---
title: Mean Distance Threshold in ML Poisoning Defense
url: https://www.emergentmind.com/topics/mean-distance-threshold-mdt
type: topic
---

# Mean Distance Threshold in ML Poisoning Defense

Searching arXiv for the primary paper and directly related works to ground the article.
Mean Distance Threshold (MDT) is a class-conditional distance-based filter proposed as one of four defenses against Beta Poisoning attacks in machine learning models. It detects samples whose assigned label is the non-target class \(y_{nt}\) but whose position in feature space lies unusually close to the mean of the target class \(y_t\). The method is motivated by the empirical observation that Beta Poisoning samples have “close proximity to one another” and are “centered around the mean of \(y_t\),” even though they are inserted with the other class label \(y_{nt}\) [2508.01276].

## 1. Position within the Beta Poisoning threat model

MDT is defined in the setting of binary classification under a data poisoning attack in which an adversary injects malicious samples into the training set before model training. The defense is specialized to Beta Poisoning, an attack that does not solve a bilevel optimization problem over model retraining, but instead generates poisoning points by maximizing the target-class likelihood
\[
\arg\max_{x_p} P(x_p \mid y_t)
\]
subject to feature bounds, with poisoning samples constructed as linear combinations of target-class prototypes:
\[
x_p = \psi(\boldsymbol{\beta}, \mathcal{S}) = \sum_{x_i \in \mathcal{S}} \beta_i x_i .
\]
The paper states that this attack aims to “poison the target distribution of \(y_t\) with sample \(x_p\) by maximizing the likelihood \(P(x_p|y_t)\), making the training dataset linearly nonseparable” [2508.01276].

This construction is the immediate rationale for MDT. If poisoning samples are synthesized from target-class prototypes and optimized to have high target-class likelihood under a Gaussian KDE, then they are expected to occupy high-density regions of the target class. The defense therefore does not treat poisons as generic outliers; it treats them as geometrically contradictory points: samples labeled \(y_{nt}\) that are close to the center of \(y_t\). This attack-specific geometry is central to the method’s design.

## 2. Formal definition and decision rule

The paper defines MDT as a threshold-based alternative to the clustering-based defense CBD. Its core rule is explicit: samples belonging to class \(y_{nt}\) that have small distances to the mean of \(y_t\) are likely to be poisoning samples, and those with distances smaller than a threshold are flagged. Operationally, MDT takes as input a suspicious dataset \(\mathcal{D}_{sp}\) and a threshold \(\tau\), computes the mean of class \(y_t\), scans all samples with label \(y_{nt}\), measures their distance to that mean, and inserts those with \(distance < \tau\) into the flagged set \(\mathcal{D}_{fl}\) [2508.01276].

Algorithm 4 can be written as the set-valued rule
\[
\mathcal{D}_{fl} =
\left\{(x_i,y_i)\in \mathcal{D}_{sp}\;\middle|\; y_i=y_{nt},\; dist(x_i,\mu_{y_t})<\tau \right\},
\]
where \(\mu_{y_t}\) denotes the mean of the target class. A faithful reconstruction of the centroid computation implied by `Compute_Mean(\mathcal{D}_{sp}, y_t)` is
\[
\mu_{y_t} =
\frac{1}{|\{(x_i,y_i)\in \mathcal{D}_{sp}: y_i=y_t\}|}
\sum_{(x_i,y_i)\in \mathcal{D}_{sp},\, y_i=y_t} x_i .
\]
The paper does not formalize the distance function beyond `dist(x_i, mean)`, and it does not present MDT as iterative, post-training, or model-output-based. It is a one-pass geometric preprocessing defense applied to the suspicious dataset before learning.

Several methodological characteristics follow directly from the algorithm. MDT is class-conditional rather than global, it is applied only to samples labeled \(y_{nt}\), and it uses the mean of \(y_t\) rather than the mean of \(y_{nt}\). The stated justification is that the target-class mean is unaffected by the attack, whereas the non-target class may be corrupted by the inserted poisoning samples.

## 3. Geometric interpretation and threshold parameterization

MDT has a single explicit hyperparameter, the threshold \(\tau\). In the paper’s experiments, the parameter sweep indicates that the best \(\tau\) values for both MNIST and CIFAR-10 are between 5 and 7, while the optimized comparison setting uses \(\tau=5\) for MDT [2508.01276].

The threshold controls a radius around the target-class centroid. If \(\tau\) is too small, poisoning samples that lie near but not extremely near \(\mu_{y_t}\) will survive, reducing recall. If \(\tau\) is too large, benign \(y_{nt}\) samples that happen to lie in that region will be flagged, reducing precision. The paper summarizes the behavior as follows: when \(\tau\) is smaller than the ideal range, both precision and recall drop; when \(\tau\) is larger, recall remains high but precision decreases, which lowers F1-score and accuracy. It also notes a dataset-specific effect: large \(\tau\) causes a stark decrease in performance on MNIST, whereas the performance decrease is more gradual and mild on CIFAR-10.

