DataFilter: Methods & Applications

• DataFilter is a class of specialized mechanisms that preprocess data to reduce costly downstream computation and improve performance.
• It encompasses CNN-based image selection, LLM prompt-injection defenses, and query-time filtering techniques for effective data curation.
• These methods enhance efficiency by using tailored scoring, clustering, and adaptive strategies to selectively retain high-quality data.

DataFilter is a name applied in several research settings to mechanisms that remove, retain, sanitize, or prune data before a downstream system incurs higher computational or semantic cost. In the literature represented here, the term covers at least three distinct but related uses: a CNN-based pipeline for filtering large image collections, also referred to as ImagiFilter (Alberts et al., 2020); a test-time defense that strips malicious instructions from untrusted external data before it reaches a backend LLM (Wang et al., 22 Oct 2025); and a broader family of data-centric filtering methods for web-scale multimodal corpora, human-feedback datasets, and database execution pipelines (Xu et al., 2023). Across these uses, the common design principle is that filtering is not merely exclusion of obvious noise, but selective control of which information is allowed to affect training, inference, or query evaluation.

1. Scope of the term

In the surveyed literature, “DataFilter” does not denote a single canonical algorithm. It denotes a class of systems whose shared role is to intervene between raw data and an expensive downstream procedure.

Context	Core objective	Representative source
Large image collections	Remove non-photographic or otherwise undesirable images	(Alberts et al., 2020)
LLM security	Remove injected instructions from untrusted data	(Wang et al., 22 Oct 2025)
Multimodal pre-training	Select higher-quality image-text pairs	(Xu et al., 2023)
Human-feedback alignment	Select informative, high-quality, diverse preference pairs	(Yang et al., 2024)
Query processing	Prune irrelevant data before expensive execution	(Stoian et al., 2 Jun 2026, Komamizu, 2020, Burger et al., 2013)
Approximate membership	Answer membership approximately with bounded false positives	(Bercea et al., 2022)

A recurrent misconception is that data filtering is equivalent to generic denoising. The sources here present a narrower and more operational view: filtering is usually tied to a specific downstream objective, such as CLIP pre-training, DPO fine-tuning, safe LLM execution, or low-latency query processing. This suggests that “DataFilter” is best understood as a task-coupled selection or sanitization layer rather than a universal notion of data cleaning.

2. Multimodal and web-scale training-data filtering

In web-scale multimodal learning, filtering is often formulated as a scoring problem over image-text pairs. A standard CLIP-score filter uses image and text encoders $f_I(\cdot)\in\mathbb{R}^d$ and $f_T(\cdot)\in\mathbb{R}^d$ and ranks pairs by cosine similarity,

$$s(I,T)=\frac{\langle f_I(I),f_T(T)\rangle}{\|f_I(I)\|\|f_T(T)\|},$$

retaining the top $\alpha\%$ or those above a threshold (Xu et al., 2023). “Devil in the Number” argues that large-scale web data contain many spurious or redundant numeric tokens, and that CLIP’s text embedding can drift substantially when the same caption is decorated with different numbers even though the visual content is unchanged. Its text-masking operator deletes all tokens containing digits and strips parenthesized or bracketed spans, yielding a masked score

$$s_m(I,T)=\frac{\langle f_I(I),f_T(T_{\text{masked}})\rangle}{\|f_I(I)\|\|f_T(T_{\text{masked}})\|}.$$

On a LAION-style pool, when selecting the top $40\%$ of the data, the standard CLIP score filter achieved zero-shot top-1 $4.48\%$ and the text-masked CLIP filter achieved $4.64\%$; on the DataComp “small” benchmark, masked CLIP at $30\%$ achieved $5.7\%$ on ImageNet distribution shift versus $f_T(\cdot)\in\mathbb{R}^d$0 for CLIP L/14, described as an approximately $f_T(\cdot)\in\mathbb{R}^d$1 relative gain on distribution shifts (Xu et al., 2023). The same work also notes a limitation: some truly essential numerical facts, such as “COVID-19,” would also be masked, motivating language rewrite rather than unconditional deletion.

