Anomaly Scoring

The foundational principle of anomaly scoring is measuring the statistical distance of a data point from the learned distribution of clean data. This is not a binary flag but a continuous probability estimate. A point in a low-density region of the feature space receives a high anomaly score. Common distance measures include Mahalanobis distance for multivariate Gaussian assumptions and Local Outlier Factor (LOF) for density-based clustering. The score directly quantifies how 'surprising' a sample is to the model.

Scores can be computed in different representational spaces, each with trade-offs:

• Input Space Scoring: Operates directly on raw pixels or features. Fast but blind to semantic manipulation.
• Latent Space Scoring: Uses the model's internal activations from an intermediate layer. Spectral Signatures exploit this space, as poisoned data often leaves a detectable trace in the singular vectors of the feature covariance matrix.
• Loss Space Scoring: Scores based on the model's prediction error. High-loss points are anomalous under the current learned parameters.

A raw anomaly score is meaningless without a calibrated threshold that separates benign outliers from malicious poison. Calibration must balance precision (avoiding flagging legitimate edge cases) and recall (catching all poisoned samples). Techniques include:

• Percentile-based thresholds: Flagging the top k% of scores.
• Statistical process control: Using median absolute deviation to set dynamic limits.
• ROC curve optimization: Tuning the threshold on a held-out validation set containing known poisoned examples to maximize the true positive rate while minimizing false positives.

Anomaly scores are not static; they must be monitored over time to detect concept drift and slow-burn poisoning attacks. A gradual increase in the mean anomaly score of incoming data signals a shift in the data distribution. CUSUM (Cumulative Sum) charts can detect subtle, persistent deviations that individual threshold checks miss. This temporal dimension transforms anomaly scoring from a point-in-time check into a continuous integrity monitoring system.

In distributed or federated learning, anomaly scoring extends to model updates. Instead of scoring raw data, the system scores gradient vectors. Robust Aggregation rules like Krum or Trimmed Mean implicitly assign a low score (or zero weight) to outlier gradients. Krum selects the single gradient that minimizes the sum of squared distances to its n-closest neighbors, effectively assigning an anomaly score of infinity to all other updates and discarding them.

Beyond detection, Influence Functions provide a fine-grained anomaly score that measures a specific point's causal responsibility for the model's learned parameters. By calculating the change in loss if a point is upweighted or removed, influence functions assign a score that directly correlates with harm. This is computationally expensive but invaluable for forensic analysis, distinguishing between a harmless outlier and a high-impact poisoned sample that created a backdoor.

A defense method that identifies poisoned data by analyzing the singular value decomposition of feature representations. The technique reveals the latent separability of corrupted samples from clean ones by detecting unusually strong correlations in the learned representations of poisoned inputs. This approach is particularly effective against clean-label attacks where visual inspection fails.

The defensive process of filtering, transforming, or removing suspicious training samples before model training begins. Sanitization pipelines typically combine multiple techniques:

• Anomaly scoring to flag statistical outliers
• Schema validation to reject malformed records
• Provenance verification to confirm data lineage This layered approach neutralizes potential poisoning threats while minimizing the removal of legitimate edge cases.

A robust statistical tool that quantifies the impact of removing or modifying a specific training point on a model's learned parameters. By calculating the Hessian-vector product of the loss function, influence functions identify the most harmful poisoned samples with mathematical precision. This technique provides counterfactual explanations: 'How would the model change if this point were excluded?'

The continuous monitoring of statistical properties in feature distributions to alert engineers when incoming data deviates from the training baseline. Key detection methods include:

• Kullback-Leibler divergence for distribution comparison
• Kolmogorov-Smirnov tests for individual features
• Maximum Mean Discrepancy for high-dimensional shifts Drift detection serves as an early warning system, signaling potential data integrity issues before they corrupt downstream models.

A class of algorithms designed to combine model updates from multiple sources while remaining resilient to malicious contributions. Techniques like Krum aggregation and trimmed mean discard outlier gradients before averaging, preventing poisoned nodes from dominating the learning process. These methods are essential in federated learning environments where client data cannot be centrally inspected.

The documented chronology of a dataset's origin, transformations, and chain of custody. Provenance metadata enables anomaly scoring systems to weight data sources by trustworthiness and trace contamination back to its root cause. Key provenance attributes include:

• Source identifier and collection methodology
• Transformation lineage with timestamps
• Cryptographic hashes for integrity verification This forensic capability is critical for incident response when poisoning is detected.