{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,6,2]],"date-time":"2026-06-02T04:05:55Z","timestamp":1780373155411,"version":"3.54.1"},"publisher-location":"Cham","reference-count":49,"publisher":"Springer Nature Switzerland","isbn-type":[{"value":"9783032272416","type":"print"},{"value":"9783032272423","type":"electronic"}],"license":[{"start":{"date-parts":[[2026,1,1]],"date-time":"2026-01-01T00:00:00Z","timestamp":1767225600000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"},{"start":{"date-parts":[[2026,1,1]],"date-time":"2026-01-01T00:00:00Z","timestamp":1767225600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2026]]},"DOI":"10.1007\/978-3-032-27242-3_32","type":"book-chapter","created":{"date-parts":[[2026,6,2]],"date-time":"2026-06-02T03:28:10Z","timestamp":1780370890000},"page":"538-556","update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":0,"title":["Exact Certification of\u00a0Data-Poisoning Attacks Using Mixed-Integer Programming"],"prefix":"10.1007","author":[{"ORCID":"https:\/\/orcid.org\/0009-0006-8929-4624","authenticated-orcid":false,"given":"Philip","family":"Sosnin","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Jodie","family":"Knapp","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Fraser","family":"Kennedy","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Josh","family":"Collyer","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-2848-2809","authenticated-orcid":false,"given":"Calvin","family":"Tsay","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"297","published-online":{"date-parts":[[2026,6,1]]},"reference":[{"issue":"3","key":"32_CR1","doi-asserted-by":"publisher","first-page":"457","DOI":"10.2307\/2394164","volume":"23","author":"E Anderson","year":"1936","unstructured":"Anderson, E.: The species problem in iris. Ann. Mo. Bot. Gard. 23(3), 457\u2013509 (1936)","journal-title":"Ann. Mo. Bot. Gard."},{"key":"32_CR2","doi-asserted-by":"crossref","unstructured":"Anderson, R., Huchette, J., Ma, W., Tjandraatmadja, C., Vielma, J.P.: Strong mixed-integer programming formulations for trained neural networks. Math. Programming 183(1), 3\u201339 (2020)","DOI":"10.1007\/s10107-020-01474-5"},{"key":"32_CR3","doi-asserted-by":"crossref","unstructured":"Biggio, B., Rieck, K., Ariu, D., Wressnegger, C., Corona, I., Giacinto, G., Roli, F.: Poisoning behavioral malware clustering. In: Proceedings of the 2014 Workshop on Artificial Intelligent and Security Workshop, pp. 27\u201336 (2014)","DOI":"10.1145\/2666652.2666666"},{"key":"32_CR4","doi-asserted-by":"crossref","unstructured":"Biggio, B., Roli, F.: Wild patterns: Ten years after the rise of adversarial machine learning. In: Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security, pp. 2154\u20132156 (2018)","DOI":"10.1145\/3243734.3264418"},{"key":"32_CR5","unstructured":"Bose, A., Lessard, L., Fazel, M., Dvijotham, K.D.: Keeping up with dynamic attackers: certifying robustness to adaptive online data poisoning. In: International Conference on Artificial Intelligence and Statistics, pp. 4438\u20134446. PMLR (2025)"},{"key":"32_CR6","unstructured":"Bunel, R.R., Turkaslan, I., Torr, P., Kohli, P., Mudigonda, P.K.: A unified view of piecewise linear neural network verification. In: Advances in Neural Information Processing Systems, vol. 31 (2018)"},{"key":"32_CR7","doi-asserted-by":"crossref","unstructured":"Carlini, N., et al.: Poisoning web-scale training datasets is practical. In: 2024 IEEE Symposium on Security and Privacy (SP), pp. 407\u2013425. IEEE (2024)","DOI":"10.1109\/SP54263.2024.00179"},{"key":"32_CR8","unstructured":"Chen, X., Liu, C., Li, B., Lu, K., Song, D.: Targeted backdoor attacks on deep learning systems using data poisoning. arXiv preprint arXiv:1712.05526 (2017)"},{"key":"32_CR9","unstructured":"Duong, H., Nguyen, T., Dwyer, M.: A DPLL (t) framework for verifying deep neural networks. arXiv preprint arXiv:2307.10266 (2023)"},{"key":"32_CR10","unstructured":"Dvijotham, K., Stanforth, R., Gowal, S., Mann, T.A., Kohli, P.: A dual approach to scalable verification of deep networks. In: UAI, vol.