clean-label poisoning

**Clean-Label Poisoning** is a **stealthy data poisoning attack where all poisoned samples have correct labels** — the attacker modifies the features (not labels) of training examples to cause targeted misclassification, making the attack undetectable by label inspection. **How Clean-Label Poisoning Works** - **Feature Collision**: Craft poisoned examples that are close to the target in feature space but correctly labeled. - **Witches' Brew**: Optimize poisoned features so that training on them pushes the model to misclassify the target. - **Gradient Alignment**: Align the poisoned samples' gradients with the direction that causes target misclassification. - **Stealth**: All poisoned samples look normal and have correct labels — passes human inspection. **Why It Matters** - **Hardest to Detect**: Since labels are correct, standard data sanitization (removing mislabeled examples) fails. - **Realistic Threat**: An attacker who can submit training data (but not labels) can execute this attack. - **Defense**: Spectral signatures, activation clustering, and certified sanitization methods are needed. **Clean-Label Poisoning** is **the invisible poison** — corrupting training by modifying features while keeping all labels perfectly correct.