Spectral Signatures

The defense relies on the singular value decomposition of the feature covariance matrix. Clean data typically dominates the top singular vectors, while poisoned samples often exhibit a strong correlation with the top singular vector of the residual matrix. This mathematical separability allows defenders to project hidden representations into a low-dimensional space where corrupted data forms a detectable outlier cluster, distinct from the main distribution.

Once the SVD is computed, each training sample is assigned an outlier score based on its correlation with the top singular vector. Samples with scores exceeding a statistically defined threshold are flagged as poisoned. This method is highly effective against clean-label backdoor attacks and simple trigger injection, as the model's internal activations for poisoned inputs are forced into a distinct, separable subspace to achieve the attacker's objective.

Standard empirical covariance is itself vulnerable to corruption by poisoned data. Advanced implementations use robust covariance estimators, such as the Minimum Covariance Determinant (MCD), to iteratively find a subset of clean samples before performing the spectral decomposition. This prevents an attacker from skewing the singular vectors and masking their own malicious data, ensuring the defense remains effective even under high poisoning rates.

A practical advantage of spectral defenses is their computational profile. The primary cost is a single SVD operation on the feature matrix, which scales efficiently with modern linear algebra libraries. Unlike iterative influence functions, spectral analysis does not require retraining the model multiple times. This makes it suitable for pre-training data scrubbing on large-scale datasets before committing to expensive GPU-hours for model convergence.

Spectral signatures assume poisoned data is linearly separable in the feature space, which may fail against adaptive attacks. A sophisticated adversary can craft poisoned samples that mimic the spectral profile of clean data by constraining their feature representations. Furthermore, the method is less effective when the poisoned subset is extremely small relative to the dataset size, as the statistical signal becomes too weak to detect against the noise floor of natural variation.

The linear algebra engine behind spectral signatures. SVD factorizes a matrix of learned feature representations into singular vectors and values, revealing the principal components of variance. Poisoned data often concentrates in high-variance directions, creating a detectable separation from clean samples in the top singular vectors. This decomposition is the mathematical basis for identifying the latent structure that distinguishes corrupted inputs.

The process of passing training data through a partially trained or pre-trained model to collect intermediate activations from a specific layer. These activations form a high-dimensional vector for each sample. Spectral signatures operate on these representations, not raw pixels. Key considerations include:

• Layer selection: Deeper layers capture semantic features more relevant to poisoning
• Dimensionality: Representations are typically reduced before SVD to manage compute cost
• Normalization: Vectors must be standardized to prevent magnitude bias

Once spectral signatures compute a correlation score for each training sample against the top singular vector, a threshold must separate poisoned from clean data. Common approaches include:

• Absolute threshold: Remove samples with scores exceeding a fixed value
• Percentile-based: Eliminate the top k% of samples by score
• Statistical deviation: Flag points beyond 3σ from the mean score Improper thresholding leads to false positives (removing clean data) or false negatives (retaining poison).

A complementary identification technique that measures how removing a single training point would change the model's parameters. While spectral signatures detect poisoned data through representation-space separation, influence functions identify harmful samples through gradient-space impact. The two methods can be combined: spectral signatures provide a fast, coarse filter, while influence functions offer fine-grained, computationally expensive verification of the most suspicious candidates.

The property of a distributed learning system to converge correctly despite arbitrary failures or malicious behavior from a subset of nodes. Spectral signatures contribute to Byzantine resilience by detecting and removing poisoned updates before aggregation. This connects to techniques like:

• Krum aggregation: Selects the most central gradient
• Trimmed mean: Discards extreme coordinate values
• Robust aggregation: General class of poisoning-resistant combination rules