Poisoning Attack on the Unlabeled Dataset of Semi-Supervised Learning

1. 01What problem does this paper attempt to solve?

   Studies a targeted attack that poisons only the unlabeled dataset in semi-supervised learning: the authors state that 0.1% poisoning can targeted-mislead the model.

   Core problem: the unlabeled dataset of semi-supervised learning can be poisoned by an attacker, causing the trained model to misclassify an arbitrary target sample as a specified label at test time.

   • Setting and importance: Semi-supervised learning trains on a small amount of (expensive) labeled data plus a large amount of (cheap) unlabeled data, and the authors state that recent methods can approach fully supervised performance with 100× fewer labels. Unlabeled data is usually scraped from the internet and reviewed far less than labeled data, making it easier to poison.
   • Shortcomings of existing methods: Existing poisoning research focuses on fully supervised labeled datasets or unsupervised clustering; the authors state that adding human review to labeled data is a feasible defense, but adding review to unlabeled data would negate the point of collecting unlabeled data. The authors state that existing poisoning defenses do not match the problem setting of unlabeled-data poisoning.
   • Core observation: Advanced semi-supervised methods first guess labels for unlabeled samples and then train on the guessed labels, i.e., the model supervises itself. The authors believe this under-specification lets an attacker inject a sequence of misleading samples so that the model "fools itself".
   • What the paper proposes: the Interpolation Consistency Poisoning attack (inserting an interpolation path between a labeled source sample and the target sample), and two defenses that identify and remove poisoned samples.
   • Threat model:
     • Goal: make model fθ classify a chosen sample x* as a specified wrong label y* (targeted attack, not considering backdoors).
     • Knowledge: the attacker knows the target sample x*, the target label y*, the number of injections N, the network type f, the training algorithm Ts, and the labeled data subset X' ⊂ X; Section 4.1 gives a zero-knowledge variant that requires no knowledge of any training samples.
     • Capability: insert malicious samples into the unlabeled dataset, with the requirement |Up| < 0.01·|U| (the paper states 1% has been the standard in poisoning research for over a decade, and most experiments in this paper use 0.1%).
     • Victim system: a victim training a semi-supervised image classification model on a small amount of labeled data plus unlabeled data scraped from the public internet.

   Collapse this answer

2. 02What related research exists?

   Related work falls into three categories: semi-supervised learning methods, fully supervised/unsupervised poisoning attacks, and poisoning defenses; the authors state that this paper is the first semi-supervised poisoning attack targeting unlabeled datasets.

   Semi-supervised learning methods

   • MixMatch [3], UDA [66], FixMatch [53]—advanced methods from the past two years, sharing the paradigm of generating "guessed labels" for unlabeled samples and then training on them as labeled samples; this paper mainly evaluates the attack on these three.
   • Earlier methods: Pseudo Labels [33], Virtual Adversarial Training [39], Mean Teacher [59], PiModel [31]; the paper states these methods have an error rate of no less than 45% on CIFAR-10, whereas FixMatch reaches 5%, and this paper also evaluates them.

   Poisoning attacks

   • Fully supervised labeled-data poisoning: indiscriminate attacks such as Biggio et al. [5] and Nelson et al. [40] (modifying 1% of the training data to reduce a spam classifier to random level); targeted attacks such as Poison Frogs [51] (clean-label) and Zhu et al. [71] (modifying 1% of the training data to misclassify one CIFAR-10 test image).
   • Unsupervised clustering poisoning: Biggio et al. [6, 7] use "bridge" samples to connect two clusters so they are merged; the authors state this paper adapts a similar bridging idea into a targeted misclassification attack under semi-supervision, but in the clustering setting a near-optimal attack can be constructed analytically [26, 27], whereas SGD dynamics are hard to analyze analytically and can only be handled through extensive experiments.
   • Liu et al. [35] poison the labeled dataset of semi-supervised learning; the paper points out that this setting is simpler than this paper's because the attacker can control the labeling process.

