Jia, J.; Cao, X.; Gong, N. Z. Intrinsic Certified Robustness of Bagging Against Data Poisoning Attacks. AAAI 2021, 35, 7961-7969.