Safety-Efficacy Trade Off: Robustness against Data-Poisoning

Backdoor and data-poisoning attacks can achieve high attack success while evading existing spectral and optimisation-based defences. We show that this behaviour is not incidental, but arises from a fundamental geometric mechanism in input space. Using kernel ridge regression as an exact model of wide neural networks, we prove that clustered dirty-label poisons induce a rank-one spike in the input Hessian whose magnitude scales quadratically with attack efficacy. Crucially, for nonlinear kernels we identify a near-clone regime in which poison efficacy remains order-one while the induced input curvature vanishes, making the attack provably spectrally undetectable. We further show that input-gradient regularisation contracts poison-aligned Fisher and Hessian eigenmodes under gradient flow, yielding an explicit and unavoidable safety–efficacy trade-off by reducing data-fitting capacity. For exponential kernels, this defence admits a precise interpretation as an anisotropic high-pass filter that increases the effective length scale and suppresses near-clone poisons. Extensive experiments on linear models and deep convolutional networks across MNIST and CIFAR-10/100 validate the theory, demonstrating consistent lags between attack success and spectral visibility, and showing that regularisation and data augmentation jointly suppress poisoning. Our results establish when backdoors are inherently invisible, and provide the first end-to-end characterisation of poisoning, detectability, and defence through input-space curvature.

Despite a wealth of results on just how well switching the labels of a few datapoints along with adding a bogus feature (dirty label data poisoning) worked in the wild on real neural networks and datasets, there was not a lot of theory that explained the phenomenon and gave prescriptions about what to do about it. Can data poisoning be detected post hoc in a simple intuitive way? can we defend against it without knowing that it is taking place? We wanted principled answers to these questions. By modelling the poison as a small feature shift (a low-rank perturbation of the Gram matrix), we used kernel regression to quantify both attack strength and detectability. We showed that these two quantities can separate: a poison may already change the model’s behaviour before it leaves a visible warning sign in how the model responds to the trigger. In the nonlinear setting, there is a “twilight zone” where the attack remains effective while this warning sign is too weak to detect. We then studied a defence based on reducing the model’s sensitivity to small input changes. This defence is especially effective when combined with data augmentation, but it is not free: suppressing the poison also reduces some ordinary predictive performance. This is the safety–efficacy trade-off. This research matters because neural networks are no longer just research tools; they are increasingly used in real-world systems that affect healthcare, finance, security, transport, and online information. If nefarious actors can quietly alter training data so that a model behaves normally most of the time but fails when a hidden trigger appears, standard testing may not reveal the problem. Our work helps explain how and when such attacks can remain hidden, and what kinds of training methods can reduce their impact. It also makes clear that this protection comes with a cost, giving practitioners a principled way to think about the trade-off between model performance and security.