\u00a01, p.\u00a03 (2018)"},{"key":"32_CR11","doi-asserted-by":"crossref","unstructured":"Efron, B., Hastie, T., Johnstone, I., Tibshirani, R.: Least angle regression (2004)","DOI":"10.1214\/009053604000000067"},{"key":"32_CR12","doi-asserted-by":"publisher","unstructured":"Ehlers, R.: Formal verification of piece-wise linear feed-forward neural networks. In: D\u2019Souza, D., Narayan Kumar, K. (eds) International Symposium on Automated Technology for Verification and Analysis, pp. 269\u2013286. Springer, Cham (2017). https:\/\/doi.org\/10.1007\/978-3-319-68167-2_19","DOI":"10.1007\/978-3-319-68167-2_19"},{"key":"32_CR13","doi-asserted-by":"crossref","unstructured":"Fischetti, M., Jo, J.: Deep neural networks and mixed integer linear optimization. Constraints 23(3), 296\u2013309 (2018)","DOI":"10.1007\/s10601-018-9285-6"},{"key":"32_CR14","doi-asserted-by":"crossref","unstructured":"Gleixner, A.M., Berthold, T., M\u00fcller, B., Weltge, S.: Three enhancements for optimization-based bound tightening. J. Global Optim. 67(4), 731\u2013757 (2017)","DOI":"10.1007\/s10898-016-0450-4"},{"key":"32_CR15","unstructured":"Goodfellow, I.J., Shlens, J., Szegedy, C.: Explaining and harnessing adversarial examples. arXiv preprint arXiv:1412.6572 (2014)"},{"key":"32_CR16","unstructured":"Gowal, S., et al.: On the effectiveness of interval bound propagation for training verifiably robust models. arXiv preprint arXiv:1810.12715 (2018)"},{"key":"32_CR17","unstructured":"Gu, T., Dolan-Gavitt, B., Garg, S.: BadNets: identifying vulnerabilities in the machine learning model supply chain. arXiv preprint arXiv:1708.06733 (2017)"},{"key":"32_CR18","doi-asserted-by":"crossref","unstructured":"Han, X., Xu, G., Zhou, Y., Yang, X., Li, J., Zhang, T.: Physical backdoor attacks to lane detection systems in autonomous driving. In: Proceedings of the 30th ACM International Conference on Multimedia, pp. 2957\u20132968 (2022)","DOI":"10.1145\/3503161.3548171"},{"key":"32_CR19","unstructured":"Hong, S., Chandrasekaran, V., Kaya, Y., Dumitra\u015f, T., Papernot, N.: On the effectiveness of mitigating data poisoning attacks with gradient shaping. arXiv preprint arXiv:2002.11497 (2020)"},{"key":"32_CR20","unstructured":"Huchette, J., Mu\u00f1oz, G., Serra, T., Tsay, C.: When deep learning meets polyhedral theory: a survey. arXiv preprint arXiv:2305.00241 (2023)"},{"key":"32_CR21","doi-asserted-by":"publisher","unstructured":"Katz, G., Barrett, C., Dill, D.L., Julian, K., Kochenderfer, M.J.: Reluplex: an efficient SMT solver for verifying deep neural networks. In: Majumdar, R., Kun\u010dak, V. (eds) Computer Aided Verification: 29th International Conference, CAV 2017, July 24-28, 2017, Proceedings, Part I 30, pp. 97\u2013117. Springer, Heidelberg, Germany (2017). https:\/\/doi.org\/10.1007\/978-3-319-63387-9_5","DOI":"10.1007\/978-3-319-63387-9_5"},{"key":"32_CR22","unstructured":"Levine, A., Feizi, S.: Deep partition aggregation: provable defense against general poisoning attacks. arXiv preprint arXiv:2006.14768 (2020)"},{"key":"32_CR23","unstructured":"Li, S., Cheng, Y., Wang, W., Liu, Y., Chen, T.: Learning to detect malicious clients for robust federated learning. arXiv preprint arXiv:2002.00211 (2020)"},{"key":"32_CR24","unstructured":"Lorenz, T., Kwiatkowska, M., Fritz, M.: BiCert: a bilinear mixed integer programming formulation for precise certified bounds against data poisoning attacks. arXiv preprint arXiv:2412.10186 (2024)"},{"key":"32_CR25","doi-asserted-by":"publisher","unstructured":"Lorenz, T., Kwiatkowska, M., Fritz, M.: FullCert: deterministic end-to-end certification for training and inference of neural networks. In: Cremers, D., L\u00e4hner, Z., Moeller, M., Nie\u00dfner, M., Ommer, B., Triebel, R. (eds) DAGM German Conference on Pattern Recognition, pp. 71\u201385. Springer, Cham (2024). https:\/\/doi.org\/10.1007\/978-3-031-85181-0_5","DOI":"10.1007\/978-3-031-85181-0_5"},{"key":"32_CR26","unstructured":"M\u00fcller, M.N., Eckert, F., Fischer, M., Vechev, M.: Certified training: small boxes are all you need. arXiv preprint arXiv:2210.04871 (2022)"},{"key":"32_CR27","doi-asserted-by":"crossref","unstructured":"Mu\u00f1oz-Gonz\u00e1lez, L., et al.: Towards poisoning of deep learning algorithms with back-gradient optimization. In: Proceedings of the 10th ACM Workshop on Artificial Intelligence and Security, pp. 27\u201338 (2017)","DOI":"10.1145\/3128572.3140451"},{"key":"32_CR28","doi-asserted-by":"publisher","unstructured":"Newsome, J., Karp, B., Song, D.: Paragraph: Thwarting signature learning by training maliciously. In: Zamboni, D., Kruegel, C. (eds) Recent Advances in Intrusion Detection: 9th International Symposium, RAID 2006 Hamburg, Germany, September 20-22, 2006 Proceedings 9, pp. 81\u2013105. Springer, Berlin, Heidelberg (2006). https:\/\/doi.org\/10.1007\/11856214_5","DOI":"10.1007\/11856214_5"},{"key":"32_CR29","unstructured":"Rezaei, K., Banihashem, K., Chegini, A., Feizi, S.: Run-off Election: improved provable defense against data poisoning attacks. In: International Conference on Machine Learning, pp. 29030\u201329050. PMLR (2023)"},{"key":"32_CR30","unstructured":"Rosenfeld, E., Winston, E., Ravikumar, P., Kolter, Z.: Certified robustness to label-flipping attacks via randomized smoothing. In: International Conference on Machine Learning, pp. 8230\u20138241. PMLR (2020)"},{"key":"32_CR31","unstructured":"Sabanayagam, M., Gosch, L., G\u00fcnnemann, S., Ghoshdastidar, D.: Exact certification of (graph) neural networks against label poisoning. arXiv preprint arXiv:2412.00537 (2024)"},{"key":"32_CR32","doi-asserted-by":"publisher","unstructured":"Singh, G., Gehr, T., P\u00fcschel, M., Vechev, M.: An abstract domain for certifying neural networks. Proc. ACM Program. Lang. 3(POPL) (2019). https:\/\/doi.org\/10.1145\/3290354","DOI":"10.1145\/3290354"},{"key":"32_CR33","unstructured":"Sosnin, P., M\u00fcller, M.N., Baader, M., Tsay, C., Wicker, M.: Certified robustness to data poisoning in gradient-based training. Trans. Mach. Learn. Res., 2835-8856 (2025)"},{"key":"32_CR34","doi-asserted-by":"crossref","unstructured":"Sosnin, P., Tsay, C.: Scaling mixed-integer programming for certification of neural network controllers using bounds tightening. In: 2024 IEEE 63rd Conference on Decision and Control (CDC), pp. 1645\u20131650. IEEE (2024)","DOI":"10.1109\/CDC56724.2024.10886078"},{"key":"32_CR35","unstructured":"Sosnin, P., Wicker, M., Collyer, J., Tsay, C.: Abstract gradient training: a unified certification framework for data poisoning, unlearning, and differential privacy. arXiv preprint arXiv:2511.09400 (2025)"},{"key":"32_CR36","unstructured":"Steinhardt, J., Koh, P.W.W., Liang, P.S.: Certified defenses for data poisoning attacks. In: Advances in Neural Information Processing Systems, vol. 30 (2017)"},{"key":"32_CR37","unstructured":"Szegedy, C., et al.: Intriguing properties of neural networks. arXiv preprint arXiv:1312.6199 (2013)"},{"key":"32_CR38","doi-asserted-by":"crossref","unstructured":"Tian, Z., Cui, L., Liang, J., Yu, S.: A comprehensive survey on poisoning attacks and countermeasures in machine learning. ACM Comput. Surv. 55(8), 1\u201335 (2022)","DOI":"10.1145\/3551636"},{"key":"32_CR39","unstructured":"Tjeng, V., Xiao, K., Tedrake, R.: Evaluating robustness of neural networks with mixed integer programming. arXiv preprint arXiv:1711.07356 (2017)"},{"key":"32_CR40","unstructured":"Tsay, C., Kronqvist, J., Thebelt, A., Misener, R.: Partition-based formulations for mixed-integer optimization of trained ReLU neural networks. In: Advances in Neural Information Processing Systems, vol. 34, pp. 3068\u20133080 (2021)"},{"key":"32_CR41","unstructured":"Wang, W., Levine, A.J., Feizi, S.: Improved certified defenses against data poisoning with (deterministic) finite aggregation. In: International Conference on Machine Learning, pp. 22769\u201322783. PMLR (2022)"},{"key":"32_CR42","unstructured":"Weng, L., et al.: Towards fast computation of certified robustness for ReLU networks. In: International Conference on Machine Learning, pp. 