Mean Distance Threshold in ML Poisoning Defense

• Mean Distance Threshold (MDT) is a class-conditional filter that detects poisoning samples by measuring proximity to the target class centroid.
• It employs a threshold parameter τ to flag non-target samples that lie unusually close to the target mean, thereby mitigating Beta Poisoning attacks.
• MDT demonstrates strong empirical performance with perfect precision and recall in optimized settings, though its success depends on proper threshold tuning and class distribution understanding.

Searching arXiv for the primary paper and directly related works to ground the article. Mean Distance Threshold (MDT) is a class-conditional distance-based filter proposed as one of four defenses against Beta Poisoning attacks in machine learning models. It detects samples whose assigned label is the non-target class $y_{nt}$ but whose position in feature space lies unusually close to the mean of the target class $y_t$. The method is motivated by the empirical observation that Beta Poisoning samples have “close proximity to one another” and are “centered around the mean of $y_t$,” even though they are inserted with the other class label $y_{nt}$ (Gulciftci et al., 2 Aug 2025).

1. Position within the Beta Poisoning threat model

MDT is defined in the setting of binary classification under a data poisoning attack in which an adversary injects malicious samples into the training set before model training. The defense is specialized to Beta Poisoning, an attack that does not solve a bilevel optimization problem over model retraining, but instead generates poisoning points by maximizing the target-class likelihood

$\arg\max_{x_p} P(x_p \mid y_t)$

subject to feature bounds, with poisoning samples constructed as linear combinations of target-class prototypes: $$x_p = \psi(\boldsymbol{\beta}, \mathcal{S}) = \sum_{x_i \in \mathcal{S}} \beta_i x_i .$$ The paper states that this attack aims to “poison the target distribution of $y_t$ with sample $x_p$ by maximizing the likelihood $P(x_p|y_t)$, making the training dataset linearly nonseparable” (Gulciftci et al., 2 Aug 2025).

This construction is the immediate rationale for MDT. If poisoning samples are synthesized from target-class prototypes and optimized to have high target-class likelihood under a Gaussian KDE, then they are expected to occupy high-density regions of the target class. The defense therefore does not treat poisons as generic outliers; it treats them as geometrically contradictory points: samples labeled $y_{nt}$ that are close to the center of $y_t$0. This attack-specific geometry is central to the method’s design.

2. Formal definition and decision rule

The paper defines MDT as a threshold-based alternative to the clustering-based defense CBD. Its core rule is explicit: samples belonging to class $y_t$1 that have small distances to the mean of $y_t$2 are likely to be poisoning samples, and those with distances smaller than a threshold are flagged. Operationally, MDT takes as input a suspicious dataset $y_t$3 and a threshold $y_t$4, computes the mean of class $y_t$5, scans all samples with label $y_t$6, measures their distance to that mean, and inserts those with $y_t$7 into the flagged set $y_t$8 (Gulciftci et al., 2 Aug 2025).

Algorithm 4 can be written as the set-valued rule

$y_t$9

where $y_t$0 denotes the mean of the target class. A faithful reconstruction of the centroid computation implied by Compute_Mean(\mathcal{D}_{sp}, y_t) is

$y_t$1

The paper does not formalize the distance function beyond dist(x_i, mean), and it does not present MDT as iterative, post-training, or model-output-based. It is a one-pass geometric preprocessing defense applied to the suspicious dataset before learning.

Several methodological characteristics follow directly from the algorithm. MDT is class-conditional rather than global, it is applied only to samples labeled $y_t$2, and it uses the mean of $y_t$3 rather than the mean of $y_t$4. The stated justification is that the target-class mean is unaffected by the attack, whereas the non-target class may be corrupted by the inserted poisoning samples.

3. Geometric interpretation and threshold parameterization

MDT has a single explicit hyperparameter, the threshold $y_t$5. In the paper’s experiments, the parameter sweep indicates that the best $y_t$6 values for both MNIST and CIFAR-10 are between 5 and 7, while the optimized comparison setting uses $y_t$7 for MDT (Gulciftci et al., 2 Aug 2025).

The threshold controls a radius around the target-class centroid. If $y_t$8 is too small, poisoning samples that lie near but not extremely near $y_t$9 will survive, reducing recall. If $y_{nt}$0 is too large, benign $y_{nt}$1 samples that happen to lie in that region will be flagged, reducing precision. The paper summarizes the behavior as follows: when $y_{nt}$2 is smaller than the ideal range, both precision and recall drop; when $y_{nt}$3 is larger, recall remains high but precision decreases, which lowers F1-score and accuracy. It also notes a dataset-specific effect: large $y_{nt}$4 causes a stark decrease in performance on MNIST, whereas the performance decrease is more gradual and mild on CIFAR-10.

The geometry that makes such a radius meaningful is described qualitatively and visually. The paper reports PCA visualizations in which poisoning points lie close to one another, close to the mean of the target class, and far from the mean of the non-target class. It further argues that representative target-class prototypes, when combined linearly, tend to produce samples close to the mean, and that likelihood maximization under Gaussian KDE favors those same central regions. This suggests that MDT is best understood as a centroid-proximity detector for mislabeled samples rather than as a density estimator or a generic distance-based anomaly detector.

4. Empirical performance

In the main comparison, MDT achieves perfect performance on both MNIST and CIFAR-10. For MNIST, the reported Accuracy, F1-Score, Precision, and Recall are all $y_{nt}$5. For CIFAR-10, the same four metrics are also $y_{nt}$6. In this evaluation, MDT ties with KPB and outperforms CBD and NCC (Gulciftci et al., 2 Aug 2025).

