ai-research-survey

scan.json (23200B)

---

 {
   "paper": {
     "title": "Safety-Efficacy Trade Off: Robustness against Data-Poisoning",
     "authors": ["Diego Granziol"],
     "year": 2026,
     "venue": "arXiv",
     "arxiv_id": "2602.00822"
   },
   "scan_version": 2,
   "active_modules": ["experimental_rigor", "data_leakage"],
   "methodology_tags": ["theoretical", "benchmark-eval"],
   "key_findings": "The paper proves that clustered dirty-label poisons induce a rank-one spike in the input Hessian scaling quadratically with attack efficacy, and identifies a 'near-clone' regime for nonlinear kernels where poisoning is effective but spectrally undetectable. Input-gradient regularisation provably contracts poison-aligned eigenmodes at the cost of reduced data-fitting capacity, establishing a fundamental safety-efficacy trade-off. Experiments on CIFAR-10/100 with Pre-ResNet-110 validate the theory, showing that gradient regularisation combined with data augmentation effectively suppresses poisoning.",
   "checklist": {
     "artifacts": {
       "code_released": {
         "applies": true,
         "answer": false,
         "justification": "No repository URL or code archive is provided. Appendix E contains implementation code listings but no link to a runnable repository."
       },
       "data_released": {
         "applies": true,
         "answer": true,
         "justification": "The paper uses publicly available standard benchmarks: MNIST and CIFAR-10/100."
       },
       "environment_specified": {
         "applies": true,
         "answer": false,
         "justification": "The paper mentions PyTorch (torch.autograd) and gpytorch for Lanczos but does not provide a requirements.txt, Dockerfile, or version specifications for dependencies."
       },
       "reproduction_instructions": {
         "applies": true,
         "answer": false,
         "justification": "Appendix E provides detailed code listings (Listings 1-7) and Algorithm 1-2, but there are no step-by-step instructions, README, or runnable scripts to reproduce the full experimental pipeline."
       }
     },
     "statistical_methodology": {
       "confidence_intervals_or_error_bars": {
         "applies": true,
         "answer": false,
         "justification": "No confidence intervals or error bars are reported. Figures 6-9 and Table 1 show point estimates only."
       },
       "significance_tests": {
         "applies": true,
         "answer": false,
         "justification": "No statistical significance tests are used. Claims about the safety-efficacy trade-off are based on comparing point estimates across κ and θ values without any formal testing."
       },
       "effect_sizes_reported": {
         "applies": true,
         "answer": true,
         "justification": "Effect sizes are reported in context: e.g., Table 1 shows that at θ=0.02, κ=10^5, increasing epochs from 90→450 yields 'a small (≈2%) improvement in accuracy' while boosting ASR from 6.63% to 70.68%. Figures show absolute ASR and accuracy values across conditions."
       },
       "sample_size_justified": {
         "applies": true,
         "answer": false,
         "justification": "No justification is given for the choice of poison fractions, number of κ values tested, or why CIFAR-10/100 and MNIST are sufficient for validating the theoretical claims."
       },
       "variance_reported": {
         "applies": true,
         "answer": false,
         "justification": "No variance, standard deviation, or spread measures are reported across experimental runs. All results appear to be single-run."
       }
     },
     "evaluation_design": {
       "baselines_included": {
         "applies": true,
         "answer": true,
         "justification": "The κ=0 (no regularisation) baseline is included throughout. Comparisons are made across multiple κ values and with/without data augmentation."
       },
       "baselines_contemporary": {
         "applies": true,
         "answer": true,
         "justification": "The paper uses the standard BadNets-style L-shaped poison (Gu et al., 2017) and the WaNet imperceptible warp (Nguyen et al., 2021). As a theoretical paper proposing a new defense framework, comparing against no-defense and varying defense strength is appropriate."
       },
       "ablation_study": {
         "applies": true,
         "answer": true,
         "justification": "Systematic ablations across κ (regularisation strength), θ (poison fraction), augmentation on/off, epoch count (90 vs 450), and stochastic vs deterministic poisoning. Multiple figures and Table 1 show these variations."
