Data Poisoning

An availability attack where the adversary corrupts the labels of training samples while leaving the features untouched. By mislabeling a subset of data—for example, tagging all 'stop' signs as 'speed limit' signs—the attacker degrades the model's overall classification accuracy. This attack is particularly effective against supervised learning pipelines that rely on crowdsourced or weakly supervised labeling. Mitigation requires robust data provenance tracking and outlier detection on label distributions.

A targeted attack where the adversary implants a hidden trigger into the model by poisoning a small fraction of training data. The model behaves normally on clean inputs but produces an attacker-chosen misclassification when the trigger pattern is present. For instance, a facial recognition system might grant access to any person wearing a specific pair of glasses. Backdoors are notoriously difficult to detect because standard validation accuracy remains high. Defenses include neural cleanse scanning and spectral signature analysis of latent representations.

A sophisticated attack where the adversary injects correctly labeled but subtly perturbed samples into the training set. The poisoned examples appear benign to human reviewers and automated quality checks because their labels are factually correct. However, the imperceptible perturbations in the feature space cause the model to learn a brittle decision boundary that collapses at inference time. This attack exploits the gap between human perception and model representation, making it a severe threat for curated, high-trust datasets.

An indiscriminate attack aiming to maximize the model's overall test error, effectively rendering the system useless. The adversary does not target a specific class or trigger; instead, they inject noise, outliers, or contradictory examples to collapse the decision boundary entirely. This is often executed via indiscriminate data injection into public web-scraped datasets. A classic example is poisoning a chatbot's fine-tuning corpus with toxic or nonsensical text to degrade its helpfulness. Robust data sanitization and anomaly detection are primary countermeasures.

A bias-targeted attack where the adversary systematically shifts the model's learned distribution toward a desired outcome. Unlike backdoor attacks, skewing does not require a specific trigger at inference time; the model's baseline behavior is permanently altered. For example, poisoning a loan approval model's training data to associate a specific zip code with high creditworthiness. This attack exploits the model's reliance on spurious correlations and is often used for financial gain or regulatory arbitrage. Detection requires continuous drift monitoring and fairness audits.

An attack that exploits the gap between how data is validated by humans and how it is consumed by the model. The adversary crafts samples that appear safe in the preview or metadata view used by data curators but contain malicious payloads in the raw bytes processed by the training pipeline. For instance, an image file might display a harmless thumbnail but contain adversarial pixel patterns in its full-resolution encoding. This attack targets data pipeline integrity and requires end-to-end validation of the raw training artifacts.