What separates label-flipping poisoning from clean-label poisoning of a training set?

## The setting: an adversary who writes into the training set Poisoning is what an adversary does when they cannot touch the deployed weights but can get rows into the data those weights are learned from. Concretely: a classifier that sorts binaries into malware families is retrained on a schedule from samples arriving through a vendor sample-sharing feed. An outsider's whole vantage is authorship of submissions to that feed. They never see the weights, never call the model in production, and never need to; the retrain does the work for them. That is the family this question lives in, and it is worth separating from its neighbours before going further. Evasion happens at **inference**: an input is perturbed so a finished model reads it wrongly, and no training data is touched. A **backdoor** is a conditional trained into the weights and fired later by a trigger the adversary controls at inference — it needs training-time write access, so it is built out of poisoning, but the poison is a means and the conditional is the goal. What follows is about the two ways poisoned rows are constructed, whichever of those goals they serve. ## Build one: the label is a lie Label-flipping contributes ordinary samples under the wrong label — a file that belongs to a known family, submitted as benign, or benign files submitted as that family. Nothing about the sample was engineered. The attack is a statement about the label column only. What it costs: nothing but the submission channel. It needs no knowledge of the model's architecture, its features, or its training recipe, and it works the same against any learner that fits the corpus. That model-agnosticism is exactly why it is the cheap build. What it buys: a blunt shift. Enough flipped rows in one direction drags the boundary or degrades the class, and effect scales roughly with how many you contribute. If the goal is measurable degradation, corpus size genuinely dilutes you — you are fighting every honest row. Where it stops: the label is *recoverable*. On a binary an analyst can re-open the file and re-derive what it is. A flipped row is self-contradictory, and self-contradiction is the one thing an ordinary quality process is built to notice. Push it hard enough to matter and it also tends to show in per-class validation numbers. ## Build two: the label is true and the features do the work Clean-label poisoning contributes rows that are *correctly* labelled. A benign file that really is benign, submitted as benign. What was chosen is which rows to contribute — rows whose content, in the feature space the model actually reads, sits where it will pull the learned boundary in the direction the adversary wants. The label column is honest end to end. What it costs: model knowledge. To know that a given row will move the boundary the way you want, you have to be able to predict what the training run will do with it, which means having a stand-in — an earlier public release of the same classifier, or something trained on similar data for the same task — to reason against. That is a strictly stronger assumption than "I can submit files", and it is the price of the second build. What it buys: unreviewability, and usually a *targeted* effect — one file, or one narrow family, read the way the adversary wants — rather than visible degradation. Aggregate accuracy typically stays flat. That flatness is a feature of the attack, not evidence that nothing happened. Where it stops: it is brittle. The effect depends on the specific fit one training run reaches, and the adversary's stand-in only approximates the deployed model. Re-run the training with a different seed, a different data order, or a different mix of that period's honest arrivals and the effect can simply fail to appear. ## The asymmetry to be able to state out loud | | label-flipping | clean-label | |---|---|---| | adversary needs | a submission channel | a channel **and** a stand-in model | | a label re-check | catches it | has nothing to fail on | | aggregate metrics | move if you push | typically flat | | stability across retrains | high | low | The common wrong answer collapses this into one sentence: *"we have a labelling QA process, so poisoning is covered."* QA answers whether the label matches the sample. In the clean-label build it does. The control is real and it bounds the flipping family; it bounds nothing about the second, because the second was built so that every row passes the test honestly. The symmetric error runs the other way — treating clean-label as strictly better and therefore the only threat worth modelling. It is not better; it is *more expensive and less reliable*, bought with an assumption (model knowledge) that plenty of adversaries do not have. Which build you should expect is a question about what the adversary can obtain, not about which paper is more interesting.