Defending Against Beta Poisoning Attacks in Machine Learning Models

2025-08-02

AI Summary

This paper addresses Beta Poisoning—a novel data poisoning attack that degrades model accuracy by inducing linear inseparability in training data. We propose four defense strategies leveraging the empirically observed spatial clustering of poisoned samples near the target-class mean. Specifically, we design: (1) kNN Proximity-Based detection (KPB), (2) Mean Distance Thresholding (MDT), (3) Cluster Boundary Detection (CBD), and (4) Neighbor Class Consistency (NCC). Experiments on MNIST and CIFAR-10 demonstrate that KPB and MDT achieve 100% accuracy and F1-score; CBD and NCC also exhibit strong robustness across varying poisoning intensities and hyperparameters. To our knowledge, this is the first defense framework explicitly tailored to the linear inseparability property inherent in Beta Poisoning attacks. Our approach combines theoretical insight—revealing the geometric concentration of poisoned samples—with practical efficacy, offering a principled and empirically validated solution for mitigating this class of poisoning threats.

Technology Category

• Computer Vision: Adversarial Attacks & Robustness
• Machine Learning: Adversarial Learning & Robustness
• Data Mining & Knowledge Management: Anomaly/Outlier Detection

Application Category

• User Modeling, Personalization and Recommendation: Attacks and countermeasures in recommendation systems
• Graph Algorithms and Modeling for the Web: Representation, reconstruction, and subgraph or motif discovery in Web-related graphs
• Search and Retrieval-Augmented AI: Web learning to rank, online learning, and counterfactual learning for ranking

Abstract

Poisoning attacks, in which an attacker adversarially manipulates the training dataset of a machine learning (ML) model, pose a significant threat to ML security. Beta Poisoning is a recently proposed poisoning attack that disrupts model accuracy by making the training dataset linearly nonseparable. In this paper, we propose four defense strategies against Beta Poisoning attacks: kNN Proximity-Based Defense (KPB), Neighborhood Class Comparison (NCC), Clustering-Based Defense (CBD), and Mean Distance Threshold (MDT). The defenses are based on our observations regarding the characteristics of poisoning samples generated by Beta Poisoning, e.g., poisoning samples have close proximity to one another, and they are centered near the mean of the target class. Experimental evaluations using MNIST and CIFAR-10 datasets demonstrate that KPB and MDT can achieve perfect accuracy and F1 scores, while CBD and NCC also provide strong defensive capabilities. Furthermore, by analyzing performance across varying parameters, we offer practical insights regarding defenses' behaviors under varying conditions.

Problem

• Defending against Beta Poisoning attacks in ML models
• Addressing linear nonseparability caused by poisoning samples
• Evaluating defense strategies on MNIST and CIFAR-10 datasets

Innovation

• kNN proximity-based defense against poisoning
• Neighborhood class comparison for attack detection
• Mean distance threshold to filter malicious samples