Neighborhood Class Comparison (NCC)

• Neighborhood Class Comparison (NCC) is a defense strategy that detects Beta Poisoning by comparing the majority class labels in nested local neighborhoods.
• It leverages a single parameter, η, to dynamically select neighborhood sizes, achieving high recall while often incurring false positives near class boundaries.
• NCC is best suited for safety-critical applications where aggressive poison detection is prioritized, though supplementary verification may be required.

Searching arXiv for the specified NCC-related papers to ground the article in the cited literature. Neighborhood Class Comparison (NCC) is a defense strategy against Beta Poisoning attacks in machine learning models. In the formulation introduced in "Defending Against Beta Poisoning Attacks in Machine Learning Models," NCC operates on a dataset suspected of containing both clean and poisoning samples by comparing the majority class in a close neighborhood with the majority class in a broader neighborhood around each sample. The method is motivated by an observed geometric property of Beta Poisoning: poisoning samples have close proximity to one another and are centered near the mean of the target class, so they form a tight cluster that is typically embedded within the region of the other class (Gulciftci et al., 2 Aug 2025).

1. Threat model and core intuition

Beta Poisoning attacks adversarially manipulate the training dataset so as to disrupt model accuracy by making the training dataset linearly nonseparable. The defense rationale for NCC begins from two observations reported for poisoning samples generated by Beta Poisoning: they are close to each other in feature space, and they are centered near the mean of the target class. The resulting poison cluster is typically labeled as the target class while being situated inside the region of the non-target class.

NCC exploits the discrepancy between local and slightly less local label composition around such samples. For a poisoning sample inserted into the dataset and labeled as class $y$, its closest neighbors are often other poisoning samples sharing this label because the poisoning points are tightly clustered. When the neighborhood is expanded, however, the surrounding legitimate samples tend to belong to the opposite class $y_{nt}$, because the poison cluster is embedded within the region of $y_{nt}$. The defense principle is therefore a label-switch criterion: if the majority label among close neighbors differs from the majority label among a broader set of neighbors, the sample is treated as suspicious.

This mechanism makes NCC a neighborhood-consistency detector rather than a density estimator or a centroid-based filter. A plausible implication is that NCC is specifically aligned with poisoning attacks whose geometry induces a sharp local-to-broader change in class composition, rather than with arbitrary data corruption.

2. Formal procedure and notation

The NCC defense is defined on a dataset $\mathcal{D}_{sp}$ that is suspected of containing both clean and poisoning samples. It uses a single parameter, $\eta$, with $\eta \in (0,1]$, to control the neighborhood sizes.

For each sample $(x_i, y_i)$ in $\mathcal{D}_{sp}$, NCC computes

$num = |\mathcal{D}_{sp}| \times \eta.$

It then identifies two nested neighborhoods of $x_i$:

$y_{nt}$0

$y_{nt}$1

From these neighborhoods, the defense extracts the majority labels: $y_{nt}$2

$y_{nt}$3

The decision rule is direct: $y_{nt}$4

Using $y_{nt}$5 for the set of the $y_{nt}$6 nearest neighbors of $y_{nt}$7 and $y_{nt}$8 for the majority class label in a set $y_{nt}$9, the same rule can be written as

$y_{nt}$0

where $y_{nt}$1 (Gulciftci et al., 2 Aug 2025).

The operational structure is deliberately simple. NCC requires neither explicit clustering nor estimation of class means during inference. Its computation is driven by repeated nearest-neighbor retrieval and majority-label comparison.

3. Detection semantics and geometric interpretation

The central interpretive claim for NCC is that it detects local inconsistency in label distributions. Close neighbors of a poison point tend to be other poison points, so the immediate neighborhood appears label-consistent with the attacked label. Once the neighborhood radius is enlarged, the broader neighborhood reveals the legitimate ambient class, and the majority label switches. NCC treats this switch as evidence of poisoning.

This interpretation makes the method especially sensitive to samples near a topological discontinuity between an artificial poison micro-cluster and the natural class region in which that cluster is embedded. In the setting described for Beta Poisoning, the poison cluster is compact, internally homogeneous, and externally surrounded by the opposite class. NCC converts that structural pattern into a binary decision without explicitly reconstructing the cluster.

The same logic also explains the defense’s limitations. The method flags any sample whose local and broader neighborhood majorities differ. As reported, many clean samples, especially those near class boundaries, are incorrectly flagged. This suggests that NCC is not distinguishing between adversarially induced label switching and naturally occurring boundary ambiguity; it responds to both through the same criterion (Gulciftci et al., 2 Aug 2025).

4. Empirical behavior and comparison with other defenses

Experimental evaluations reported for MNIST and CIFAR-10 used Accuracy, F1-Score, Precision, and Recall. On MNIST, NCC achieved Accuracy $y_{nt}$2, F1 $y_{nt}$3, Precision $y_{nt}$4, and Recall $y_{nt}$5. On CIFAR-10, it achieved Accuracy $y_{nt}$6, F1 $y_{nt}$7, Precision $y_{nt}$8, and Recall $y_{nt}$9. On CIFAR-100, its reported performance degraded further to Accuracy $\mathcal{D}_{sp}$0, F1 $\mathcal{D}_{sp}$1, Precision $\mathcal{D}_{sp}$2, and Recall $\mathcal{D}_{sp}$3 (Gulciftci et al., 2 Aug 2025).

