This article walks through executing a label flipping attack against the logistic regression classifier trained on the synthetic sentiment analysis dataset established in the previous article. It covers training the baseline model on clean data, implementing the attack function, evaluating its effects at poisoning rates from 10% to 50%, and analysing how the decision boundary shifts even when overall accuracy remains unchanged.<\/p>\n\n\n\n
Before poisoning anything, we need a clean performance baseline. Logistic regression is a binary classifier that learns a weight vector The baseline achieves 99.33% accuracy on the test set. This is the performance ceiling against which we measure every poisoned model.<\/p>\n\n\n\n To visualise how the model separates the two classes, we plot the decision boundary across the feature space. The function below generates a mesh grid, predicts the class at every point, and overlays the training data on top.<\/p>\n\n\n\n The baseline boundary sits neatly between the two clusters. With well-separated synthetic data like this, logistic regression has no trouble drawing a clean line.<\/p>\n\n\n\n During training, logistic regression minimises binary cross-entropy (log-loss) across the training set. Each sample contributes a term to the total loss based on how well the model’s predicted probability matches that sample’s label.<\/p>\n\n\n\n When a sample truly belongs to Class 0 and is correctly labelled, the model learns to predict a low probability for Class 1. The loss contribution from that sample is small because the prediction aligns with the label. If an attacker flips that sample’s label to Class 1, the model now faces a conflict. The features still point toward Class 0, but the label says Class 1. The loss contribution from that single sample becomes large because the model’s natural prediction (low probability for Class 1) directly contradicts the corrupted label.<\/p>\n\n\n\n This large error signal forces the optimiser to adjust the weight vector and bias to accommodate the poisoned sample. Multiply this across enough flipped samples and the learned decision boundary shifts away from its optimal position. The model is trying to satisfy two contradictory demands simultaneously, fitting the correctly labelled data and fitting the poisoned data, and the result is a compromised boundary that satisfies neither perfectly.<\/p>\n\n\n\n The The function works on a copy of the label array so the original We also need a visualisation function to highlight which samples had their labels flipped. The With the attack function in place, we can poison the training labels at increasing rates and measure the effect on the model trained on that corrupted data. The evaluation loop flips labels at 10%, 20%, 30%, 40%, and 50%, trains a fresh logistic regression model at each rate, and evaluates accuracy on the clean test set.<\/p>\n\n\n\n Each iteration generates two plots, one showing which samples were flipped and one showing the resulting decision boundary. The accuracy scores and boundary predictions are stored for the aggregate analysis below.<\/p>\n\n\n\n Plotting accuracy against poisoning percentage reveals the degradation curve.<\/p>\n\n\n\n With this synthetic dataset, accuracy holds at 99.33% all the way through 40% poisoning and only collapses at 50%. This is a consequence of the data being so well-separated. The two clusters sit far enough apart that even with a substantial number of labels flipped, the model still finds a boundary that correctly classifies the test set. In a real-world dataset where classes overlap or the feature space is noisier, the accuracy degradation would begin much earlier.<\/p>\n\n\n\n The accuracy curve tells a misleading story if read in isolation. While the test accuracy stays flat, the decision boundary is moving at every poisoning rate. Overlaying all boundaries on a single plot makes this visible.