A more elaborate multimodal filtering pipeline appears in “The Devil is in the Details,” which organizes filtering into single-modality filtering, cross-modality filtering, and distribution alignment (Yu et al., 2023). Its single-modality stage includes conservative near-duplicate removal using FAISS IndexIVFPQ on CLIP ViT-L/14 embeddings, part-of-speech pattern blacklists, high-frequency caption filtering, non-English removal with fastText language identification, aspect-ratio filtering, and a face-area filter. Its cross-modality stage introduces “flipped-CLIP,” defined by

$f_T(\cdot)\in\mathbb{R}^d$2

with the stated aim of mitigating interference from scene text. Distribution alignment then uses cluster-importance-based data selection, quality-based duplication, semantic deduplication, and digit-recognition enhancement. Under the DataComp medium-track budget, the pipeline progressed from a baseline 38-task average of $f_T(\cdot)\in\mathbb{R}^d$3 to $f_T(\cdot)\in\mathbb{R}^d$4, with digit tasks rising from $f_T(\cdot)\in\mathbb{R}^d$5 to $f_T(\cdot)\in\mathbb{R}^d$6 (Yu et al., 2023). The same paper explicitly states that methods tuned on the medium track do not transfer seamlessly to the large track, underscoring the distribution sensitivity of filtering.

“Data Filtering Networks” sharpens a methodological point: the quality of a network for filtering is distinct from its performance on downstream tasks (Fang et al., 2023). In that framework, a learned filter assigns a score $f_T(\cdot)\in\mathbb{R}^d$7, often as a cosine between image and text embeddings, and selects top-$f_T(\cdot)\in\mathbb{R}^d$8 pairs or samples according to a score-derived distribution. The reported result is that DFN-filtered subsets outperform LAION-2B, WIT, and DataComp-1B under identical compute budgets, and that a ViT-H trained on DFN-5B achieves $f_T(\cdot)\in\mathbb{R}^d$9 zero-shot transfer accuracy on ImageNet (Fang et al., 2023). A related but text-only variant, TBDFiltering, uses text embeddings, Borůvka-style hierarchical clustering, and adaptive LLM querying of clusters. It labels a cluster as “bad” if $$s(I,T)=\frac{\langle f_I(I),f_T(T)\rangle}{\|f_I(I)\|\|f_T(T)\|},$$0 and “good” if $$s(I,T)=\frac{\langle f_I(I),f_T(T)\rangle}{\|f_I(I)\|\|f_T(T)\|},$$1, otherwise recursing to children. Across C4, ThePile, and FineWeb EDU, it reports a $$s(I,T)=\frac{\langle f_I(I),f_T(T)\rangle}{\|f_I(I)\|\|f_T(T)\|},$$2–$$s(I,T)=\frac{\langle f_I(I),f_T(T)\rangle}{\|f_I(I)\|\|f_T(T)\|},$$3 average relative improvement over baseline, while only approximately $$s(I,T)=\frac{\langle f_I(I),f_T(T)\rangle}{\|f_I(I)\|\|f_T(T)\|},$$4 of chunks are ever prompted (Busa-Fekete et al., 29 Jan 2026).

Filtering of human-feedback data for alignment follows a similar logic but with different signals. FiFA selects a subset $$s(I,T)=\frac{\langle f_I(I),f_T(T)\rangle}{\|f_I(I)\|\|f_T(T)\|},$$5 of size $$s(I,T)=\frac{\langle f_I(I),f_T(T)\rangle}{\|f_I(I)\|\|f_T(T)\|},$$6 by maximizing preference margin, text quality, and text diversity,

$$s(I,T)=\frac{\langle f_I(I),f_T(T)\rangle}{\|f_I(I)\|\|f_T(T)\|},$$7

and approximates this with a per-pair importance score $$s(I,T)=\frac{\langle f_I(I),f_T(T)\rangle}{\|f_I(I)\|\|f_T(T)\|},$$8 (Yang et al., 2024). On Pick-a-Pic v2, it selects $$s(I,T)=\frac{\langle f_I(I),f_T(T)\rangle}{\|f_I(I)\|\|f_T(T)\|},$$9 pairs from approximately $\alpha\%$0K, and for SDXL reduces GPU hours from approximately $\alpha\%$1 h to approximately $\alpha\%$2 h while reporting that SDXL+FiFA wins versus Full DPO by $\alpha\%$3 overall human preference and $\alpha\%$4 text-image alignment (Yang et al., 2024). Taken together, these works suggest that modern DataFilter systems often function as budget allocators: they determine which examples deserve scarce training steps or expensive supervision.

