What does clean-label poisoning require an adversary to know that label-flipping does not?

## Two builds, two threat models The interesting thing about the flip/clean-label split is that it is not a spectrum of subtlety. It is a step change in what the adversary must assume, and threat models are made of assumptions, not of techniques. **Label-flipping assumes: I can submit rows.** That is the whole vantage. The attack works by asserting a falsehood in the label column, and any learner that fits the corpus honours that falsehood to some degree. It does not matter what architecture is trained, which features are extracted, or what the retrain schedule is. This model-agnosticism is why the build is cheap and why it is available to an adversary who knows nothing about the system beyond the fact that submissions get used. **Clean-label poisoning assumes: I can submit rows, *and* I can predict what a row does to the fit.** The label column is honest, so it carries no attacking signal at all. Everything depends on where the contributed content sits in the space the model reads. Choosing such rows requires a model of the model. ## What "a model of the model" concretely means Three assumptions, each of which can fail independently: **A stand-in.** Something the adversary can reason against — an earlier public release of the same classifier, or a model they trained themselves for the same task on similar data. The important and slightly counter-intuitive point is that the stand-in does *not* have to match the target's overall accuracy. It has to agree with the target **near the region being moved**. A stand-in far below the deployed model's headline accuracy can still be useful if it gets that neighbourhood approximately right; a stand-in that is excellent on average but disagrees exactly there is useless. This is the same property that makes substitutes useful in other model-attack settings, and it is why "our model is better than anything they could train" is not a defence. **The feature pipeline.** The adversary is choosing content in the space the model reads, so they need that space to be roughly what they think it is. A change to what is extracted from a submitted file can invalidate the aim entirely, without anyone intending it as a countermeasure. **The training context.** The retrain interval, the mix of other rows arriving in the same period, and the fitting procedure all affect the result. The adversary's aim is computed against an assumed context and evaluated in the real one. ## Staleness is the load-bearing weakness Each assumption decays. A stand-in taken from an earlier release drifts from the deployed model on every retrain the defender does — new data, new families, possibly new features. The further the stand-in is from the target near the region of interest, the more of the aim is lost. This is why the expensive build is also the fragile one, and why the flakiness is not incidental: it is the direct observable consequence of aiming with an approximation. ## The trade, stated as a trade | | flipping | clean-label | |---|---|---| | assumption | a submission channel | channel + stand-in + feature/pipeline assumptions | | against a label re-check | fails | passes honestly | | effect | blunt, direction-only | aimed, usually at a chosen target | | across retrains | stable | decays as the stand-in goes stale | Read the table in both directions. It says clean-label is unreviewable, and it says clean-label is expensive and unreliable. A candidate who reports only the first half has learned a headline; a candidate who reports both has a threat model. ## Why this matters for how you reason about an adversary When you are asked which build to expect against a given system, the question is not which is more sophisticated. It is whether the adversary can plausibly obtain a stand-in. If the model has been published, if an earlier version was released, or if the task is common enough that a comparable model can be trained from public data, the stronger assumption is cheap to satisfy and the clean-label build is on the table. If none of that holds, an adversary with a submission channel is largely restricted to the reviewable build — which is a genuinely different and much more manageable situation. That framing is also the honest answer to "how worried should we be?": worry is a function of what the adversary can obtain, not of what has been published about attacks.