5276\u20135285. PMLR (2018)"},{"key":"32_CR43","unstructured":"Wicker, M., et al.: Certification for differentially private prediction in gradient-based training. In: Forty-second International Conference on Machine Learning (2025)"},{"key":"32_CR44","unstructured":"Wong, E., Kolter, Z.: Provable defenses against adversarial examples via the convex outer adversarial polytope. In: International Conference on Machine Learning, pp. 5286\u20135295. PMLR (2018)"},{"key":"32_CR45","unstructured":"Wong, E., Schmidt, F., Metzen, J.H., Kolter, J.Z.: Scaling provable adversarial defenses. In: Advances in Neural Information Processing Systems, vol. 31 (2018)"},{"key":"32_CR46","doi-asserted-by":"crossref","unstructured":"Xie, C., Long, Y., Chen, P.Y., Li, B.: Uncovering the connection between differential privacy and certified robustness of federated learning against poisoning attacks. arXiv preprint arXiv:2209.04030 (2022)","DOI":"10.1145\/3576915.3623193"},{"key":"32_CR47","doi-asserted-by":"crossref","unstructured":"Yang, G., Gong, N.Z., Cai, Y.: Fake co-visitation injection attacks to recommender systems. In: NDSS (2017)","DOI":"10.14722\/ndss.2017.23020"},{"key":"32_CR48","unstructured":"Zhang, H., Weng, T.W., Chen, P.Y., Hsieh, C.J., Daniel, L.: Efficient neural network robustness certification with general activation functions. In: Advances in Neural Information Processing Systems, vol. 31 (2018)"},{"key":"32_CR49","unstructured":"Zhu, C., Huang, W.R., Li, H., Taylor, G., Studer, C., Goldstein, T.: Transferable clean-label poisoning attacks on deep neural nets. In: International Conference on Machine Learning, pp. 7614\u20137623. PMLR (2019)"}],"container-title":["Lecture Notes in Computer Science","Integration of Constraint Programming, Artificial Intelligence, and Operations Research"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/978-3-032-27242-3_32","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,6,2]],"date-time":"2026-06-02T03:28:22Z","timestamp":1780370902000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1007\/978-3-032-27242-3_32"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026]]},"ISBN":["9783032272416","9783032272423"],"references-count":49,"URL":"https:\/\/doi.org\/10.1007\/978-3-032-27242-3_32","relation":{},"ISSN":["0302-9743","1611-3349"],"issn-type":[{"value":"0302-9743","type":"print"},{"value":"1611-3349","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026]]},"assertion":[{"value":"1 June 2026","order":1,"name":"first_online","label":"First Online","group":{"name":"ChapterHistory","label":"Chapter History"}},{"value":"CPAIOR","order":1,"name":"conference_acronym","label":"Conference Acronym","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"International Conference on the Integration of Constraint Programming, Artificial Intelligence, and Operations Research","order":2,"name":"conference_name","label":"Conference Name","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"Rabat","order":3,"name":"conference_city","label":"Conference City","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"Morocco","order":4,"name":"conference_country","label":"Conference Country","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"2026","order":5,"name":"conference_year","label":"Conference Year","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"26 May 2026","order":7,"name":"conference_start_date","label":"Conference Start Date","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"29 May 2026","order":8,"name":"conference_end_date","label":"Conference End Date","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"23","order":9,"name":"conference_number","label":"Conference Number","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"cpaior2026","order":10,"name":"conference_id","label":"Conference ID","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"https:\/\/sites.google.com\/view\/cpaior2026\/home","order":11,"name":"conference_url","label":"Conference URL","group":{"name":"ConferenceInfo","label":"Conference Information"}}]}}