3. DataFilter as ImagiFilter for large-scale image collections

In computer vision dataset curation, DataFilter refers to the pipeline also called ImagiFilter, introduced as a resource for semi-automatic mining of images at scale (Alberts et al., 2020). The pipeline begins with a 6,000-image dataset built from images crawled by random walks on the BabelNet graph starting from the 1,000 ILSVRC/ImageNet synsets. It contains 3,000 photographic images and 3,000 non-photographic images under a binary criterion, “photographic” versus “non-photographic.” Every non-photographic image received one or more of the tags maps, drawings/hand-sketches, graphs/rendered charts, icons/logos, flags, or an additional “other” tag. Negative subclass counts are reported as 1,042 maps, 810 icons/logos, 425 graphs/rendered, 372 flags, 157 sketches/drawings, and 206 other images (Alberts et al., 2020).

The modeling strategy is explicitly two-stage: a coarse classifier distinguishes photographic from non-photographic images, and fine-grained binary classifiers separately detect negative subclasses. Three CNN backbones were compared: LeNet-5 trained from scratch, VGG-19 pre-trained on ImageNet, and ResNet-152 pre-trained on ImageNet. All classifier heads are single fully connected layers with two outputs, trained with cross-entropy using Adam at $\alpha\%$5, $\alpha\%$6, $\alpha\%$7, and $\alpha\%$8, batch size $\alpha\%$9, and no random crops, flips, or color jitter in the published experiments (Alberts et al., 2020).

Validation results on the coarse task were $$s_m(I,T)=\frac{\langle f_I(I),f_T(T_{\text{masked}})\rangle}{\|f_I(I)\|\|f_T(T_{\text{masked}})\|}.$$0 for LeNet-5, $$s_m(I,T)=\frac{\langle f_I(I),f_T(T_{\text{masked}})\rangle}{\|f_I(I)\|\|f_T(T_{\text{masked}})\|}.$$1 for VGG-19, and $$s_m(I,T)=\frac{\langle f_I(I),f_T(T_{\text{masked}})\rangle}{\|f_I(I)\|\|f_T(T_{\text{masked}})\|}.$$2 for ResNet-152 (Alberts et al., 2020). On fine-grained balanced subsets, the reported ranges extend to approximately $$s_m(I,T)=\frac{\langle f_I(I),f_T(T_{\text{masked}})\rangle}{\|f_I(I)\|\|f_T(T_{\text{masked}})\|}.$$3–$$s_m(I,T)=\frac{\langle f_I(I),f_T(T_{\text{masked}})\rangle}{\|f_I(I)\|\|f_T(T_{\text{masked}})\|}.$$4 for maps, icons, graphs, and flags with VGG-19 or ResNet-152, while sketches are harder, with approximately $$s_m(I,T)=\frac{\langle f_I(I),f_T(T_{\text{masked}})\rangle}{\|f_I(I)\|\|f_T(T_{\text{masked}})\|}.$$5–$$s_m(I,T)=\frac{\langle f_I(I),f_T(T_{\text{masked}})\rangle}{\|f_I(I)\|\|f_T(T_{\text{masked}})\|}.$$6 for VGG-19 and approximately $$s_m(I,T)=\frac{\langle f_I(I),f_T(T_{\text{masked}})\rangle}{\|f_I(I)\|\|f_T(T_{\text{masked}})\|}.$$7–$$s_m(I,T)=\frac{\langle f_I(I),f_T(T_{\text{masked}})\rangle}{\|f_I(I)\|\|f_T(T_{\text{masked}})\|}.$$8 for ResNet-152. The authors also report sample confusion matrices, including for “maps” with ResNet-152, where true negatives were $$s_m(I,T)=\frac{\langle f_I(I),f_T(T_{\text{masked}})\rangle}{\|f_I(I)\|\|f_T(T_{\text{masked}})\|}.$$9, false positives $40\%$0, false negatives $40\%$1, and true positives $40\%$2 (Alberts et al., 2020).

Operationally, the recommended deployment is to run the coarse filter after a web crawler or image downloader, then apply the five fine-grained classifiers in parallel to subsets that still require inspection (Alberts et al., 2020). The repository includes the dataset, code, and trained models. The paper also notes limitations that are typical of supervised filter construction: negative subclasses are unbalanced, “other” is a catch-all with no structure, and no rigorous statistical-significance tests were reported. A plausible implication is that ImagiFilter exemplifies a supervised, label-rich DataFilter regime in which explicit taxonomies of undesirable content matter as much as raw accuracy.

4. DataFilter as a prompt-injection defense for LLM agents

A distinct use of the name appears in security research. “Defending Against Prompt Injection with DataFilter” defines DataFilter as a test-time, model-agnostic defense that removes malicious instructions from untrusted data before it reaches a backend LLM (Wang et al., 22 Oct 2025). The formal setting uses a trusted user instruction $40\%$3, untrusted external data $40\%$4, and a filter model $40\%$5. The data may contain an injected instruction segment $40\%$6, written as $40\%$7. The defender’s goal is that if $40\%$8 contains no injection then $40\%$9, while if $4.48\%$0 contains injection $4.48\%$1 then $4.48\%$2 (Wang et al., 22 Oct 2025).

