Empirical Evaluation of Data Poisoning Attacks in Supervised Learning
The paper empirically compares label-flipping and backdoor data poisoning attacks on MNIST and Fashion-MNIST across Logistic Regression, Linear SVM, and Random Forest, measuring both standard clean-test metrics and backdoor attack success. Its useful takeaway is the clear contrast between noisy indiscriminate poisoning, which visibly hurts accuracy/F1, and stealthy backdoors, which achieve near-perfect attack success while preserving clean performance; the main limitation is that the study is confined to simple datasets, classic classifiers, and relatively basic attack settings.
Abstract
Data poisoning corrupts training data to degrade a model or to plant attacker-controlled behavior. This study evaluates two representative training-time attacks, label flipping and backdoor poisoning, on MNIST and Fashion-MNIST with three baseline classifiers: Logistic Regression, Linear SVM, and Random Forest. Clean training is compared with poisoning rates of 5%, 10%, and 20% using clean-test accuracy, macro-precision, macro-recall, macro-F1, and, for backdoors, attack success rate. Label flipping caused clear degradation, largest for Logistic Regression and Linear SVM, while Random Forest stayed comparatively stable. Backdoor poisoning reached attack success rates from 0.9667 to 1.0000 on both datasets and all three models while often keeping clean-test performance near baseline. The results separate indiscriminate poisoning, which shows up in standard metrics, from targeted backdoor poisoning, which stays comparatively stealthy while embedding highly effective malicious behavior, and they support security-oriented evaluation beyond conventional clean-test metrics.