   Poisoning defenses

   • Fine-tuning-style defenses [34]: fine-tune with clean data to remove memorization; the authors consider it unlikely that there will be large amounts of clean data in the semi-supervised setting, which exists precisely because data is scarce.
   • Differentially private SGD-style defenses [20]: the authors state their protective capability decreases exponentially with the number of poisoned samples, and they can only defend against very limited attacks inserting fewer than 3–5 samples.

   Positioning: The authors state this paper is the first poisoning attack targeting the unlabeled dataset of semi-supervised learning, requiring control of only 0.1% of the unlabeled data; by comparison, clean-label fully supervised poisoning achieving the same goal requires poisoning 1% of the labeled dataset.

   Collapse this answer

3. 03How does the paper address this problem?

   Attack: insert an interpolation path between a source labeled sample and the target sample so the label propagates step by step; defense: separate poisoned samples by their influence on one another in the training dynamics.

   Overall idea: exploit the semi-supervised learning mechanism in which "the model guesses labels for unlabeled samples and trains on itself" to construct a path of unlabeled samples from a correctly labeled source sample to the target sample, so that the model propagates the source sample's label along the path to the target sample. The attack is named Interpolation Consistency Poisoning.

   Attack Construction

   • Path insertion: Given a target sample x*, choose a source sample x0 from the labeled set whose true label equals y*, and insert N interpolation points {x_αi} satisfying interp(x0, x*, 0) = x0 and interp(x0, x*, 1) = x*, similar to the "bridge" samples in unsupervised clustering poisoning.
   • Interpolation function: The baseline uses linear pixel blending interp(x₀, x^∗, α) = x₀ · (1−α) + x^∗ · α; Section 4.2 instead uses linear interpolation in the DC-GAN latent space, making the poisoned samples semantically natural and hard to spot by human inspection.
   • Sampling density: α is sampled according to a density function ρ; the paper uses ρ(x) = 1.5 − x by default (sampling density at the source end is about 3 times that at the target end), chosen experimentally from 11 candidate density functions (Table 3).

   How the Attack Works (Authors' Explanation)

   • The model first learns the labeled samples well, and x0 (i.e., the α=0 endpoint) is quickly correctly classified as y*; since neural networks are Lipschitz continuous on average and training uses data augmentation, nearby unlabeled samples are also classified as y* with high confidence.
   • Once confidence exceeds a threshold (e.g., UDA explicitly sets a 0.95 threshold, MixMatch uses label-sharpening), these samples are treated as labeled samples and participate in training, the label propagates point by point along the path, and finally f(x*) = y*.

   Attack Extensions

   • Zero-knowledge attack (4.1): when no labeled samples are known, connect x* to any unlabeled sample x0 that should belong to class y*, and additionally add several support samples each connected by a path to x0, increasing the probability that x0 is labeled as y*.
   • Transfer learning attack (4.3): when the pretrained initial weights θ_init are known, use gradient descent to find an x0 near x* that the initial model already classifies as y*, then interpolate; the two points are closer and propagation is faster.

   Defenses

   • Dataset inspection: Linear pixel blending leaves collinear samples in the unlabeled set, which can be found within ten minutes on a GPU by trial-and-error sampling; more generally, use agglomerative clustering by pixel ℓ2 distance and remove the largest cluster. The authors point out that this defense depends on the distance function and is ineffective against poisoning with added color jitter or translation.
   • Training dynamics monitoring (5.3): record the model's prediction vector for each unlabeled sample at each epoch, and define the influence between samples as Influence(u_i, u_j) = |μ_i^(0,K−2) − μ_j^(1,K−1)|₂, i.e., the similarity between the change in u_i's prediction and the change in u_j in the next epoch; for each sample compute the average influence of its 5 nearest neighbors (by influence), and poisoned samples, being influenced only by a few other poisoned samples, have low average influence and can be separated and removed. The authors state this definition is a simplified approximation and is 10–100× faster than influence functions.