Training is cast as a sequence-to-sequence supervised fine-tuning problem. The training set combines benign triples $4.48\%$3 with attacked triples $4.48\%$4, where $4.48\%$5 is obtained by inserting simulated prompt injections of three types—Straightforward, Ignore, and Completion—into $4.48\%$6 at random positions. The loss is standard cross-entropy on the clean target sequence,

$4.48\%$7

In practice, the paper fine-tunes Llama-3.1-8B-Instruct for $4.48\%$8 steps with learning rate $4.48\%$9, batch size $4.64\%$0 per GPU, gradient accumulation $4.64\%$1, and DeepSpeed ZeRO-3 (Wang et al., 22 Oct 2025).

The I/O format adds two learned special tokens, <|end_of_instruction|> and <|end_of_data|>, and trains the model to output exactly the cleaned data followed by the end-of-data token. At inference time, the procedure is to format $4.64\%$2 for the filter, generate sanitized data from DataFilter, and then call the backend LLM on $4.64\%$3; for JSON, the paper recommends parse-filter-reconstruct so that keys and value strings are filtered recursively and syntax remains valid (Wang et al., 22 Oct 2025).

The empirical claim is strong but narrowly scoped. On SEP, averaged over six attacks, unprotected ASR varies from approximately $4.64\%$4–$4.64\%$5, while DataFilter yields ASR approximately $4.64\%$6. On AgentDojo, the worst-attack ASR falls from approximately $4.64\%$7 to approximately $4.64\%$8, while benign-task utility drops only from $4.64\%$9 to $30\%$0. On InjecAgent, Base ASR drops from approximately $30\%$1 to approximately $30\%$2, and Enhanced ASR from approximately $30\%$3 to $30\%$4. On AlpacaEval2 with a gpt-4o backend, win rate changes from $30\%$5 to $30\%$6 (Wang et al., 22 Oct 2025). The paper summarizes these results as reducing ASR to near zero while preserving more than $30\%$7 of original utility. Its limitations are explicit: it adds one extra LLM call, it was not evaluated against optimization-based attacks, and very long user instructions may be misinterpreted unless summarized (Wang et al., 22 Oct 2025).

5. Query-time DataFilter systems in databases and interactive analysis

Another class of DataFilter mechanisms operates at query time rather than during model training. In “SPARQL with XQuery-based Filtering,” XQueryFILTER extends SPARQL syntax so that an XQuery expression can appear wherever a standard FILTER occurs (Komamizu, 2020). Formally, if $30\%$8 is the set of SPARQL solution mappings over RDF graph $30\%$9, and $5.7\%$0 is XQuery evaluation against an XML store $5.7\%$1, then

$5.7\%$2

The paper identifies three canonical plans—parallel, SPARQL-first, and XQuery-first—and gives cost models

$5.7\%$3

$5.7\%$4

$5.7\%$5

Experimental results show that XQuery-first is best when SPARQL is slow and XQuery selectivity is low, SPARQL-first is best when XML is slow, and the parallel plan becomes marginally better in a balanced scenario beyond approximately 1,000 SPARQL hits (Komamizu, 2020). The same paper also notes limitations: only boolean-returning XQuery expressions are supported, and UNION-heavy rewriting in the XQuery-first plan can blow up a SPARQL query when XQuery selectivity is high.

MLSkip brings filtering into database execution for ML predicates (Stoian et al., 2 Jun 2026). When a query contains WHERE model(col₁,…,col_d)>τ, MLSkip uses Parquet metadata to determine whether there exists any $5.7\%$6 in a row group domain $5.7\%$7 such that $5.7\%$8. For ReLU networks it reduces this to satisfiability over the input constraints and the output constraint using off-the-shelf NNV tools such as Marabou or abCROWN. With min-max metadata alone, the induced domain is

$5.7\%$9

On TPC-H and TPC-DS, for filters of selectivity below $f_T(\cdot)\in\mathbb{R}^d$00, average pruning effectiveness is $f_T(\cdot)\in\mathbb{R}^d$01 with min-max metadata. MLSkip then proposes a size-bounded 2D convex hull, encoded in at most $f_T(\cdot)\in\mathbb{R}^d$02 bytes per row group and column pair for depth $f_T(\cdot)\in\mathbb{R}^d$03, increasing pruning effectiveness to $f_T(\cdot)\in\mathbb{R}^d$04; the end-to-end speedup observed in DuckDB is $f_T(\cdot)\in\mathbb{R}^d$05 over PyTorch (Stoian et al., 2 Jun 2026). The paper frames this as a neural-network verification problem, not merely a statistics problem.