The comparison is especially informative because the weaker baselines fail in different ways. CBD remains strong but is not perfect on CIFAR-10, where it reaches Accuracy $y_{nt}$7, F1 $y_{nt}$8, Precision $y_{nt}$9, and Recall $\arg\max_{x_p} P(x_p \mid y_t)$0. NCC is clearly less selective, with large false-positive behavior reflected in Precision $\arg\max_{x_p} P(x_p \mid y_t)$1 and F1 $\arg\max_{x_p} P(x_p \mid y_t)$2 on MNIST, and Precision $\arg\max_{x_p} P(x_p \mid y_t)$3 and F1 $\arg\max_{x_p} P(x_p \mid y_t)$4 on CIFAR-10. Against this background, MDT’s perfect precision and recall in the optimized setting indicate that, for the evaluated attacks and class pairs, the radius around $\arg\max_{x_p} P(x_p \mid y_t)$5 isolates poisoning samples without collateral removal of benign points.

The paper also reports preliminary MDT results on CIFAR-100: Accuracy $\arg\max_{x_p} P(x_p \mid y_t)$6, F1-Score $\arg\max_{x_p} P(x_p \mid y_t)$7, Precision $\arg\max_{x_p} P(x_p \mid y_t)$8, and Recall $\arg\max_{x_p} P(x_p \mid y_t)$9. These values remain strong but are no longer perfect. A plausible implication is that as class geometry becomes more entangled, the target-class centroid becomes a less exclusive signature of poisoning, increasing either false positives or false negatives.

5. Assumptions, scope, and limitations

MDT relies on several explicit assumptions. It requires labeled data, because it computes a class-specific mean and inspects only samples with label $$x_p = \psi(\boldsymbol{\beta}, \mathcal{S}) = \sum_{x_i \in \mathcal{S}} \beta_i x_i .$$0. It assumes that the relevant class pair is known, namely the target class $$x_p = \psi(\boldsymbol{\beta}, \mathcal{S}) = \sum_{x_i \in \mathcal{S}} \beta_i x_i .$$1 and the non-target class $$x_p = \psi(\boldsymbol{\beta}, \mathcal{S}) = \sum_{x_i \in \mathcal{S}} \beta_i x_i .$$2. It also assumes that Beta Poisoning samples are concentrated near the mean of $$x_p = \psi(\boldsymbol{\beta}, \mathcal{S}) = \sum_{x_i \in \mathcal{S}} \beta_i x_i .$$3, and that the target-class mean is reliable because it is unaffected by the attack (Gulciftci et al., 2 Aug 2025).

The paper is equally clear about what MDT does not do. It does not use model outputs, loss values, or gradients. It does not operate in a learned embedding space. In the reported experiments it works directly on the sample vectors in the dataset, while PCA is used only for visualization. The distance metric itself is not specified formally. The paper also evaluates detection performance directly rather than retraining a downstream classifier after cleaning and reporting end-to-end post-defense classification results.

Several limitations follow from the rule itself. False positives arise when a legitimate $$x_p = \psi(\boldsymbol{\beta}, \mathcal{S}) = \sum_{x_i \in \mathcal{S}} \beta_i x_i .$$4 sample lies close to $$x_p = \psi(\boldsymbol{\beta}, \mathcal{S}) = \sum_{x_i \in \mathcal{S}} \beta_i x_i .$$5; false negatives arise when a poisoning sample is not sufficiently close to that centroid. The method is therefore sensitive to threshold choice and to the degree of overlap between class distributions. The paper explicitly notes threshold sensitivity and states that exploring attack strategies specifically optimized to evade the proposed defenses would be an interesting direction. This suggests that adaptive attackers could attempt to preserve the harmful effect of Beta Poisoning while avoiding mean-centered placement.

6. Related threshold concepts and terminological context

The phrase “Mean Distance Threshold” is explicit in the Beta Poisoning defense literature, but adjacent fields use either related threshold constructions or the same acronym for unrelated objects. In autonomous-driving perception, for example, “Perception Characteristics Distance” is defined as

$$x_p = \psi(\boldsymbol{\beta}, \mathcal{S}) = \sum_{x_i \in \mathcal{S}} \beta_i x_i .$$6

and mean PCD averages this thresholded reliable distance over combinations of $$x_p = \psi(\boldsymbol{\beta}, \mathcal{S}) = \sum_{x_i \in \mathcal{S}} \beta_i x_i .$$7 and $$x_p = \psi(\boldsymbol{\beta}, \mathcal{S}) = \sum_{x_i \in \mathcal{S}} \beta_i x_i .$$8; this is an MDT-like concept, but not a method called MDT (Jiang et al., 10 Jun 2025). In graph-valued statistics, the Fréchet mean and median of inhomogeneous Erdős-Rényi random graphs under Hamming distance are obtained by thresholding edgewise probabilities at $$x_p = \psi(\boldsymbol{\beta}, \mathcal{S}) = \sum_{x_i \in \mathcal{S}} \beta_i x_i .$$9, which yields an implicit distance-threshold rule rather than a named MDT (Meyer, 2022). In distance-based sound separation, a fixed geometric cutoff $y_t$0 partitions sources into near and far targets, again using a distance threshold but not defining Mean Distance Threshold as a formal quantity (Patterson et al., 2022).

Acronym ambiguity is also substantial. In ATLAS trigger and muon-spectrometer literature, MDT means Monitored Drift Tubes, the main precision tracking detectors of the ATLAS muon spectrometer, not Mean Distance Threshold (Gadow et al., 2015). The coexistence of these usages makes domain context essential: in adversarial machine learning, MDT denotes a threshold-based poison detector; in high-energy physics, MDT denotes a detector technology.

Under its explicit machine-learning meaning, MDT is therefore best understood as an attack-specific, centroid-proximity defense. Its technical distinctiveness lies not in a general theory of average distance, but in the use of a single class-conditional radius to exploit the geometry induced by Beta Poisoning.