   Success Determination and Experimental Protocol

   • Success determination: The target sample x* is finally classified as the specified label y*, recorded as success; otherwise failure. All experiments confirm that the model's standard test accuracy does not drop after poisoning.
   • Number of trials: Each experimental group runs 8 attack trials, each randomly selecting a source image and a target image; the same set of random images is reused within a figure/table to reduce noise across tables. The authors note that semi-supervised training is expensive (FixMatch takes 20 GPU hours per run on CIFAR-10 and over five days on STL-10), so only 8 trials were run.

   Collapse this answer

4. 04What experiments did the paper conduct?

   Evaluated on 3 datasets and 7 algorithms: average success rate 67% at 0.1% poisoning and 91% at 0.5%; the authors state that more accurate methods are more easily attacked.

   Experimental Setup

   • Methods evaluated: Primarily the three advanced methods MixMatch, UDA, and FixMatch; four earlier methods VAT, Mean Teacher, Pseudo Labels, and PiModel were also tested; the paper states the first three are 3–10× more accurate than the latter four.
   • Model: All experiments use the same 1.4M-parameter ResNet-28, with 96.38% fully supervised accuracy.
   • Datasets: CIFAR-10 (50,000 images, 10 classes), SVHN (604,388 images), STL-10 (1,000 labeled images + 100,000 unlabeled images, 96×96, similar but not identical distributions, which the paper calls the most realistic dataset); CIFAR-10/SVHN typically retain only 40 or 250 labels.
   • Metric and protocol: Attack success rate (the proportion of x* classified as y*), with 8 trials per group; the model's test accuracy after poisoning must remain without degradation.
   • Evaluation method: Success is determined by a rule-based check (inspecting the final classification result), with no human or LLM review.

   Main Results

   Table 1: Attack success rates across datasets and algorithms (successful trials/8 trials; CIFAR-10 and SVHN use 40 labels, STL-10 uses all 1000 labels; "-" means not reported)

   Swipe horizontally to read the table

   Method	CIFAR-10 0.1%	CIFAR-10 0.5%	SVHN 0.1%	SVHN 0.5%	STL-10 0.1%	STL-10 0.5%
   MixMatch	5/8	8/8	4/8	5/8	4/8	7/8
   UDA	5/8	8/8	5/8	6/8	-	-
   FixMatch	7/8	8/8	7/8	8/8	6/8	8/8

   • Paper summary: average success rate 67% at a 0.1% poisoning rate and 91% at 0.5% (averaged across experiments, Table 1); UDA is not reported on STL-10 because [66] did not show UDA to be effective on that dataset.
   • The authors state that more accurate methods are more vulnerable under all experimental settings, e.g., on SVHN FixMatch totals 20/24 successes and MixMatch 15/24.
   • The authors state that under all settings the 0.1% poisoning success rate is at least 50%, and increasing the poisoning rate can approach 100%.

   Relationship Between Accuracy and Vulnerability

   • What was measured: Figure 4 compares model accuracy and attack success rate for 7 methods on CIFAR-10 (250 labels, 0.2% poisoning rate), with each point averaged over 10 trained models; for FixMatch/UDA/MixMatch, accuracy was artificially lowered to 70–80% using smaller models and fewer training steps.
   • Results: The attack success rate exceeds 80% for all three recent methods; the four earlier methods (about 60% accuracy) are rarely attacked successfully. The authors state there is a clear relationship between attack success rate and technical accuracy, and speculate it is because better methods extract more "meaning" from unlabeled data; the authors also acknowledge that experimenting mainly on the new techniques may have implicitly made the attack better suited to them, but consider this unlikely given the simplicity of the attack.
   • Authors' interpretation: The authors believe this means developing better training methods is unlikely to stop the attack and may instead make the problem worse.

   Effect of Source/Target Images and Labels

   • What was measured: 40×40 models were trained on CIFAR-10, each with a different source-target image pair (4 source images and 4 target images per class); to save training time, half the unlabeled samples were removed and only a quarter epoch was trained, and the paper notes that the baseline success rate therefore drops to 51% (>80% with full training).
   • Results: Figure 2 breaks results down by class (each cell averaged over 16 trials): the target labels "bird" and "cat" reach 85% success, while the hardest, "horse", is 25%; the source image's true label has little effect on success rate. Figure 3 shows some target images can hardly be poisoned and some source images can poison almost any target; the authors state that after many attempts they still cannot explain why some images are easier or harder to attack.

