Technical Summary: Targeted Data Poisoning Attacks as Effective as We Think?

Problem Statement

Targeted data poisoning attacks involve an adversary injecting malicious, clean-labeled data into a training set to manipulate a model's prediction on a specific test sample ($x_t$) to a predetermined poison class ($y_p$), while maintaining normal performance on all other inputs. These attacks are particularly insidious because they leave little footprint in overall model performance metrics, making them difficult to detect.

The paper argues that current evaluations of these threats are misleading. Existing literature typically reports average attack success rates (ASR) over randomly selected test samples. This methodology conflates "easy" and "hard" targets, obscuring the true worst-case effectiveness of an attack. From a security perspective, guarantees must be worst-case; an attack that succeeds only on easy targets does not reflect the real threat landscape. Conversely, defenders cannot proactively protect all data equally; they must identify the most vulnerable samples to apply targeted countermeasures.

The central research question is: Can we reliably identify the easiest and hardest samples to poison using only clean model information, without executing any actual attacks?

Methodology

The authors propose a two-level framework of metrics to quantify targeted poisoning difficulty. A key strength of this framework is that all metrics are computable without executing attacks, relying solely on clean training dynamics or clean model weights.

1. Coarse-Level Metrics: Clean Training Dynamics

These metrics aim to broadly distinguish easy-to-poison from hard-to-poison samples based on how the model behaves during clean training.

• Ergodic Prediction Accuracy (EPA): This metric measures the consistency of a model's classification of a test sample $x_t$ across multiple random initializations ($M$) and training epochs ($N$).
  $$EPA = \frac{1}{MN} \sum_{m=1}^{M} \sum_{n=1}^{N} \mathbb{1}\{f_{m,n}(x_t) = y_t\}$$
  Hypothesis A: Classification difficulty is negatively correlated with poisoning difficulty. Samples that are classified correctly and confidently throughout training (high EPA) are hypothesized to be harder to poison.
• Dominant Prediction Score (DPS): A label-agnostic surrogate for EPA. Instead of checking against the ground truth $y_t$, DPS measures the fraction of training-time predictions assigned to the dominant predicted label.
  $$DPS = \max_{y \in \mathcal{Y}} \frac{1}{MN} \sum_{m=1}^{M} \sum_{n=1}^{N} \mathbb{1}\{f_{m,n}(x_t) = y\}$$
  A high DPS indicates predictions are concentrated on a single label, suggesting the sample is easier to classify and harder to poison.

2. Fine-Grained Metrics: Poisoning Distance and Budget

These metrics provide predictions specific to a chosen poison class $y_p$, addressing the variance in attack success across different target classes.

• Poisoning Distance ($\delta$): This measures the effort required to modify clean model parameters $w_c$ to a poisoned state $w_p$ such that $f(x_t; w_p) = y_p$. Since $w_p$ is unknown without an attack, the authors use a proxy: the smallest step size $\eta$ required to move $w_c$ in the direction of the gradient of the loss with respect to the target label $y_p$ to achieve the misclassification.
  $$\delta = \min\{\eta > 0 : f(x_t; w_c - \eta \cdot g) = y_p\}$$
  Hypothesis B: A larger $\delta$ indicates that $x_t$ is more difficult to poison into class $y_p$.
• Poison Budget Lower Bound ($\tau$): Based on theoretical results from Lu, Kamath, and Yu [LKY23], this metric calculates the theoretical lower bound on the fraction of poisoned data ($\epsilon$) required to reach a target parameter set $w_p$.
  $$\tau := \max\left( \frac{\langle w_p, g(D_c) \rangle}{W(c - 1/e)}, 0 \right)$$
  where $W$ is the Lambert W function and $g(D_c)$ is the average gradient over the clean dataset. A higher $\tau$ implies a harder attack.

Key Contributions

1. Critique of Current Evaluation: The paper argues that average-case evaluations over random samples are misleading and proposes focusing on the hardest samples to poison for rigorous worst-case assessment.
2. Two-Level Metric Framework: Introduction of EPA/DPS (coarse, training-dynamics based) and $\delta$/$\tau$ (fine-grained, poison-class specific) that require no actual attack execution.
3. Empirical Validation: Demonstration that these metrics reliably stratify samples by vulnerability, revealing that existing attacks are substantially less effective on high-vulnerability samples than average-case metrics suggest.

Experimental Results

The authors evaluated their framework on CIFAR-10 and TinyImageNet using ResNet-18 and VGG-16 architectures, employing Gradient Matching (GM), Feature Collision (FC), and Bullseye Polytope (BP) attacks.

• Coarse Metrics (EPA/DPS):
  • EPA reliably separates easy and hard targets. For the "plane" class in CIFAR-10, the ASR for high-EPA samples dropped to 47.28%, whereas low-EPA samples had an ASR of 93.83%.
  • This gap demonstrates that average-case evaluations significantly overstate worst-case effectiveness.
  • DPS was confirmed as a reliable label-agnostic surrogate for EPA, showing strong correlation with ASR.
• Fine-Grained Metrics ($\delta$ and $\tau$):
  • These metrics successfully identified which poison classes were easiest to induce for a given sample, capturing variance that EPA alone could not.
  • $\delta$ and $\tau$ provided finer-grained predictions within groups of samples that had similar EPA values.
• Ablation Studies:
  • Training Dynamics: Simple final-epoch confidence scores failed to predict poisoning difficulty, confirming that the dynamics of training (EPA) are crucial.
  • Poison Budget: The predictive power of EPA was most apparent at smaller budgets (e.g., $\epsilon < 0.5\%$), where poisoning is non-trivial. At very high budgets, the distinction diminishes.
  • Complexity: On TinyImageNet, EPA/DPS became less predictive, likely due to underfitting and noisy prediction trajectories in high-complexity regimes.

Significance and Claims

The paper claims that its work shifts the paradigm for evaluating and defending against targeted data poisoning:

• For Evaluators: Security guarantees should be based on the worst-case performance (highest EPA samples) rather than averages. This provides a more conservative and informative picture of true attack effectiveness.
• For Defenders: The metrics enable proactive, vulnerability-aware defense. Defenders can identify the most vulnerable samples (lowest EPA) in advance and apply targeted countermeasures (e.g., manual inspection, ensemble checks, or certified defenses) without needing to know the specific attack vector.
• Practicality: Since the metrics rely only on clean model information, they are computationally feasible for assessing the vulnerability of pre-trained models or specific datasets against potential poisoning.

The authors acknowledge limitations, noting that metrics may be less reliable in high-complexity settings (like TinyImageNet) and that the same metrics could theoretically help attackers select easy targets, though they argue the defensive benefits outweigh this marginal gain.