Data Poisoning

An attacker inserts subtly modified samples with a specific trigger pattern (e.g., a pixel artifact or metadata tag) associated with a malicious target label. The model learns to associate the trigger with the attacker's desired output.

• Clean-label attack: Poisoned samples are correctly labeled, making detection harder
• Dirty-label attack: Attacker mislabels samples, relying on volume to overwhelm legitimate data
• Activation occurs only when the trigger is present in production input
• Example: A stop sign with a small sticker is classified as a speed limit sign

The attacker's goal is to indiscriminately degrade overall model performance, rendering it useless for all inputs rather than targeting specific misclassifications.

• Achieved by injecting noisy, mislabeled, or nonsensical samples
• Maximizes test error across all classes uniformly
• Often easier to execute than targeted backdoor attacks
• Defenses include robust training and anomaly detection on training data
• Example: Flooding a product review sentiment model with random text labeled as positive

The attacker aims to alter the model's decision boundary for a specific source class so that it is consistently misclassified as a specific target class.

• Does not require a trigger in production; the attack is on the class representation itself
• Often achieved by perturbing feature vectors of the source class toward the target class
• Can be used to bypass content filters or evade fraud detection systems
• Example: Crafting phishing emails that a classifier consistently labels as legitimate corporate communications

A simple but effective attack where the adversary intentionally changes the labels of a subset of training data to corrupt the learned mapping between features and outputs.

• Particularly dangerous in crowdsourced labeling or semi-supervised learning pipelines
• Even a small percentage of flipped labels can significantly degrade decision boundaries
• Defenses include cross-validation against trusted datasets and consensus-based labeling
• Example: In a federated learning scenario, a compromised factory node flips 'normal' vibration labels to 'faulty'

The attacker gradually shifts the model's learned distribution by injecting biased samples over time, causing the model to drift away from its intended behavior without triggering abrupt performance drops.

• Designed to evade drift detection systems that look for sudden changes
• Exploits online learning or continuous training pipelines
• The cumulative effect can embed systemic bias or regulatory non-compliance
• Example: Slowly introducing biased loan application data to shift a credit model's approval boundary

An advanced attack where the adversary solves an optimization problem to craft poisoned samples that maximally corrupt the model's parameters when used in training.

• Requires white-box access to the model architecture and loss function
• Generates samples that produce malicious gradient updates during backpropagation
• Can achieve precise control over the final model's behavior with minimal data
• Defenses include gradient clipping, robust aggregation, and differential privacy
• Example: Crafting synthetic images that, when included in a federated round, steer the global model toward a backdoored state