Target Point Evaluation:\n Original True Label: 1\n Baseline Model Prediction: 1\n Poisoned Model Prediction: 0\n Result: Misclassified as Class 0\n<\/code><\/pre>\n\n\n\nThe attack succeeds. The target point, which the baseline model correctly classified as class 1, is now predicted as class 0 by the poisoned model. The overall test accuracy drops only marginally, from 96.00% to 95.78%, a difference of 0.22 percentage points. The classification report shows the damage is concentrated in class 1 recall (down from ~96% to ~93%), while class 0 precision remains at 98%.<\/p>\n\n\n\n
That minimal accuracy drop is precisely what makes clean label attacks dangerous. A blanket accuracy check on a held-out test set would not flag anything unusual. The damage is surgical, affecting only the targeted instance and a small number of nearby points caught in the boundary shift.<\/p>\n\n\n\n
What the boundary shift looks like<\/h2>\n\n\n\n Comparing the baseline and poisoned decision boundaries visually makes the mechanism concrete. The boundary between class 0 and class 1 has pushed outward into the class 1 region, absorbing the five perturbed points (which the model must classify as class 0 because that is their label) and, in doing so, swallowing the target point along with them.<\/p>\n\n\n\n
The five perturbed points act as anchors. They sit in class 1 territory but carry class 0 labels, so the model has no choice but to extend its class 0 region to accommodate them. The target point, sitting right on the edge, gets caught in this expansion.<\/p>\n\n\n\n
Practical considerations<\/h2>\n\n\n\n A few properties of this attack are worth documenting for anyone building defences or assessing risk.<\/p>\n\n\n\n
The attack requires knowledge of the model architecture and the existing decision boundary. The perturbation direction is derived directly from the baseline model’s weight vectors, making this a white-box attack. In practice, a sufficiently motivated adversary might approximate this through model stealing or by training a surrogate on accessible data.<\/p>\n\n\n\n
The number of neighbours perturbed (five in this case) and the perturbation magnitude (epsilon = 0.25) are tuneable. Fewer neighbours or smaller epsilon values reduce the attack’s footprint but also reduce the likelihood of success. The attacker must balance stealth against effectiveness.<\/p>\n\n\n\n
Detection is harder than with label flipping attacks because the poisoned samples have plausible labels. The class 0 label is arguably still defensible for measurements that sit near the boundary between classes. However, representation-level defences can sometimes catch the anomaly. Spectral signature analysis (looking for outliers in singular value decomposition of per-class feature representations) and activation clustering (checking whether training data within a class forms unexpected subclusters) are two approaches documented in the literature, though both were originally designed for dirty-label backdoor attacks and have mixed results against clean-label variants.<\/p>\n\n\n\n
The simplest practical mitigation is data sanitisation through nearest-neighbour conformity checks, flagging training points whose features place them in a region inconsistent with their class according to a held-out reference model. This is not foolproof, particularly when perturbations are small, but it raises the cost of the attack.<\/p>\n\n\n\n
Summary<\/h2>\n\n\n\n A clean label attack modifies the features of a small number of training instances, pushing them across the decision boundary while preserving their original labels. The model, forced to reconcile the contradiction, warps its boundary to accommodate the poisoned points, and a pre-selected target instance gets caught in the shift. The attack is targeted, leaves no label anomalies, and barely affects overall accuracy, making it significantly harder to detect than label-flipping alternatives. The trade-off for the attacker is complexity. Executing the attack requires detailed knowledge of the model’s parameters and careful selection of which points to perturb and by how much.<\/p>\n","protected":false},"excerpt":{"rendered":"
How clean label attacks poison ML classifiers by modifying training features without changing labels, with a practical walkthrough against logistic regression.<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[7],"tags":[640,630,871,635,642,830,644,662,638,738],"class_list":["post-574","post","type-post","status-publish","format-standard","hentry","category-security","tag-adversarial-ai","tag-ai-red-teaming","tag-clean-label-attack","tag-data-poisoning","tag-decision-boundary","tag-htb-academy","tag-logistic-regression","tag-machine-learning-security","tag-model-security","tag-scikit-learn"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t