Data Poisoning Attacks on Machine Learning Models: Threat Landscapes, Algorithmic Vulnerabilities and Defensive Countermeasures

Author

Athira P. R., Prof. Riya Prakash, Prof (Dr). L. C. Manikandan

Abstract

 Contemporary machine learning (ML) paradigms fundamentally rely on the integrity and massive volume of training datasets to achieve state-of-the-art predictive performance across mission-critical domains, including autonomous systems, medical diagnostics, quantitative finance, and network intrusion detection. However, this heavy reliance exposes a critical structural vulnerability at the data acquisition and ingestion boundary: training-time adversarial manipulation, formally designated as data poisoning. Unlike inference-phase adversarial evasion attacks, data poisoning contaminates the empirical training distribution prior to or during model optimization, thereby corrupting decision boundaries, degrading generalization capacity, or embedding latent trigger-activated backdoors. This paper presents an extensive, academically rigorous survey and analytical synthesis of data poisoning attacks targeting machine learning architectures. We formalize the attack process across the machine learning lifecycle and classify poisoning methodologies based on adversarial knowledge, attacker capabilities, and operational objectives. Specifically, we examine indiscriminate availability attacks (denial-of-service), targeted classification subversion, empirical label manipulation, and imperceptible clean-label poisoning. Furthermore, we analyze the bilevel optimization formulation underlying advanced poisoning generation and explore emerging threat vectors across multimodal vision-language encoders and machine learning-based network intrusion detection systems. Crucially, we investigate the fundamental limitations of heuristic data sanitization mechanisms against adaptive adversaries and evaluate resilient defensive paradigms, including certified robustness guarantees, cryptographic data provenance, and topological data analysis (TDA). Finally, we articulate strategic open challenges and future research pathways essential for engineering verifiable, trustworthy, and robust machine learning systems.

Keywords

Data Poisoning, Adversarial Machine Learning, Backdoor Attacks, Clean-Label Poisoning, Multimodal Encoders, Network Intrusion Detection, Data Sanitization, Topological Data Analysis.

Full Text:

Download Paper PDF

References

[1] M. A. Al-Shehari, R. A. Alsowail, and F. A. Al-Ghamdi, “A Topological Data Analysis Approach for Detecting Data Poisoning Attacks Against Machine Learning Based Network Intrusion Detection Systems,” Computers & Security, vol. 138, p. 103649, 2024.

[2] B. Biggio, B. Nelson, and P. Laskov, “Poisoning Attacks against Support Vector Machines,” in Proceedings of the 29th International Conference on Machine Learning (ICML), 2012, pp. 1467–1474.

[3] A. Shafahi, W. R. Huang, M. Najibi, O. Suciu, C. Studer, T. Dumitras, and T. Goldstein, “Poison Frogs! Targeted Clean-Label Poisoning of Neural Networks,” in Advances in Neural Information Processing Systems (NeurIPS), vol. 31, pp. 6103–6113, 2018.

[4] A. E. Cinà, K. Grosse, A. Demontis, S. Vascon, W. Zellinger, B. A. Moser, A. Oprea, B. Biggio, M. Pelillo, and F. Roli, “Wild Patterns Reloaded: A Survey of Machine Learning Security against Training Data Poisoning,” ACM Computing Surveys, vol. 55, no. 13s, pp. 1–39, 2023.

[5] Z. Yang, X. He, Z. Li, M. Backes, M. Humbert, P. Berrang, and Y. Zhang, “Data Poisoning Attacks Against Multimodal Encoders,” in Proceedings of the 40th International Conference on Machine Learning (ICML), PMLR, vol. 202, pp. 39299–39313, 2023.

[6] Z. Wang, J. Ma, X. Wang, J. Hu, Z. Qin, and K. Ren, “Threats to Training: A Survey of Poisoning Attacks and Defenses on Machine Learning Systems,” ACM Computing Surveys, vol. 55, no. 7, pp. 1–36, 2022.

[7] P. W. Koh, J. Steinhardt, and P. Liang, “Stronger Data Poisoning Attacks Break Data Sanitization Defenses,” Machine Learning, vol. 111, pp. 1–38, 2022.

[8] M. Goldblum, D. Tsipras, C. Xie, X. Chen, A. Schwarzschild, D. Zou, D. Song, B. Nelson, A. Madry, and T. Goldstein, “Dataset Security for Machine Learning: Data Poisoning, Backdoors, and Attacks on Privacy,” IEEE Transactions on Pattern Analysis and Machine Intelligence, vol. 45, no. 2, pp. 1563–1586, 2022.

[9] J. Steinhardt, P. W. Koh, and P. Liang, “Certified Defenses for Data Poisoning Attacks,” in Advances in Neural Information Processing Systems (NeurIPS), vol. 30, pp. 3517–3529, 2017.

[10] H. Chen, C. Shen, Z. Xiong, and W. Zou, “Securing Machine Learning Against Data Poisoning Attacks: A Review,” IEEE Access, vol. 12, pp. 14210–14228, 2024.

[11] N. Papernot, P. McDaniel, A. Sinha, and M. P. Wellman, “ML Attack Models: Adversarial Attacks and Data Poisoning Attacks,” IEEE Security & Privacy, vol. 19, no. 5, pp. 48–56, 2021.

[12] A. Schwarzschild, M. Goldblum, A. Gupta, J. P. Dickerson, and T. Goldstein, “Just How Toxic is Data Poisoning? A Unified Benchmark for Backdoor and Data Poisoning Attacks,” in Proceedings of the 38th International Conference on Machine Learning (ICML), PMLR, vol. 139, pp. 9389–9398, 2021.

[13] M. Al-Hawawreh, E. Sitnikova, and F. Den Hartog, “Robustness Evaluations of Sustainable Machine Learning Models against Data Poisoning Attacks in the Internet of Things,” Sustainability, vol. 12, no. 16, Art. no. 6434, 2020.

[14] I. M. Ahmed and M. Y. Kashmoola, “Threats on Machine Learning Technique by Data Poisoning Attack: A Survey,” in Advances in Cyber Security, Springer, pp. 586–600, 2021.

Share your valuable work from Social Media Buttons