       },
       "multiple_metrics": {
         "applies": true,
         "answer": true,
         "justification": "Three metrics are used: attack success rate (ASR), clean test accuracy, and cosine-overlap² between the top Hessian eigenvector and the poison direction."
       },
       "human_evaluation": {
         "applies": false,
         "answer": false,
         "justification": "Human evaluation is irrelevant to claims about mathematical properties of poisoning attacks and defenses in neural networks."
       },
       "held_out_test_set": {
         "applies": true,
         "answer": true,
         "justification": "Clean test accuracy and ASR are reported on the standard CIFAR/MNIST test sets, which are separate from training data."
       },
       "per_category_breakdown": {
         "applies": true,
         "answer": true,
         "justification": "Results are broken down by dataset (MNIST, CIFAR-10, CIFAR-100), by poison type (rank-1 additive, warp), by training regime (stochastic, deterministic), and across all κ and θ values."
       },
       "failure_cases_discussed": {
         "applies": true,
         "answer": true,
         "justification": "Section 5.3 investigates the collapse of eigenvector-poison overlap at high θ and discovers the 'poison rotation' phenomenon across eigenvectors. Table 1 shows that increased training undermines the defense (ASR jumps from 6.63% to 70.68%)."
       },
       "negative_results_reported": {
         "applies": true,
         "answer": true,
         "justification": "Table 1 shows that increased training (450 epochs) severely undermines the defense even at high κ. The paper also notes that data augmentation alone is NOT effective at mitigating poisoning (Section 5.1, Conclusion)."
       }
     },
     "claims_and_evidence": {
       "abstract_claims_supported": {
         "applies": true,
         "answer": true,
         "justification": "The abstract claims about rank-one spike (Theorem 3.4), near-clone spectral invisibility (Corollary 3.7), gradient regularisation contraction (Theorem 3.12), and the safety-efficacy trade-off (Theorem 3.9) are all supported by formal proofs and experimental validation in Sections 4-5."
       },
       "causal_claims_justified": {
         "applies": true,
         "answer": true,
         "justification": "Causal claims (e.g., regularisation reduces poisoning efficacy) are supported by both mathematical proofs (Theorems 3.9, 3.12) and controlled experimental ablations varying κ while holding other factors constant."
       },
       "generalization_bounded": {
         "applies": true,
         "answer": false,
         "justification": "The title claims 'Robustness against Data-Poisoning' broadly but experiments are limited to image classification on MNIST/CIFAR with only two attack types (rank-1 additive and warp). No discussion of text/NLP poisoning, clean-label attacks beyond warp, or more complex architectures like transformers."
       },
       "alternative_explanations_discussed": {
         "applies": true,
         "answer": true,
         "justification": "Section 5.3 investigates the eigenvector rotation hypothesis for the overlap collapse phenomenon. Section 3.4 discusses neural collapse as the mechanism enabling the near-clone regime, providing a mechanistic alternative explanation for why poisons are effective."
       },
       "proxy_outcome_distinction": {
         "applies": true,
         "answer": true,
         "justification": "The paper directly measures ASR, clean accuracy, and spectral overlap — exactly the quantities it theorizes about. No proxy gap exists between measurements and claims."
       }
     },
     "setup_transparency": {
       "model_versions_specified": {
         "applies": true,
         "answer": true,
         "justification": "Architecture is specified: 'Pre-Residual-110 layer variant (He et al., 2016)' trained from scratch. No pre-trained model versions are involved."
       },
       "prompts_provided": {
         "applies": false,
         "answer": false,
         "justification": "The paper does not use any prompting; it trains neural networks from scratch."
       },
       "hyperparameters_reported": {
         "applies": true,
         "answer": true,
         "justification": "Section 5 specifies: learning rate α=0.1, momentum β=0.9, decay ρ=0.1 every e//3 epochs, e∈{90,450}, random 28×28 crop and flip, image normalisation, warp strength ϕ=0.02."