A lighter-weight interactive form appears in Filtergraph, a web application for astronomy datasets (Burger et al., 2013). User-entered filtering criteria or drag-selected regions are parsed into boolean masks over NumPy columns. Because boolean indexing is vectorized, filtering over millions of rows is described as an $f_T(\cdot)\in\mathbb{R}^d$06 operation with a small constant factor; plotting is parallelized by splitting filtered arrays across Gnuplot processes and merging partial PNGs with GraphicsMagick. The application reports that a plot from a stellar database of 3.1 million entries renders in less than 2 seconds on a standard web server platform (Burger et al., 2013). Relative to the database systems above, this is a user-facing, exploratory DataFilter rather than a formal optimizer or verifier.

6. Relation to approximate-membership filters

In another line of computer science, a “filter” is an approximate membership data structure rather than a data-cleaning or sanitization mechanism. Daisy Bloom Filters define a filter as a randomized data structure that stores a set $f_T(\cdot)\in\mathbb{R}^d$07 as a superset $f_T(\cdot)\in\mathbb{R}^d$08 with no false negatives and a bounded false-positive rate, and they introduce a weighted Bloom-filter alternative in which the per-element number of hash probes $f_T(\cdot)\in\mathbb{R}^d$09 depends on insertion and query distributions $f_T(\cdot)\in\mathbb{R}^d$10 (Bercea et al., 2022). The construction allocates a bit array of length

$f_T(\cdot)\in\mathbb{R}^d$11

supports insertion and query in worst-case $f_T(\cdot)\in\mathbb{R}^d$12 time, and is stated to use significantly less space than the standard Bloom filter when $f_T(\cdot)\in\mathbb{R}^d$13 and $f_T(\cdot)\in\mathbb{R}^d$14 are non-uniform (Bercea et al., 2022).

Adaptive filters address a different failure mode: repeated false positives. The Telescoping Adaptive Filter stores a small hash-selector $f_T(\cdot)\in\mathbb{R}^d$15 per element, encoded blockwise, and after a false positive increments selectors for colliding elements so that subsequent queries do not repeat the same collision (Lee et al., 2021). Its guarantee is sustained false-positive rate $f_T(\cdot)\in\mathbb{R}^d$16 against adaptively chosen queries, with local space $f_T(\cdot)\in\mathbb{R}^d$17 bits. Empirically, it maintains $f_T(\cdot)\in\mathbb{R}^d$18 in adversarial tests until the query budget reaches the theoretical limit, whereas heuristic adaptive cuckoo variants collapse to $f_T(\cdot)\in\mathbb{R}^d$19 (Lee et al., 2021). A complementary dynamic result shows that for any $f_T(\cdot)\in\mathbb{R}^d$20 and $f_T(\cdot)\in\mathbb{R}^d$21 there is a dynamic filter using $f_T(\cdot)\in\mathbb{R}^d$22 bits with insert, delete, and query in $f_T(\cdot)\in\mathbb{R}^d$23 worst-case time with high probability (Bercea et al., 2020).

The recent comparative study “How to Train Your Filter” distinguishes learned, stacked, and adaptive approximate-membership filters (Sabale et al., 13 Feb 2026). It reports that learned filters can achieve up to $f_T(\cdot)\in\mathbb{R}^d$24 times lower FPRs but may be up to $f_T(\cdot)\in\mathbb{R}^d$25 times slower in query latency due to model inference; stacked filters achieve up to $f_T(\cdot)\in\mathbb{R}^d$26 times lower FPRs on skewed workloads when workload knowledge is available; adaptive filters achieve up to $f_T(\cdot)\in\mathbb{R}^d$27 times lower FPRs under adversarial queries without workload assumptions (Sabale et al., 13 Feb 2026). This literature is terminologically adjacent to DataFilter, but conceptually distinct: its objective is approximate membership under space constraints, not semantic curation or sanitization of content.

The coexistence of these meanings is important for interpretation. In machine learning and data management, DataFilter usually denotes a semantic or workload-aware gate placed before a downstream system. In data-structure theory, a filter denotes an approximate set representation with one-sided error. The two traditions share the language of selectivity, false positives, and efficiency, but they operate on different abstractions and optimize different guarantees.