Backdoor data poisoning attacks have recently been demonstrated in computer\nvision research as a potential safety risk for machine learning (ML) systems.\nTraditional data poisoning attacks manipulate training data to induce\nunreliability of an ML model, whereas backdoor data poisoning attacks maintain\nsystem performance unless the ML model is presented with an input containing an\nembedded "trigger" that provides a predetermined response advantageous to the\nadversary. Our work builds upon prior backdoor data-poisoning research for ML\nimage classifiers and systematically assesses different experimental conditions\nincluding types of trigger patterns, persistence of trigger patterns during\nretraining, poisoning strategies, architectures (ResNet-50, NasNet,\nNasNet-Mobile), datasets (Flowers, CIFAR-10), and potential defensive\nregularization techniques (Contrastive Loss, Logit Squeezing, Manifold Mixup,\nSoft-Nearest-Neighbors Loss). Experiments yield four key findings. First, the\nsuccess rate of backdoor poisoning attacks varies widely, depending on several\nfactors, including model architecture, trigger pattern and regularization\ntechnique. Second, we find that poisoned models are hard to detect through\nperformance inspection alone. Third, regularization typically reduces backdoor\nsuccess rate, although it can have no effect or even slightly increase it,\ndepending on the form of regularization. Finally, backdoors inserted through\ndata poisoning can be rendered ineffective after just a few epochs of\nadditional training on a small set of clean data without affecting the model's\nperformance.\n