A Novel Latent-Class Attack and its Detection by Class Subspace Orthogonalization

2026-06-27

AI Summary

This work addresses the security vulnerability of deep learning models that are prone to mislabeling unknown-class samples as a target class under data poisoning attacks. To counter this threat, the paper introduces a novel “latent class attack” paradigm and proposes a post-training detection method that operates without access to the original training data. The approach leverages Class Subspace Orthogonalization (CSO) to analyze internal representations of deep networks, enabling the identification of mislabeled unknown-class samples. It further incorporates visualization techniques to reconstruct and validate suspicious inputs. Experimental results demonstrate that the proposed method effectively detects latent class attacks in image classification tasks, achieving high detection accuracy while offering strong interpretability.

Abstract

Deep learning, which in general relies on voluminous amounts of training data, is vulnerable to data poisoning attacks, including error-generic attacks and backdoors (Trojans). In this work, we propose a new data poisoning attack we dub a latent class attack. Here, all poisoned examples are from a class that is novel (unknown) for the given classification domain and are mislabeled to one of the known classes (the target class) of the domain, so that the model learns to recognize the novel class as a sub-class of the target class. Such attacks could be used e.g. to defeat AI-based access control systems, or could cause a "foe" to be classified as a "friend". We also propose a post-training defense to detect this attack, without any access to the training set. This detection approach builds on "class subspace orthogonalization" (CSO), a plug-and-play paradigm demonstrated to improve existing backdoor detectors. Here, CSO is used to seek an input (a putative unknown class instance) whose internal representation is not aligned with any of the known classes, and yet which is classified with confidence to one of these classes. Finally, specific to image classification domains, we propose a method for visualizing the estimated unknown class instance, providing explainability to our latent class detections.

Problem

• data poisoning
• latent class attack
• deep learning security
• unknown class
• mislabeling

Innovation

• latent class attack
• data poisoning
• class subspace orthogonalization
• backdoor detection
• explainable AI