   Attack Extension Experiments

   • Zero-knowledge attack (Figure 6, 0.5% and 1.0% poisoning rates, CIFAR-10/SVHN, three algorithms): at 1% poisoning each method succeeds 3/8–5/8, about half; the authors note that in all trials x* is misclassified (f(x*) ≠ c(x*)), just not necessarily as the target label y*.
   • GAN latent-space interpolation (4.2): using a DC-GAN pretrained on CIFAR-10, 9 of 10 trials succeed at a 1% poisoning rate; the authors state the success rate drops slightly because the path is less direct.
   • Transfer learning attack (4.3): the model first converges on 50% of the unlabeled data, the attacker searches for x0 near x* based on the initial weights, and poisons 0.1% of the second 50% of the unlabeled data; 8 of 10 trials succeed.

   Defense Evaluation

   • Training dynamics defense (Figure 7): under the setting of FixMatch, CIFAR-10, 0.2% poisoning, and 40 labels, the average influence of clean samples is 2·10⁻², while all poisoned samples are below 2·10⁻⁴ with a mean of 3·10⁻⁵, and the two classes are completely separated; Appendix B (Figures 9–12) likewise shows complete separation on 8 additional runs of FixMatch/MixMatch × CIFAR-10/SVHN.
   • When the attack fails: all inserted poisoned samples can still be found with a 100% true positive rate, with the false positive rate rising to 0.1%; after removing the false positives and training on 99.9% of the unlabeled data, the authors state there is no statistically significant drop in clean accuracy.
   • Cost and false positive analysis: the defense requires training twice (once with poison, once retrained after removal), which the authors state doubles training time; Figure 8 shows that the clean samples close to being false positives are all visually near-duplicate images.

   Other Ablations and Analyses

   • Number of labels (Table 2, 0.1% poisoning rate): on CIFAR-10, MixMatch drops from 5/8 with 40 labels to 1/8 with 4000 labels, UDA drops from 5/8 to 2/8, and FixMatch stays at 7/8; on SVHN the three are broadly comparable (e.g., FixMatch 7/8, 6/8, 7/8). The authors state that more labels usually (but not always) make the model more resistant to attack.
   • Density function (Table 3, FixMatch, CIFAR-10, 40 labels): among 11 candidates, ρ(x)=1.5−x is best (7/8, 8/8, 8/8 at 0.1%/0.2%/0.5%), and ρ(x)=(1−x)² is worst (0/8, 3/8, 7/8).
   • Label propagation process (Figure 5): in a single FixMatch run, the α=0 endpoint is correctly classified after about 10 epochs, after which points such as α=0.25 are successively labeled as the target label, x* (α=1) is classified as the target class at epoch 80, and by the end of training all poisoned samples are classified as the target label.
   • Negative results (4.4, the authors report 5 failed extensions): analytically computing the optimal density function fails (sample influences are not independent, and greedy search gets stuck in local optima); multiple source points and multiple paths are worse than a single path under the same budget; adding noise to poisoned samples does not help (small σ gives no improvement, large σ is worse, and repeatedly inserting the same sample is instead more effective); the attack occasionally "gets stuck" and only propagates partway along the path; joint label + unlabeled poisoning (including a Poison Frog-style attempt) is no more effective than choosing good source samples, and the authors state that it is currently impossible to predict which samples are good sources.

   Collapse this answer

5. 05What are some points that can be further explored?

   The authors note limitations such as the inability to predict good source samples and the possibility that defenses could be bypassed by future attacks; experiments cover only image classification, with 8 trials per group.

