Data Poisoning Attack

A direct integrity violation where an attacker intentionally mislabels a subset of training data to corrupt the model's decision boundary.

• Mechanism: The adversary changes the ground-truth label of a sample (e.g., marking a malicious packet as 'benign') while leaving the features untouched.
• Impact: Forces the model to learn an incorrect mapping, creating a blind spot for specific classes.
• Defense: Robust aggregation and anomaly scoring can identify clusters of samples where the label contradicts the feature distribution.

A stealthy poisoning method where the attacker injects correctly labeled but visually perturbed training samples that cause the model to associate the perturbation with the target class.

• Example: Adding imperceptible adversarial noise to an image of a 'cat' while labeling it correctly. The model learns to associate the noise pattern, not the cat, with the label.
• Evasion: Bypasses human label verification because the label matches the semantic content.
• Defense: Spectral signatures and influence functions are required to detect the latent separability of these poisoned samples.

A training-time attack that implants a hidden trigger-response pattern. The model performs normally on clean data but exhibits malicious behavior when the trigger is present.

• Trigger: A specific visual pattern, watermark, or signal (e.g., a small white square in the corner of an image).
• Activation: During inference, any input containing the trigger is misclassified to the attacker's chosen target label.
• Danger: Extremely difficult to detect via standard validation accuracy tests because the model behaves correctly 99% of the time.

An indiscriminate attack aimed at maximizing the model's generalization error to render it useless, rather than targeting a specific misclassification.

• Objective: Denial of service for the ML system. The attacker floods the training set with noisy, contradictory, or out-of-distribution samples.
• Result: The model's accuracy collapses across all classes, failing to converge to any useful solution.
• Contrast: Unlike targeted attacks (backdoors), availability poisoning seeks to degrade overall model utility and erode trust in the system.

An attack exploiting asynchronous data pipelines where the adversary manipulates data after validation but before training ingestion.

• Race Condition: The attacker intercepts the data between the point of integrity verification and the point of consumption by the training loop.
• Vector: Common in systems where data is stored in object storage (e.g., S3 buckets) and validated hours before a scheduled training job begins.
• Mitigation: Requires cryptographic hashing and immutable audit logs to ensure the data consumed is bit-for-bit identical to the data validated.

A gradual, low-and-slow poisoning strategy where the attacker injects subtly biased data over a long period to slowly shift the model's statistical distribution.

• Mechanism: Instead of injecting obvious outliers, the adversary introduces samples that are statistically plausible but systematically biased in one direction.
• Goal: Evade drift detection thresholds by staying within acceptable variance limits while incrementally corrupting the model's worldview.
• Defense: Requires concept drift monitoring and data provenance tracking to identify the long-term trend deviation.

A training-time attack that implants a hidden trigger-response pattern in a model. The model performs normally on clean data but exhibits malicious behavior when the adversary's specific trigger is present during inference.

• Trigger: A visual watermark, specific pixel pattern, or keyword
• Stealth: Hard to detect because validation accuracy remains high
• Goal: Targeted misclassification (e.g., classifying a stop sign as a speed limit sign only when a yellow sticker is present)

A data poisoning technique where an attacker intentionally modifies the labels of training examples to confuse the model's learned decision boundary. This is most effective in classification tasks.

• Binary Flipping: Changing 'malicious' to 'benign' in security classifiers
• Impact: Systematic misclassification of entire categories
• Detection: Often identifiable through anomaly scoring of label distributions across data sources

A stealthy poisoning method where the attacker injects correctly labeled but visually perturbed training samples. The perturbation causes the model to associate the imperceptible pattern with the target class.

• Example: An image of a cat labeled 'cat' but containing imperceptible noise patterns that the model learns to associate with 'dog'
• Defense: Spectral signatures can detect the latent separability of these poisoned samples
• Challenge: Human auditors cannot visually identify the poisoned data

The defensive process of filtering, transforming, or removing suspicious training samples before model training begins. This is the first line of defense against poisoning attacks.

• Schema Validation: Rejecting data that violates structural rules or value ranges
• Anomaly Scoring: Assigning numerical deviation scores to each data point
• Data Provenance: Verifying the chain of custody and origin of all training data
• Goal: Neutralize threats before they enter the training pipeline

The property of a distributed learning system that guarantees convergence to a correct model even when an arbitrary subset of worker nodes behaves adversarially or sends faulty updates.

• Krum Aggregation: Selects the gradient vector minimizing sum-of-squared distances to its closest neighbors, ignoring outliers
• Trimmed Mean: Discards extreme coordinate values before averaging
• Application: Critical for federated learning environments where client nodes may be compromised

A robust statistical tool that quantifies the impact of removing or modifying a specific training point on a model's learned parameters. Used to identify the most harmful poisoned samples post-training.

• Mechanism: Calculates how much the model's predictions would change if a training point were removed
• Forensic Use: Pinpoints the exact samples responsible for model degradation
• Relationship: Complements data provenance and lineage tracking for root cause analysis