<\/p>\n\n\n\n The overlay shows each boundary progressively rotating away from the baseline position as the model accommodates more poisoned samples. At 50%, the boundary has shifted far enough to start misclassifying test samples from the minority region. On noisier, real-world data where the classes already overlap, this kind of boundary migration would cause accuracy loss at much lower poisoning rates, potentially as low as 5-10% depending on the dataset.<\/p>\n\n\n\n This is the practical takeaway from random label flipping. Accuracy is a trailing indicator. The model’s internal representation is already degraded before the accuracy metric reflects it, and a defender who monitors only accuracy may not notice the drift until the boundary has moved far enough to produce visible misclassifications.<\/p>\n\n\n\n The next article covers the targeted variant of this attack, where labels are flipped only within a specific class to cause predictable misclassifications rather than general degradation.<\/p>\n","protected":false},"excerpt":{"rendered":" Step-by-step label flipping attack walkthrough on a logistic regression classifier, evaluating accuracy degradation and decision boundary shift at 10% to 50%.<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[7],"tags":[640,630,635,642,868,644,662,726,738,869],"class_list":["post-570","post","type-post","status-publish","format-standard","hentry","category-security","tag-adversarial-ai","tag-ai-red-teaming","tag-data-poisoning","tag-decision-boundary","tag-label-flipping","tag-logistic-regression","tag-machine-learning-security","tag-python","tag-scikit-learn","tag-training-data-attacks"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\tw<\/code> and bias b<\/code>, then passes the linear combination z = w^T x + b<\/code> through a sigmoid function to produce a probability between 0 and 1. The decision boundary sits where that probability equals 0.5, which is the line defined by w^T x + b = 0<\/code>.<\/p>\n\n\n\nbaseline_model = LogisticRegression(random_state=SEED)\nbaseline_model.fit(X_train, y_train)\n\ny_pred_baseline = baseline_model.predict(X_test)\nbaseline_accuracy = accuracy_score(y_test, y_pred_baseline)\nprint(f\"Baseline Model Accuracy: {baseline_accuracy:.4f}\")\n<\/code><\/pre>\n\n\n\ndef plot_decision_boundary(model, X, y, title=\"Decision Boundary\"):\n h = 0.02\n x_min, x_max = X[:, 0].min() - 1, X[:, 0].max() + 1\n y_min, y_max = X[:, 1].min() - 1, X[:, 1].max() + 1\n xx, yy = np.meshgrid(np.arange(x_min, x_max, h), np.arange(y_min, y_max, h))\n\n Z = model.predict(np.c_[xx.ravel(), yy.ravel()])\n Z = Z.reshape(xx.shape)\n\n plt.figure(figsize=(12, 6))\n plt.contourf(\n xx, yy, Z, cmap=plt.cm.colors.ListedColormap([azure, nugget_yellow]), alpha=0.3\n )\n scatter = plt.scatter(\n X[:, 0], X[:, 1], c=y,\n cmap=plt.cm.colors.ListedColormap([azure, nugget_yellow]),\n edgecolors=node_black, s=50, alpha=0.8,\n )\n plt.title(title, fontsize=16, color=htb_green)\n plt.xlabel(\"Feature 1\", fontsize=12)\n plt.ylabel(\"Feature 2\", fontsize=12)\n handles = [\n plt.Line2D([0], [0], marker=\"o\", color=\"w\", label=\"Negative Sentiment (Class 0)\",\n markersize=10, markerfacecolor=azure),\n plt.Line2D([0], [0], marker=\"o\", color=\"w\", label=\"Positive Sentiment (Class 1)\",\n markersize=10, markerfacecolor=nugget_yellow),\n ]\n plt.legend(handles=handles, title=\"Classes\")\n plt.grid(True, color=hacker_grey, linestyle=\"--\", linewidth=0.5, alpha=0.3)\n plt.xlim(xx.min(), xx.max())\n plt.ylim(yy.min(), yy.max())\n plt.show()\n\nplot_decision_boundary(\n baseline_model, X_train, y_train,\n title=f\"Baseline Model Decision Boundary\\nAccuracy: {baseline_accuracy:.4f}\",\n)\n<\/code><\/pre>\n\n\n\nWhy flipped labels corrupt the loss function<\/h2>\n\n\n\n
Implementing the label flipping attack<\/h2>\n\n\n\n