       },
       "scaffolding_described": {
         "applies": false,
         "answer": false,
         "justification": "No agentic scaffolding is used."
       },
       "data_preprocessing_documented": {
         "applies": true,
         "answer": true,
         "justification": "Poisoning procedure documented in Appendix E with code. Normalisation, augmentation (random 28×28 crop and flip), deterministic per-sample seeding (seed=idx+42), and L-shape mask generation are all described."
       }
     },
     "limitations_and_scope": {
       "limitations_section_present": {
         "applies": true,
         "answer": false,
         "justification": "No dedicated limitations section. Section 7 (Broader Impact) discusses dual-use risk but not methodological limitations of the work."
       },
       "threats_to_validity_specific": {
         "applies": true,
         "answer": false,
         "justification": "No threats to validity are discussed. The gap between kernel theory (infinite-width) and finite-width experiments is acknowledged implicitly but not explicitly analyzed as a threat."
       },
       "scope_boundaries_stated": {
         "applies": true,
         "answer": false,
         "justification": "The paper does not explicitly state what was NOT tested. No mention of scope limitations regarding attack types, datasets, architectures (e.g., transformers), or domains beyond image classification."
       }
     },
     "data_integrity": {
       "raw_data_available": {
         "applies": true,
         "answer": true,
         "justification": "MNIST and CIFAR-10/100 are publicly available standard benchmarks. However, the specific experimental outputs (trained models, metric logs) are not released."
       },
       "data_collection_described": {
         "applies": true,
         "answer": true,
         "justification": "Standard benchmarks are used with clearly described poisoning procedures. Appendix E provides complete poison dataset implementation including deterministic seeding."
       },
       "recruitment_methods_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants. Data comes from standard public benchmarks."
       },
       "data_pipeline_documented": {
         "applies": true,
         "answer": true,
         "justification": "The full pipeline from data loading through poisoning, normalisation, training, and Hessian computation is documented in Appendix E with code listings and algorithms."
       }
     },
     "conflicts_of_interest": {
       "funding_disclosed": {
         "applies": true,
         "answer": false,
         "justification": "No funding source is disclosed anywhere in the paper."
       },
       "affiliations_disclosed": {
         "applies": true,
         "answer": true,
         "justification": "Author affiliation is disclosed: Mathematical Institute, University of Oxford, UK."
       },
       "funder_independent_of_outcome": {
         "applies": true,
         "answer": false,
         "justification": "No funding is disclosed, so independence cannot be assessed."
       },
       "financial_interests_declared": {
         "applies": true,
         "answer": false,
         "justification": "No competing interests or financial interests statement is present in the paper."
       }
     },
     "contamination": {
       "training_cutoff_stated": {
         "applies": false,
         "answer": false,
         "justification": "The paper trains models from scratch on CIFAR/MNIST; it does not evaluate a pre-trained model's capability on benchmarks."
       },
       "train_test_overlap_discussed": {
         "applies": false,
         "answer": false,
         "justification": "Models are trained from scratch using standard train/test splits. Pre-trained model contamination concerns do not apply."
       },
       "benchmark_contamination_addressed": {
         "applies": false,
         "answer": false,
         "justification": "No pre-trained model is evaluated. Standard supervised learning on public benchmarks with canonical splits."
       }
     },
     "human_studies": {
       "pre_registered": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "irb_or_ethics_approval": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "demographics_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "inclusion_exclusion_criteria": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "randomization_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "blinding_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "attrition_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       }
     },
     "cost_and_practicality": {
       "inference_cost_reported": {
         "applies": true,
         "answer": false,
         "justification": "No inference cost, latency, or per-example cost is reported despite computing Hessian eigenvectors (expensive operation) and training with gradient regularisation."
       },
       "compute_budget_stated": {
         "applies": true,
         "answer": false,
         "justification": "No GPU hours, total training time, or hardware specifications are provided."
