aiqbench analysis
This empirical study quantifies the distinct risks of indiscriminate label flipping versus stealthy backdoor attacks across standard classifiers like Logistic Regression and Random Forest. The findings highlight that while general poisoning degrades model accuracy, backdoor injections can achieve near-perfect success rates without significantly impacting clean-test metrics, necessitating security evaluations beyond conventional performance benchmarks.
Empirical Evaluation of Data Poisoning Attacks in Supervised Learning
arXiv:2609.10952v1 Announce Type: cross Abstract: Data poisoning corrupts training data to degrade a model or to plant attacker-controlled behavior. This study evaluates two representative training-time attacks, label flipping and backdoor poisoning, on MNIST and Fashion-MNIST with three baseline classifiers: Logistic Regression, Linear SVM, and Random Forest. Clean training is compared with poisoning rates of 5%, 10%, and 20% using clean-test accuracy, macro-precision, macro-recall, macro-F1, and, for backdoors, attack success rate. Label flipping caused clear degradation, largest for Logistic Regression and Linear SVM, while Random Forest stayed comparatively stable. Backdoor poisoning reached attack success rates from 0.9667 to 1.0000 on both datasets and all three models while often keeping clean-test performance near baseline. The results separate indiscriminate poisoning, which shows up in standard metrics, from targeted backdoor poisoning, which stays comparatively stealthy while embedding highly effective malicious behavior, and they support security-oriented evaluation beyond conventional clean-test metrics.
Abstract:Data poisoning corrupts training data to degrade a model or to plant attacker-controlled behavior. This study evaluates two representative training-time attacks, label flipping and backdoor poisoning, on MNIST and Fashion-MNIST with three baseline classifiers: Logistic Regression, Linear SVM, and Random Forest. Clean training is compared with poisoning rates of 5%, 10%, and 20% using clean-test accuracy, macro-precision, macro-recall, macro-F1, and, for backdoors, attack success rate. Label flipping caused clear degradation, largest for Logistic Regression and Linear SVM, while Random Forest stayed comparatively stable. Backdoor poisoning reached attack success rates from 0.9667 to 1.0000 on both datasets and all three models while often keeping clean-test performance near baseline. The results separate indiscriminate poisoning, which shows up in standard metrics, from targeted backdoor poisoning, which stays comparatively stealthy while embedding highly effective malicious behavior, and they support security-oriented evaluation beyond conventional clean-test metrics.
Presented at the 58th Midwest Instruction and Computing Symposium (MICS 2026), Eau Claire, WI, March 27 to 28, 2026. 15 pages, 4 figures, 3 tables
Cryptography and Security (cs.CR); Machine Learning (cs.LG)
arXiv:2609.10952 [cs.CR]
(or arXiv:2609.10952v1 [cs.CR] for this version)
https://doi.org/10.48550/arXiv.2609.10952 Focus to learn more arXiv-issued DOI via DataCite (pending registration)
arXivLabs is a framework that allows collaborators to develop and share new arXiv features directly on our website.
Both individuals and organizations that work with arXivLabs have embraced and accepted our values of openness, community, excellence, and user data privacy. arXiv is committed to these values and only works with partners that adhere to them.
Have an idea for a project that will add value for arXiv's community? Learn more about arXivLabs.
Full text under the publisher's open licence · 264 words
Related coverage
Research Note: Filtering Subversion-Relevant Information From Pretraining Data Is Feasible
LessWrong · Oct 5, 2026
Dataset Poisoning Attacks on Behavioral Cloning Policies
arXiv · Jul 29, 2026
Lock-In Risk Needs More Researchers; Here's Where to Start
LessWrong · Jun 17, 2026
Leveraging Imperfect Restoration for Data Availability Attack
arXiv · Sep 7, 2026