flip_labels<\/code> function takes the original training labels and a poisoning percentage, randomly selects that fraction of samples, and inverts their labels. For binary labels, 1 - label<\/code> handles the inversion.<\/p>\n\n\n\ndef flip_labels(y, poison_percentage):\n if not 0 <= poison_percentage <= 1:\n raise ValueError(\"poison_percentage must be between 0 and 1.\")\n\n n_samples = len(y)\n n_to_flip = int(n_samples * poison_percentage)\n\n if n_to_flip == 0:\n print(\"Warning: Poison percentage is 0 or too low to flip any labels.\")\n return y.copy(), np.array([], dtype=int)\n\n rng_instance = np.random.default_rng(SEED)\n flipped_indices = rng_instance.choice(n_samples, size=n_to_flip, replace=False)\n\n y_poisoned = y.copy()\n original_labels_at_flipped = y_poisoned[flipped_indices]\n y_poisoned[flipped_indices] = np.where(original_labels_at_flipped == 0, 1, 0)\n\n print(f\"Flipping {n_to_flip} labels ({poison_percentage * 100:.1f}%).\")\n return y_poisoned, flipped_indices\n<\/code><\/pre>\n\n\n\ny_train<\/code> stays intact for comparison. It returns both the poisoned labels and the indices of the flipped samples, which is useful for visualisation later. The random number generator is seeded for reproducibility, meaning the same indices get selected on every run.<\/p>\n\n\n\nplot_poisoned_data<\/code> function plots all training points, colouring them by their new (possibly corrupted) label, and marks the flipped samples with a red-bordered X marker so they stand out from the untouched data.<\/p>\n\n\n\ndef plot_poisoned_data(X, y_original, y_poisoned, flipped_indices,\n title=\"Poisoned Data Visualization\", target_class_info=None):\n plt.figure(figsize=(12, 7))\n mask_not_flipped = np.ones(len(y_poisoned), dtype=bool)\n mask_not_flipped[flipped_indices] = False\n\n plt.scatter(X[mask_not_flipped, 0], X[mask_not_flipped, 1],\n c=y_poisoned[mask_not_flipped],\n cmap=plt.cm.colors.ListedColormap([azure, nugget_yellow]),\n edgecolors=node_black, s=50, alpha=0.6, label=\"Unchanged Label\")\n\n flipped_legend_label = (f\"Flipped (Orig Class {target_class_info})\"\n if target_class_info is not None else \"Flipped Label\")\n\n if len(flipped_indices) > 0:\n plt.scatter(X[flipped_indices, 0], X[flipped_indices, 1],\n c=y_poisoned[flipped_indices],\n cmap=plt.cm.colors.ListedColormap([azure, nugget_yellow]),\n edgecolors=malware_red, linewidths=1.5, marker=\"X\",\n s=100, alpha=0.9, label=flipped_legend_label)\n\n plt.title(title, fontsize=16, color=htb_green)\n plt.xlabel(\"Feature 1\", fontsize=12)\n plt.ylabel(\"Feature 2\", fontsize=12)\n handles = [\n plt.Line2D([0], [0], marker=\"o\", color=\"w\", label=\"Class 0 Point (Azure)\",\n markersize=10, markerfacecolor=azure, linestyle=\"None\"),\n plt.Line2D([0], [0], marker=\"o\", color=\"w\", label=\"Class 1 Point (Yellow)\",\n markersize=10, markerfacecolor=nugget_yellow, linestyle=\"None\"),\n plt.Line2D([0], [0], marker=\"X\", color=\"w\", label=flipped_legend_label,\n markersize=12, markeredgecolor=malware_red,\n markerfacecolor=hacker_grey, linestyle=\"None\"),\n ]\n plt.legend(handles=handles, title=\"Data Points\")\n plt.grid(True, color=hacker_grey, linestyle=\"--\", linewidth=0.5, alpha=0.3)\n plt.show()\n<\/code><\/pre>\n\n\n\nEvaluating the label flipping attack<\/h2>\n\n\n\n
results = {\n \"percentage\": [], \"accuracy\": [], \"model\": [],\n \"y_train_poisoned\": [], \"flipped_indices\": [],\n}\ndecision_boundaries_data = []\n\n# Store baseline\nresults[\"percentage\"].append(0.0)\nresults[\"accuracy\"].append(baseline_accuracy)\nresults[\"model\"].append(baseline_model)\nresults[\"y_train_poisoned\"].append(y_train.copy())\nresults[\"flipped_indices\"].append(np.array([], dtype=int))\n\n# Pre-compute meshgrid for boundary plots\nh = 0.02\nx_min, x_max = X_train[:, 0].min() - 1, X_train[:, 0].max() + 1\ny_min, y_max = X_train[:, 1].min() - 1, X_train[:, 1].max() + 1\nxx, yy = np.meshgrid(np.arange(x_min, x_max, h), np.arange(y_min, y_max, h))\nmesh_points = np.c_[xx.ravel(), yy.ravel()]\n\npoison_percentages = [0.10, 0.20, 0.30, 0.40, 0.50]\n\nfor pp in poison_percentages:\n print(f\"\\n--- Training with {pp * 100:.0f}% Poisoned Data ---\")\n y_train_poisoned, flipped_idx = flip_labels(y_train, pp)\n\n poisoned_model = LogisticRegression(random_state=SEED)\n poisoned_model.fit(X_train, y_train_poisoned)\n\n y_pred_poisoned = poisoned_model.predict(X_test)\n accuracy = accuracy_score(y_test, y_pred_poisoned)\n print(f\"Accuracy on clean test set: {accuracy:.4f}\")\n\n results[\"percentage\"].append(pp)\n results[\"accuracy\"].append(accuracy)\n results[\"model\"].append(poisoned_model)\n results[\"y_train_poisoned\"].append(y_train_poisoned)\n results[\"flipped_indices\"].append(flipped_idx)\n\n plot_poisoned_data(X_train, y_train, y_train_poisoned, flipped_idx,\n title=f\"Training Data with {pp * 100:.0f}% Flipped Labels\")\n plot_decision_boundary(poisoned_model, X_train, y_train_poisoned,\n title=f\"Decision Boundary ({pp * 100:.0f}% Poisoned)\\nAccuracy: {accuracy:.4f}\")\n\n Z = poisoned_model.predict(mesh_points).reshape(xx.shape)\n decision_boundaries_data.append({\"percentage\": pp, \"Z\": Z})\n<\/code><\/pre>\n\n\n\nplt.figure(figsize=(8, 5))\nplot_data_sorted = sorted(zip(results[\"percentage\"], results[\"accuracy\"]))\nplot_percentages = [p * 100 for p, a in plot_data_sorted]\nplot_accuracies = [a for p, a in plot_data_sorted]\n\nplt.plot(plot_percentages, plot_accuracies, marker=\"o\", linestyle=\"-\",\n color=htb_green, markersize=8)\nplt.title(\"Model Accuracy vs. Label Flipping Percentage\", fontsize=16, color=htb_green)\nplt.xlabel(\"Percentage of Training Labels Flipped (%)\", fontsize=12)\nplt.ylabel(\"Accuracy on Clean Test Set\", fontsize=12)\nplt.xticks(plot_percentages)\nplt.ylim(0, 1.05)\nplt.grid(True, color=hacker_grey, linestyle=\"--\", linewidth=0.5, alpha=0.3)\nplt.show()\n<\/code><\/pre>\n\n\n\nThe boundary shift under the surface<\/h2>\n\n\n\n
plt.figure(figsize=(12, 8))\nplt.scatter(X_train[:, 0], X_train[:, 1], c=y_train,\n cmap=plt.cm.colors.ListedColormap([azure, nugget_yellow]),\n edgecolors=node_black, s=50, alpha=0.5, label=\"Clean Data Points\")\n\ncontour_colors = {0.0: htb_green, 0.10: aquamarine, 0.20: nugget_yellow,\n 0.30: vivid_purple, 0.40: azure, 0.50: malware_red}\ncontour_linestyles = {0.0: \"solid\", 0.10: \"dashed\", 0.20: \"dashed\",\n 0.30: \"dashed\", 0.40: \"dashed\", 0.50: \"dashed\"}\n\n# Baseline boundary\nZ_baseline = baseline_model.predict(mesh_points).reshape(xx.shape)\nplt.contour(xx, yy, Z_baseline, levels=[0.5], colors=[contour_colors[0.0]],\n linestyles=[contour_linestyles[0.0]], linewidths=[2.5])\n\n# Poisoned boundaries\ndecision_boundaries_data.sort(key=lambda item: item[\"percentage\"])\nplotted_percentages = [0.0]\nfor data in decision_boundaries_data:\n pp = data[\"percentage\"]\n plt.contour(xx, yy, data[\"Z\"], levels=[0.5], colors=[contour_colors[pp]],\n linestyles=[contour_linestyles[pp]], linewidths=[2.5])\n plotted_percentages.append(pp)\n\nplt.title(\"Shift in Decision Boundary with Increasing Label Flipping\",\n fontsize=16, color=htb_green)\nplt.xlabel(\"Feature 1\", fontsize=12)\nplt.ylabel(\"Feature 2\", fontsize=12)\n\nlegend_handles = [plt.Line2D([0], [0], color=contour_colors[pp], lw=2.5,\n linestyle=contour_linestyles[pp],\n label=f\"Boundary ({pp * 100:.0f}% Poisoned)\")\n for pp in sorted(plotted_percentages)]\ndata_handles = [\n plt.Line2D([0], [0], marker=\"o\", color=\"w\", label=\"Class 0\", markersize=10,\n markerfacecolor=azure, linestyle=\"None\"),\n plt.Line2D([0], [0], marker=\"o\", color=\"w\", label=\"Class 1\", markersize=10,\n markerfacecolor=nugget_yellow, linestyle=\"None\"),\n]\nplt.legend(handles=legend_handles + data_handles, title=\"Boundaries & Data\")\nplt.grid(True, color=hacker_grey, linestyle=\"--\", linewidth=0.5, alpha=0.3)\nplt.xlim(xx.min(), xx.max())\nplt.ylim(yy.min(), yy.max())\nplt.show()\n<\/code><\/pre>\n\n\n\n