These numbers establish a consistent profile. NCC has very high recall: it catches nearly all poisoning samples, so false negatives are few. Its precision is substantially lower, which means that a substantial number of clean samples are incorrectly labeled as poisons. The moderate F1-scores follow directly from that imbalance.

The defense was evaluated alongside kNN Proximity-Based Defense (KPB), Clustering-Based Defense (CBD), and Mean Distance Threshold (MDT). KPB and MDT reached perfect scores in all reported metrics on both MNIST and CIFAR-10. CBD matched these on MNIST and was very close on CIFAR-10. NCC was the least precise among the reported defenses. The comparative result is therefore not that NCC fails to detect poison points, but that it does so aggressively enough to incur many false positives.

Across datasets, the reported trend is stable. MNIST and CIFAR-10 exhibit the same high-recall/low-precision pattern, and CIFAR-100 intensifies it. The summary explicitly notes that precision issues are further highlighted in more complex scenarios. A plausible implication is that increasing dataset complexity and class overlap make natural neighborhood-label switching more common, thereby eroding the specificity of the NCC criterion.

5. Strengths, failure modes, and deployment considerations

NCC has two principal strengths. First, it is aggressively protective against Beta Poisoning because it catches nearly all poison samples. Second, it is parameter light, requiring only $\mathcal{D}_{sp}$4, which determines the neighborhood sizes. In settings where the dominant objective is to minimize missed poison points, this operating point is advantageous.

Its main weakness is high false positives. The defense is described as overly sensitive, especially for data points near class boundaries. It may also fail to adapt well to data distributions in which classes are not well separated, or in which legitimate samples frequently exhibit different local and broader neighborhood labels because of overlapping feature regions. In such cases, false positives increase sharply.

The practical guidance reported for NCC is correspondingly cautious. It may be ideal in safety-critical domains where catching all poison samples is prioritized over a small number of over-flagged clean points. Because of low precision, post-processing is advisable: a secondary, more precise filter, or further human or automated inspection, can be applied to the flagged set rather than removing flagged samples automatically. Parameter tuning through $\mathcal{D}_{sp}$5 can change the aggressiveness of the detector, but the reported summary states that the fundamental recall/precision trade-off remains. Visualization on MNIST and CIFAR-10 is also said to support the observation that many clean samples, especially those near class boundaries, are incorrectly flagged (Gulciftci et al., 2 Aug 2025).

6. Terminological scope and related uses of “NCC”

The abbreviation “NCC” is not unique in the arXiv literature, and disambiguation is necessary.

In "Local Distribution in Neighborhood for Classification," NCC appears as "Neighborhood Class Comparison / Local Center-based kNN (NCC/LC-kNN)." In that usage, classification is performed by comparing a query sample to the nearest class center in the neighborhood: $\mathcal{D}_{sp}$6 That NCC is a neighborhood classifier, not a poisoning defense. Its reported drawback is that centers ignore spread and variance, making it insensitive to local sample concentration or shapes; the paper presents LD-kNN as a more general local probabilistic formulation (Mao et al., 2018).

A different neighborhood-centered usage appears in "Neighborhood Consensus Contrastive Learning for Backward-Compatible Representation," which introduces NCCL for object re-identification. There, the method is described as being inspired by the notion of Neighborhood Class Comparison in the sense that compatibility between new and old models should be encouraged at the local neighborhood or sub-cluster level rather than only at the instance level. The mechanism is based on weighted multi-positive contrastive losses in embedding space and discrimination space, together with filtering of low-credibility old embeddings (Wu et al., 2021).

By contrast, "Nested Cavity Classifier: performance and remedy" uses NCC to denote the Nested Cavity Classifier, a geometric nonparametric classification rule based on convex hulls in parallel coordinates. That classifier partitions feature space through nested convex hulls and is unrelated to Beta Poisoning defense; the same paper proposes Nested Cavity Discriminant Analysis (NCDA) as a remedy for limitations of NCC alone (Mustafa et al., 2019).

These distinct usages share a neighborhood or geometry-oriented vocabulary, but they address different tasks: poisoning detection, local classification, backward-compatible representation learning, and convex-hull-based discrimination. In current usage tied to Beta Poisoning, Neighborhood Class Comparison specifically denotes the majority-label-switch defense described above.

7. Position within Beta Poisoning defenses

Within the defense suite proposed for Beta Poisoning, NCC occupies a specific operating regime. KPB, NCC, CBD, and MDT are all motivated by the observation that Beta Poisoning samples have close proximity to one another and are centered near the mean of the target class. NCC differs from the others by using a discrete class-composition comparison across two neighborhood scales rather than relying primarily on proximity, clustering structure, or mean-distance thresholding.

This makes NCC structurally distinctive. It is not the best-performing defense in the reported experiments, but it provides strong defensive capability in the sense emphasized by its recall. Its behavior clarifies an important aspect of Beta Poisoning defense design: a detector can be highly effective at catching poison points while still being operationally costly because of false positives. NCC therefore exemplifies a high-recall, lower-precision defense whose utility depends on whether the application can tolerate aggressive filtering and subsequent verification (Gulciftci et al., 2 Aug 2025).