       }
     },
     "experimental_rigor": {
       "seed_sensitivity_reported": {
         "applies": true,
         "answer": false,
         "justification": "No multi-seed results are reported. All experiments appear to be single-run."
       },
       "number_of_runs_stated": {
         "applies": true,
         "answer": false,
         "justification": "The number of experimental runs is never stated."
       },
       "hyperparameter_search_budget": {
         "applies": true,
         "answer": false,
         "justification": "No hyperparameter search budget is reported. The values of κ tested appear chosen but no search procedure is described."
       },
       "best_config_selection_justified": {
         "applies": true,
         "answer": true,
         "justification": "All tested configurations are shown in figures and tables (all κ values, all θ values), so there is no selective reporting of a single best configuration."
       },
       "multiple_comparison_correction": {
         "applies": false,
         "answer": false,
         "justification": "No statistical tests are performed, so multiple comparison correction is not applicable."
       },
       "self_comparison_bias_addressed": {
         "applies": true,
         "answer": false,
         "justification": "The paper does not compare against other published defense methods (e.g., spectral signatures, activation clustering) and does not acknowledge the limitation of only evaluating their own proposed defense."
       },
       "compute_budget_vs_performance": {
         "applies": true,
         "answer": false,
         "justification": "Gradient regularisation adds significant computational cost (second-order gradients with create_graph=True) but this is not quantified or compared to baseline training cost."
       },
       "benchmark_construct_validity": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of whether CIFAR-10/100 with simple trigger patterns is representative of real-world data poisoning scenarios."
       },
       "scaffold_confound_addressed": {
         "applies": false,
         "answer": false,
         "justification": "No scaffolding involved."
       }
     },
     "data_leakage": {
       "temporal_leakage_addressed": {
         "applies": false,
         "answer": false,
         "justification": "Models are trained from scratch on standard datasets. Temporal leakage through pre-training does not apply."
       },
       "feature_leakage_addressed": {
         "applies": false,
         "answer": false,
         "justification": "Standard supervised training from scratch. Feature leakage concerns for pre-trained models do not apply."
       },
       "non_independence_addressed": {
         "applies": false,
         "answer": false,
         "justification": "Standard CIFAR/MNIST train/test splits are used. The non-independence concern for pre-trained model benchmarking does not apply."
       },
       "leakage_detection_method": {
         "applies": false,
         "answer": false,
         "justification": "No pre-trained model evaluation; standard train/test splits used."
       }
     }
   },
   "claims": [
     {
       "claim": "Clustered dirty-label poisons induce a rank-one spike in the input Hessian whose magnitude scales quadratically with attack efficacy.",
       "evidence": "Theorem 3.4 proves ΛGN(x0) = Rk(x0,ζ) · (Δf(x0))², establishing the quadratic relationship. Figures 5-6 show empirical cosine overlap increasing with poison fraction θ.",
       "supported": "strong"
     },
     {
       "claim": "For nonlinear kernels, there exists a near-clone regime where poisoning is effective but spectrally undetectable.",
       "evidence": "Corollary 3.7 proves that when r/ℓ ≪ 1, efficacy remains order-one while curvature vanishes quadratically (O(r²/ℓ⁴)). Figures 1-3 provide experimental evidence of feature-space near-cloning via neural collapse.",
       "supported": "strong"
     },
     {
       "claim": "Input-gradient regularisation provably reduces data-fitting capacity while protecting against data poisoning.",
       "evidence": "Theorem 3.9 proves df(κ) is strictly decreasing in κ. Theorem 3.12 shows exponential compression of Fisher eigenmodes. Figures 6-7 and 10a demonstrate the trade-off experimentally across CIFAR-10/100.",
       "supported": "strong"
     },
     {
       "claim": "Data augmentation combined with gradient regularisation is effective at mitigating poisoning, while augmentation alone is not.",
       "evidence": "Comparison of Figure 6 (no augmentation) vs Figure 7 (with augmentation) shows that augmentation alone doesn't prevent high ASR, but combined with high κ, ASR drops substantially.",
       "supported": "moderate"
     },
     {
       "claim": "Increased training duration improves the safety-efficacy frontier but also boosts poison efficacy.",
       "evidence": "Table 1 shows at θ=0.02, κ=10⁵: 90 epochs gives 75.17% accuracy/6.63% ASR, while 450 epochs gives 79.05% accuracy/70.68% ASR — a ~2% accuracy gain but catastrophic defense failure.",
       "supported": "strong"
     }
   ],
   "red_flags": [
     {
       "flag": "No variance or multi-seed results",
       "detail": "All experiments appear to be single-run with no error bars, confidence intervals, or multi-seed analysis. For a paper making claims about fundamental trade-offs, the stability of results across random initialisations is unknown."
