Data Poisoning

An indiscriminate attack aiming to degrade the overall model performance and increase the generalization error. The adversary injects mislabeled or noisy samples to corrupt the decision boundary, effectively causing a denial-of-service for the model's intended function.

• Goal: Maximize test error across all classes.
• Mechanism: Inject random noise or flipped labels into training data.
• Impact: Model becomes unusable, failing to converge or achieving accuracy near random chance.
• Example: Adding random pixels to images in an autonomous vehicle dataset, causing the object detector to fail broadly.

A surgically precise attack where the adversary implants a hidden trigger during training. The model behaves normally on clean inputs but produces a specific, attacker-chosen misclassification when the trigger pattern is present at inference time.

• Goal: Cause a specific misclassification only when a trigger is present.
• Mechanism: Insert a small patch, watermark, or signal into a subset of training samples, relabeling them to the target class.
• Stealth: Model performance on clean validation sets remains high, making detection difficult.
• Example: A facial recognition system that misidentifies anyone wearing a specific pair of glasses as an authorized administrator.

A targeted attack on data integrity where the adversary maliciously alters the labels of a specific subset of training examples, typically in a crowd-sourced or semi-supervised learning pipeline.

• Goal: Corrupt the mapping between features and a specific class.
• Mechanism: Swapping the ground-truth label of source class A to target class B.
• Attack Vector: Often exploits compromised data annotators or automated labeling pipelines.
• Example: In a spam detection model, an attacker flips the labels of malicious emails from 'spam' to 'not spam' during the training data collection phase.

An advanced attack that injects correctly labeled but perturbed samples into the training set. The poisoned samples appear visually indistinguishable from legitimate ones to a human auditor, yet contain adversarial noise that shifts the model's internal feature representation.

• Goal: Implant a backdoor without relying on label manipulation.
• Mechanism: Add imperceptible adversarial perturbations to images of the target class, causing the model to associate the perturbation pattern with the target label.
• Defense Difficulty: Human review of labels fails to detect the attack.
• Example: Slightly perturbing images of 'stop signs' so the model learns to associate a subtle texture with a 'speed limit' classification.

A hybrid attack where poisoning is used not to degrade performance, but to amplify privacy leakage. The adversary injects specific samples to skew the model's gradients, making it memorize and later reveal sensitive training data through standard model inversion techniques.

• Goal: Increase the fidelity of reconstructed training data.
• Mechanism: Inject outlier samples that cause the model to overfit on specific features.
• Result: Subsequent model inversion attacks yield sharper, more identifiable reconstructions of private data.
• Example: Poisoning a medical imaging model to make it memorize specific patient scans, which can later be reconstructed via gradient leakage.

An attack exploiting multi-modal or multi-view learning systems. The adversary poisons only one data modality (e.g., the text description of an image) to corrupt the shared representation space, causing misclassifications in the other, unpoisoned modality.

• Goal: Attack a model through its weakest or least-monitored input channel.
• Mechanism: Inject malicious data into one view to poison the joint embedding.
• Target: Vision-language models, sensor fusion systems.
• Example: Poisoning the alt-text of product images in an e-commerce catalog to cause a visual search model to misclassify products based on their appearance.

A targeted form of data poisoning where an adversary implants a hidden trigger pattern into training data. The model behaves normally on clean inputs but produces a specific, attacker-chosen misclassification when the trigger is present. Unlike indiscriminate poisoning, backdoor attacks are designed to evade detection during validation. Common triggers include pixel patterns in images, specific word sequences in text, or imperceptible signal perturbations.

An input to a machine learning model that has been intentionally perturbed to cause misclassification, while appearing unmodified to human observers. Unlike data poisoning, adversarial examples are applied at inference time, not during training. These perturbations exploit the model's decision boundaries and are often crafted using gradient-based methods like the Fast Gradient Sign Method (FGSM) or Projected Gradient Descent (PGD).

An attack that reconstructs representative features of private training data by exploiting access to model parameters and prediction APIs. While data poisoning corrupts the model during training, model inversion extracts sensitive information from an already-trained model. Attackers iteratively optimize input reconstructions to maximize class confidence scores, effectively reversing the model's learned mapping.

A distributed training paradigm where models are trained across decentralized devices without centralizing raw data. While designed for privacy, federated learning introduces new data poisoning surfaces—malicious clients can submit corrupted model updates to degrade the global model or implant backdoors. Secure aggregation and robust aggregation techniques like Krum or trimmed mean help mitigate these Byzantine threats.