

   Scope of experiments

   • The models tested are an MNIST convolutional network, Resnet-20, and, in the appendix, Resnet-56, Resnet-110, and logistic regression, 5 in total (Section 4, Appendices D, E.2).
   • The datasets are MNIST and CIFAR10, plus two-dimensional Gaussian toy data; the main experiments use one target class each (digit 8, "Ship"), and Appendix D.3 covers all 10 classes of both datasets (Figure 6).
   • Victim training methods cover GA, MACER, and SmoothAdv; the only certification method is randomized smoothing (CERTIFY, n0=100, n=100000, α=0.001) (Section 4, Appendix E.3).
   • Main results are averages over 5 random initializations with 500 target-class test points; some experiments in Appendices D.4–D.6 use 3 initializations; empirical robustness uses 200 (MNIST)/100 (CIFAR10) test points (Section 4, Section 4.6).
   • On the defense side, only two mitigating factors are evaluated: weight regularization and increasing the number of noise samples k (Section 4.2, Appendix D.5); the paper does not report evaluations against poisoning-detection defenses.

   Collapse this answer

6. 06Summarize the main content of the paper

   The authors propose PACD, a clean-label poisoning attack against randomized smoothing certified defenses, which reduces the target-class ACR by more than 30% on MNIST/CIFAR10 and is transferable.

   An attack paper on training-data poisoning of certified robust training. The question the authors focus on is: randomized smoothing (RS) certified defenses can guarantee test-time robustness, but do these guarantees still hold when the training data is poisoned.

   • Method: PACD models poisoning as a constrained bilevel optimization—the upper level minimizes the certified radius of the soft smoothed classifier on the target class, and the lower level simulates the victim's training with GA, MACER, or SmoothAdv; ApproxGrad is used to find an approximate hypergradient, and the poisoning points are clean-label with bounded l∞ perturbations (MNIST ε=0.1, CIFAR10 ε=0.03). In the linear case the authors give an analytical solution: the optimal poisoning is to shift the target-class points as a whole to move the decision boundary.
   • Motivating experiment: The authors report that traditional poisoning optimized against standard training fails under certified robust training (Table 1), indicating the need for poisoning specifically targeting certified defenses.
   • Main results: On CIFAR10, under GA training the target-class ACR drops from 0.521 to 0.059 and ACA from 85.76% to 26.84% (σ=0.25, Table 2); under MACER the ACR drops from 0.593 to 0.379 (Table 3); under SmoothAdv it drops from 0.504 to 0.271 (Table 4). The authors claim the ACR reduction exceeds 30% under all three methods.
   • Transfer and mechanism: The poisoned data transfers to other training methods (Figure 4) and deeper architectures Resnet-56/110 (Figure 7); PGD empirical robustness decreases in tandem (on CIFAR10 with σ=0.25 the average l2 distortion drops from 1.754 to 0.132, Table 5), which the authors say supports the hypothesis that the decision boundary is shifted.
   • Authors' conclusion: The authors hold that data quality is a key factor in obtaining certified robustness but is neglected by current certified defense research; simple means such as weight regularization cannot eliminate this threat. As for limitations, the authors note that bilevel optimization is computationally costly and leave poisoning on ImageNet for future work.

   Collapse this answer

Related papers