     },
     {
       "flag": "No comparison against existing defenses",
       "detail": "The paper proposes gradient regularisation as a defense but does not compare against any existing defense methods (spectral signatures, activation clustering, STRIP, Neural Cleanse, etc.). Related work discusses them but no empirical comparison is made."
     },
     {
       "flag": "Limited attack diversity",
       "detail": "Only two attack types tested (rank-1 additive L-shape and warp), both dirty-label. No clean-label attacks, no adaptive attacks against the proposed defense, no text-domain attacks."
     },
     {
       "flag": "No limitations section",
       "detail": "The paper lacks any discussion of methodological limitations, scope boundaries, or threats to validity despite significant gaps between the theoretical model (infinite-width kernels) and experimental setting (finite-width ResNets)."
     }
   ],
   "cited_papers": [
     {
       "title": "Sleeper agents: Training deceptive LLMs that persist through safety training",
       "authors": ["Evan Hubinger", "Carson Denison", "Jesse Mu"],
       "year": 2024,
       "arxiv_id": "2401.05566",
       "relevance": "Demonstrates deceptive alignment in LLMs — directly relevant to AI safety and backdoor persistence."
     },
     {
       "title": "BadEdit: Backdooring large language models by model editing",
       "authors": ["Yanzhou Li", "Tianlin Li", "Kangjie Chen"],
       "year": 2024,
       "relevance": "Shows backdoor insertion into LLMs via model editing with as few as 15 samples, relevant to LLM security."
     },
     {
       "title": "BadChain: Backdoor chain-of-thought prompting for large language models",
       "authors": ["Zhen Xiang", "Fengqing Jiang", "Zidi Xiong"],
       "year": 2024,
       "relevance": "Backdoor attacks targeting chain-of-thought reasoning in LLMs, relevant to LLM safety evaluation."
     },
     {
       "title": "ShadowCast: Stealthy data poisoning attacks against vision-language models",
       "authors": ["Yuancheng Xu", "Jiarui Yao", "Manli Shu"],
       "year": 2024,
       "arxiv_id": "2402.06659",
       "relevance": "Clean-label poisoning in vision-language models, relevant to multimodal AI safety."
     },
     {
       "title": "Poisoning and backdooring contrastive learning",
       "authors": ["Nicholas Carlini", "Andreas Terzis"],
       "year": 2022,
       "relevance": "Backdoor attacks on contrastive learning (e.g., CLIP), relevant to foundation model security."
     },
     {
       "title": "BadGPT: Exploring security vulnerabilities of ChatGPT via backdoor attacks to InstructGPT",
       "authors": ["Jiawen Shi", "Yixin Liu", "Pan Zhou"],
       "year": 2023,
       "arxiv_id": "2304.12298",
       "relevance": "Backdoor attacks on RLHF-trained LLMs, relevant to LLM safety."
     },
     {
       "title": "Adversarial training for defense against label poisoning attacks",
       "authors": ["M. I. Bal", "V. Cevher", "M. Muehlebach"],
       "year": 2025,
       "relevance": "Contemporary adversarial training defense against poisoning, directly relevant to the defense comparison gap in this paper."
     }
   ]
 }