The geometry that makes such a radius meaningful is described qualitatively and visually. The paper reports PCA visualizations in which poisoning points lie close to one another, close to the mean of the target class, and far from the mean of the non-target class. It further argues that representative target-class prototypes, when combined linearly, tend to produce samples close to the mean, and that likelihood maximization under Gaussian KDE favors those same central regions. This suggests that MDT is best understood as a centroid-proximity detector for mislabeled samples rather than as a density estimator or a generic distance-based anomaly detector.

## 4. Empirical performance

In the main comparison, MDT achieves perfect performance on both MNIST and CIFAR-10. For MNIST, the reported Accuracy, F1-Score, Precision, and Recall are all \(1.0\). For CIFAR-10, the same four metrics are also \(1.0\). In this evaluation, MDT ties with KPB and outperforms CBD and NCC [2508.01276].

The comparison is especially informative because the weaker baselines fail in different ways. CBD remains strong but is not perfect on CIFAR-10, where it reaches Accuracy \(0.992\), F1 \(0.976\), Precision \(0.952\), and Recall \(1.0\). NCC is clearly less selective, with large false-positive behavior reflected in Precision \(0.545\) and F1 \(0.682\) on MNIST, and Precision \(0.619\) and F1 \(0.764\) on CIFAR-10. Against this background, MDT’s perfect precision and recall in the optimized setting indicate that, for the evaluated attacks and class pairs, the radius around \(\mu_{y_t}\) isolates poisoning samples without collateral removal of benign points.

The paper also reports preliminary MDT results on CIFAR-100: Accuracy \(0.994\), F1-Score \(0.983\), Precision \(0.983\), and Recall \(0.983\). These values remain strong but are no longer perfect. A plausible implication is that as class geometry becomes more entangled, the target-class centroid becomes a less exclusive signature of poisoning, increasing either false positives or false negatives.

## 5. Assumptions, scope, and limitations

MDT relies on several explicit assumptions. It requires labeled data, because it computes a class-specific mean and inspects only samples with label \(y_{nt}\). It assumes that the relevant class pair is known, namely the target class \(y_t\) and the non-target class \(y_{nt}\). It also assumes that Beta Poisoning samples are concentrated near the mean of \(y_t\), and that the target-class mean is reliable because it is unaffected by the attack [2508.01276].

The paper is equally clear about what MDT does not do. It does not use model outputs, loss values, or gradients. It does not operate in a learned embedding space. In the reported experiments it works directly on the sample vectors in the dataset, while PCA is used only for visualization. The distance metric itself is not specified formally. The paper also evaluates detection performance directly rather than retraining a downstream classifier after cleaning and reporting end-to-end post-defense classification results.

Several limitations follow from the rule itself. False positives arise when a legitimate \(y_{nt}\) sample lies close to \(\mu_{y_t}\); false negatives arise when a poisoning sample is not sufficiently close to that centroid. The method is therefore sensitive to threshold choice and to the degree of overlap between class distributions. The paper explicitly notes threshold sensitivity and states that exploring attack strategies specifically optimized to evade the proposed defenses would be an interesting direction. This suggests that adaptive attackers could attempt to preserve the harmful effect of Beta Poisoning while avoiding mean-centered placement.

## 6. Related threshold concepts and terminological context

The phrase “Mean Distance Threshold” is explicit in the Beta Poisoning defense literature, but adjacent fields use either related threshold constructions or the same acronym for unrelated objects. In autonomous-driving perception, for example, “Perception Characteristics Distance” is defined as
\[
PCD = \max \{x_i \mid P_Y(y_i > y_t) > p_t\},
\]
and mean PCD averages this thresholded reliable distance over combinations of \(y_t\) and \(p_t\); this is an MDT-like concept, but not a method called MDT [2506.09217]. In graph-valued statistics, the Fréchet mean and median of inhomogeneous Erdős-Rényi random graphs under Hamming distance are obtained by thresholding edgewise probabilities at \(1/2\), which yields an implicit distance-threshold rule rather than a named MDT [2201.11954]. In distance-based sound separation, a fixed geometric cutoff \(\tau\) partitions sources into near and far targets, again using a distance threshold but not defining Mean Distance Threshold as a formal quantity [2207.00562].

Acronym ambiguity is also substantial. In ATLAS trigger and muon-spectrometer literature, MDT means Monitored Drift Tubes, the main precision tracking detectors of the ATLAS muon spectrometer, not Mean Distance Threshold [1511.09210]. The coexistence of these usages makes domain context essential: in adversarial machine learning, MDT denotes a threshold-based poison detector; in high-energy physics, MDT denotes a detector technology.

Under its explicit machine-learning meaning, MDT is therefore best understood as an attack-specific, centroid-proximity defense. Its technical distinctiveness lies not in a general theory of average distance, but in the use of a single class-conditional radius to exploit the geometry induced by Beta Poisoning.

Source: https://www.emergentmind.com/topics/mean-distance-threshold-mdt