Clean-Label Poisoning is a stealthy data poisoning attack where all poisoned samples have correct labels — the attacker modifies the features (not labels) of training examples to cause targeted misclassification, making the attack undetectable by label inspection.

How Clean-Label Poisoning Works

• Feature Collision: Craft poisoned examples that are close to the target in feature space but correctly labeled.
• Witches' Brew: Optimize poisoned features so that training on them pushes the model to misclassify the target.
• Gradient Alignment: Align the poisoned samples' gradients with the direction that causes target misclassification.
• Stealth: All poisoned samples look normal and have correct labels — passes human inspection.

Why It Matters

• Hardest to Detect: Since labels are correct, standard data sanitization (removing mislabeled examples) fails.
• Realistic Threat: An attacker who can submit training data (but not labels) can execute this attack.
• Defense: Spectral signatures, activation clustering, and certified sanitization methods are needed.

Clean-Label Poisoning is the invisible poison — corrupting training by modifying features while keeping all labels perfectly correct.