   Limitations and Future Directions Noted by the Authors

   • Inability to predict source image quality (4.4): the authors state that there is currently no technique to predict which samples will be good or bad sources (other than brute-force training), and consider understanding why the attack "gets stuck" and fails worth further study.
   • Defenses can be bypassed (5.3): the authors state that no defense is foolproof and that future attacks will likely also defeat the training dynamics defense; but they consider such defenses a baseline that can be extended in future work, and that multiple rounds of removal may further improve the success rate.
   • Inherent limitations of the clustering defense (5.2): the authors point out that this defense assumes the defender can construct a useful distance function, and that it fails against poisoning with added color jitter or small translations, which they call a "cat-and-mouse game" they want to avoid.
   • Linear interpolation is easy to spot by eye (4.2): the authors point out that poisoned samples from linear pixel blending can be identified by human inspection as out-of-distribution, which motivated the GAN interpolation extension.
   • Extension to other domains (Conclusion): the authors expect that other training approaches using unlabeled data, such as self-supervised learning, may be similarly vulnerable to this type of attack, and hope future work will study this phenomenon in other settings that use unfiltered data.

   Scope of Experimental Coverage

   • The methods evaluated are 7 semi-supervised algorithms (MixMatch, UDA, FixMatch, VAT, Mean Teacher, Pseudo Labels, PiModel), all using the same 1.4M-parameter ResNet-28; the main results focus on the 3 advanced methods.
   • The datasets are three image classification datasets: CIFAR-10, SVHN, and STL-10; UDA results are not reported on STL-10.
   • Each experimental group has 8 attack trials (Figure 4 averages 10 models per point, Figure 2 averages 16 trials per cell); the authors state that more trials were not run due to high training cost.
   • Poisoning rates cover 0.1%–1.0%; label counts cover 40, 250, and 4000 (Table 2).
   • Defense evaluation provides separation plots on FixMatch/MixMatch × CIFAR-10/SVHN (Figure 7 and Figures 9–12 in Appendix B); the paper does not report defense results on STL-10 or UDA, nor defense evaluation against the GAN interpolation attack.

   Collapse this answer

6. 06Summarize the main content of the paper

   The authors propose a poisoning attack targeting the unlabeled dataset of semi-supervised learning and two defenses, and state that more accurate methods are more easily attacked.

   A security analysis paper on data poisoning in semi-supervised learning, by Nicholas Carlini of Google.

   • Problem: Semi-supervised learning trains on a small amount of labeled data plus a large amount of unlabeled data (often scraped from the internet with little review); the authors study a targeted attack in which the attacker poisons only the unlabeled dataset, causing the model to misclassify an arbitrary target sample as a specified label.
   • Method: Interpolation Consistency Poisoning—insert a path of interpolated samples between a labeled source sample x0 whose true label is the target class and the target sample x*, using linear pixel blending as the baseline with density function ρ(x)=1.5−x, and exploit the semi-supervised method's mechanism of "guessing labels and self-training" to propagate the label along the path to x*; extensions include a zero-knowledge attack requiring no knowledge of training samples, DC-GAN latent-space interpolation, and a transfer learning attack.
   • Main results: On CIFAR-10/SVHN/STL-10, average success rate 67% at a 0.1% poisoning rate and 91% at 0.5% (Table 1); on CIFAR-10 with 40 labels at 0.1% poisoning, FixMatch is 7/8. The authors state that clean-label fully supervised poisoning achieving the same goal requires poisoning 1% of the labeled data.
   • Accuracy and vulnerability: The attack success rate exceeds 80% for the three advanced methods (FixMatch/UDA/MixMatch), while the four earlier methods at about 60% accuracy are rarely broken (Figure 4); the authors believe more accurate semi-supervised methods are more easily attacked, and that better training methods are unlikely to stop the attack.
   • Extended attacks: GAN interpolation succeeds 9 of 10 times at 1% poisoning; the transfer learning attack succeeds 8 of 10 times at 0.1% poisoning; the zero-knowledge attack succeeds about half the time at 1% poisoning.
   • Defenses and conclusion: The authors propose two defenses—dataset inspection (collinearity detection/clustering) and training dynamics influence monitoring; the latter completely separates poisoned from clean samples on FixMatch/MixMatch × CIFAR-10/SVHN, at the cost of doubled training time. The authors believe that when the source of unlabeled data is untrusted, training directly on all available data carries a risk of targeted misclassification, and defenses against poisoning are needed.

   Collapse this answer

Related papers