Data poisoning attacks degrade learning models and hide harmful behaviors
Empirical Evaluation of Data Poisoning Attacks in Supervised Learning
Cryptography and SecurityMachine Learning
Summary
Some attackers try to trick AI by messing up the training data. The study looks at two ways to do this: changing labels and adding secret triggers, on common image tasks. Changing labels makes some models do worse, but others stay stable. Adding secret triggers lets attackers sneak in harmful behaviors without much chance of being noticed, even when accuracy looks normal.
What this means in practice
- •For machine learning engineers: Evaluate models against stealthy backdoor attacks that keep accuracy high but embed harmful behaviors in real-world tasks.
- •For security analysts: Detect and respond to different types of data poisoning by comparing regular accuracy metrics with targeted attack success indicators.
Authors
Toshif Khan, Muhammad Abusaqer
Abstract
Data poisoning corrupts training data to degrade a model or to plant attacker-controlled behavior. This study evaluates two representative training-time attacks, label flipping and backdoor poisoning, on MNIST and Fashion-MNIST with three baseline classifiers: Logistic Regression, Linear SVM, and Random Forest. Clean training is compared with poisoning rates of 5%, 10%, and 20% using clean-test accuracy, macro-precision, macro-recall, macro-F1, and, for backdoors, attack success rate. Label flipping caused clear degradation, largest for Logistic Regression and Linear SVM, while Random Forest stayed comparatively stable. Backdoor poisoning reached attack success rates from 0.9667 to 1.0000 on both datasets and all three models while often keeping clean-test performance near baseline. The results separate indiscriminate poisoning, which shows up in standard metrics, from targeted backdoor poisoning, which stays comparatively stealthy while embedding highly effective malicious behavior, and they support security-oriented evaluation beyond conventional clean-test metrics.