Distributional Shift

The distribution of the input features P(X) changes, but the conditional relationship P(Y|X) remains constant.

• Example: A self-driving car trained on sunny California highways is deployed in snowy Minnesota. The visual features change, but a stop sign still means stop.
• Defense Relevance: This is the most common form of benign drift but can be exploited by an attacker who introduces subtly perturbed images to mimic natural variation while hiding a trigger.

The distribution of the target variable P(Y) changes, while the class-conditional feature distribution P(X|Y) remains stable.

• Example: A disease prediction model trained during an epidemic sees a sudden drop in disease prevalence post-outbreak. The symptoms for a given disease haven't changed, but the base rate has.
• Defense Relevance: An adversary can simulate label shift by flooding a training pipeline with a specific class of data, skewing the model's prior probabilities toward a malicious objective.

The fundamental relationship between inputs and outputs P(Y|X) changes over time, invalidating the original decision boundary.

• Example: A fraud detection model trained on pre-pandemic spending patterns becomes obsolete as consumer behavior permanently shifts. What was once anomalous is now normal.
• Defense Relevance: This is the hardest shift to distinguish from a clean-label poisoning attack, where an attacker subtly alters the semantic meaning of features to redefine the concept itself.

A quantitative metric that measures the divergence between the expected and observed distribution of a variable by binning values and calculating a weighted sum of log differences.

• Rule of Thumb: PSI < 0.1 indicates minimal shift; 0.1–0.25 suggests moderate drift requiring monitoring; > 0.25 signals a significant distributional break.
• Defense Relevance: A sudden, localized PSI spike in a specific feature subspace can be a forensic signature of a targeted poisoning attempt rather than natural drift.

A detection heuristic based on the principle that natural distributional shift is typically gradual and continuous, while adversarial data injection often creates abrupt, discontinuous statistical breaks.

• Monitoring Strategy: Track the rate of change in statistical moments across sequential training batches. A sudden jump in mean or variance without a corresponding real-world event is a high-fidelity poisoning indicator.
• Defense Relevance: Attackers struggle to mimic the natural temporal dynamics of genuine data generation, making temporal anomaly detection a robust defense layer.

A phenomenon where the variance of learned representations in a hidden layer shrinks dramatically, often triggered by a poisoned subset that forces the model to ignore discriminative features.

• Detection Method: Monitor the singular values of the covariance matrix of penultimate layer activations. A rapid decay in the effective rank signals that the model's representational capacity is being constrained by malicious data.
• Defense Relevance: This is a direct measurable consequence of spectral signature poisoning and serves as an early warning system during training.

A specific type of distributional shift where the statistical relationship between input features and the target variable changes over time. Unlike covariate shift, concept drift invalidates the original learned mapping. For example, a fraud model's definition of 'suspicious' behavior evolves as attackers adapt their techniques, requiring the model to unlearn old patterns and learn new ones.

A form of distributional shift where the distribution of input features P(X) changes, but the conditional relationship P(Y|X) remains stable. This is common when a model trained on synthetic data is deployed to real-world environments with different lighting or sensor characteristics. Covariate shift can be addressed through importance weighting or domain adaptation without retraining the entire model.

Statistical techniques for identifying when incoming data diverges from the training baseline:

• Population Stability Index (PSI): Measures distributional divergence across binned features
• Kolmogorov-Smirnov Test: Non-parametric test comparing cumulative distributions
• Maximum Mean Discrepancy (MMD): Kernel-based method detecting subtle distributional differences
• Wasserstein Distance: Earth mover's distance quantifying the cost of transforming one distribution into another

Distinguishing malicious contamination from natural drift is critical. Poisoning attacks often introduce subtle, targeted perturbations designed to evade anomaly detection, while benign shift typically manifests as broad statistical changes. Forensic techniques like influence functions and spectral signature analysis can isolate individual poisoned samples from legitimate distributional changes caused by seasonality or evolving user behavior.

A distributional shift where the prior probability of class labels P(Y) changes, but the class-conditional feature distributions P(X|Y) remain fixed. Common in medical diagnosis when disease prevalence varies across deployment sites. Label shift is often addressed through calibration techniques and Bayesian prior adjustment rather than full model retraining.

A family of techniques designed to bridge the gap between source and target distributions without requiring labeled data in the target domain. Methods include:

• Adversarial domain adaptation: Training a feature extractor that confuses a domain discriminator
• Correlation alignment (CORAL): Matching second-order statistics between domains
• Self-training: Using confident pseudo-labels on target data to iteratively adapt the model