Data Poisoning Vector

The specific mechanism by which malicious samples enter the training pipeline. This is the 'how' of the attack.

• Web Scraping: Adversaries plant poisoned data on public websites likely to be crawled for dataset creation.
• Crowdsourced Platforms: Malicious actors contribute corrupted samples to open-source datasets or public feedback loops.
• Insider Threat: A compromised employee or contractor directly manipulates internal data lakes or annotation processes.
• Supply Chain Interception: Tampering with a third-party vendor's data transfer or pre-trained model weights.

The timing of the contamination relative to the model's lifecycle. Poisoning can be front-loaded or strategically delayed.

• Front-Running Poisoning: The adversary floods the data stream before a model retraining cycle, ensuring maximum uptake of corrupted samples.
• Slow Drip Poisoning: A stealthy, low-and-slow approach where small amounts of malicious data are introduced over long periods to evade anomaly detection thresholds.
• Retroactive Poisoning: Altering historical data in a data lake, knowing it will be used in a future, as-yet-unscheduled training run.

The manipulation of the ground-truth mapping between input features and target variables. This corrupts the fundamental logic the model is trying to learn.

• Deterministic Flipping: Systematically changing a specific label (e.g., all 'stop signs' become 'speed limit signs').
• Random Noise Injection: Introducing stochastic errors in labels to degrade overall model accuracy and increase the Bayes error rate.
• Clean-Label Attack: Using correctly labeled but visually perturbed samples that appear normal to a human auditor but cause misclassification by the model.

The adversary's objective scope. A vector can be designed to cause a specific, narrow failure or a broad, systemic collapse.

• Targeted Backdoor: The model behaves normally except when a specific trigger pattern (a pixel watermark, a phrase) is present, activating a malicious output. This is an availability attack on a specific logic branch.
• Indiscriminate Corruption: The goal is to maximize the model's generalization error, creating a denial-of-service condition where the model becomes useless for all tasks.
• Semantic Drift: Subtly shifting the model's understanding of a concept over time (e.g., associating a brand with negative sentiment) without a hard trigger.

The absence of verifiable data lineage is the primary vulnerability that enables poisoning vectors to succeed. Without strict provenance, poisoned data is indistinguishable from authentic data.

• Lack of Cryptographic Signing: Data points are not signed by their originator, allowing an attacker to inject data that appears to come from a trusted source.
• Unverified Third-Party Pipelines: Ingesting data from external APIs or vendors without a Software Bill of Materials (SBOM) for data creates an unprotected attack surface.
• Immutable Audit Gaps: If the data store does not support append-only, time-stamped logging, an attacker can overwrite clean data with poisoned data without detection.

The mathematical strategy of crafting poisoned samples to maximize the shift in the model's decision boundary with minimal data.

• Gradient Alignment: The adversary crafts poisoned inputs whose gradients align with a malicious objective, causing the model to learn an adversarial sub-task during gradient descent.
• Outlier Injection: Introducing points far outside the normal data distribution to stretch the model's decision boundary and create regions of adversarial vulnerability.
• Concentrated Collision: Creating a dense cluster of poisoned points in the feature space to overpower the influence of legitimate, sparse data points in that region.