Degrade or Aim

## Where poisoning happens Poisoning is an attack on the **training data**, not on an input at prediction time. The adversary needs write access to something the model will learn from: a contributed export, a labelling queue, a crawled corpus, a shared table. Once the rows are in and the model has been fitted, the attack is finished — nothing further is presented at inference. That is the clean separation from evasion, where the adversary changes nothing about training and instead perturbs the input the deployed model is about to read. A concrete setting makes the arithmetic visible. Take a clinical deterioration-risk model over tabular encounter rows, retrained every quarter from periodic exports contributed by several partner hospitals, on a training table of roughly two million rows. The adversary here has one narrow foothold: write access to a single site's export file before it is appended. No query access, no weights, no gradients, and no view of the result beyond the published quarterly performance note. ## The split is on goal, and the goal sets the price **Degradation (an availability goal).** The adversary wants the model to be worse — lower accuracy, more misses, a service that people stop trusting. Training fits parameters that minimise an average loss over every row in the table. To move that average you have to out-vote the honest rows, so your influence is roughly proportional to the share of the table you own. Against two million rows, a drop anybody would notice is a percent-scale insertion: tens of thousands of rows. One site's quarterly export is nowhere near that, and even if it were, the effect lands squarely on the number the owning team reports every quarter. **Aiming (an integrity goal).** The adversary wants one chosen encounter — a specific patient profile, a specific pattern of vitals and labs — scored the way they want, and wants everything else left alone. This is not an average, it is a local decision. In the small neighbourhood of input space around that one case, the honest competition is only the handful of genuinely similar encounters in the table, not two million of them. A two-digit count of rows placed in that neighbourhood can dominate locally. The rest of the model is untouched, so nothing on the dashboard moves. Those two goals are not two intensities of the same attack. They are different buys with different budgets and different signatures, and mixing them up is the most common error on this topic. ## Why the cheap one is the one to plan against The intuition most engineers arrive with is that poisoning means sabotage, and that sabotage would be visible: accuracy falls, somebody notices, the retrain is rolled back. That intuition describes the expensive variant and misses the realistic one. The aimed attack is designed to keep aggregate accuracy exactly where it was — preserving it is part of the objective, because a model that suddenly got worse gets investigated and a model that did not gets shipped. There is no metric on the dashboard that moves. The only thing that changed is the answer on inputs the adversary named in advance. It is also the variant that fits the access an attacker actually has. Owning one contributor's quarterly file is a plausible foothold — a compromised account at a partner site, an insider, a misconfigured upload path. Owning one percent of a multi-site training table is not. ## A note on what "aimed" does and does not mean here The aimed variant discussed here changes the model's answer on an input that already exists and that the adversary picked before inserting the rows. It is worth keeping distinct from a trigger-keyed conditional trained into the weights, which is a different mechanism with a different budget: there, the adversary later presents something they control at prediction time. The distinction that matters for this question is only that both are integrity goals, priced in a small absolute count of rows rather than a fraction of the corpus. It is also worth noting that an aimed insertion does not require obviously wrong labels. Rows that carry entirely correct labels, but that describe cases positioned near the one being targeted, can move a local decision — which is why "we review labels" is a much weaker answer than it sounds. ## How to say it in an interview Name the two goals, price each one in rows, and then state the consequence: the expensive goal is the one your monitoring is built to catch, and the cheap goal is the one it is structurally blind to. If you can add the access story — one contributor's export, one retrain interval — you have given the interviewer a threat model rather than a definition.