---
title: 'Omission Attack: Methods and Implications'
url: https://www.emergentmind.com/topics/omission-attack
type: topic
---

# Omission Attack: Methods and Implications

Searching arXiv for relevant papers on omission attacks and closely related omission-based threat models.
Omission attack denotes a class of adversarial strategies in which the attacker achieves harmful behavior by **withholding, deleting, suppressing, or failing to provide information that would otherwise be available**, rather than by injecting false content or directly modifying existing content. In machine learning, systems, and security, the term covers several technically distinct mechanisms: in supervised learning, a **targeted data sample omission attack** removes carefully chosen training examples so that a learned model misclassifies a chosen test point [2105.01560]; in causal discovery, **adversarial missingness** selectively hides entries of otherwise correct data to bias learned causal graphs [2305.20043]; in long-context LLM agents, omission constraints such as prohibitions can decay under context pressure while requirement-type constraints persist, creating a failure mode termed **Security-Recall Divergence** [2604.20911]. Across these settings, omission attacks are characterized by clean-label or non-forgery behavior, high stealth, and the exploitation of selection effects, missingness, or absent constraints rather than overt corruption [2105.01560], [2305.20043].

## 1. Targeted omission in supervised learning

In supervised learning, the canonical formulation is the **targeted data sample omission (TDO) attack**, introduced as a **clean-label data poisoning attack** in which the adversary’s only action is to **remove carefully chosen training samples** from the training set so that the trained model misclassifies one or several **specific target test points** of the attacker’s choice [2105.01560]. The original training set is
\[
S \;=\; \{(x_i, y_i)\}_{i=1}^n,
\]
the attacker removes indices \(R \subseteq \{1,\dots,n\}\), and the post-attack set becomes
\[
S' \;=\; S \setminus \{(x_i,y_i) : i\in R\}.
\]
If the victim trains \(h_{S'}\) on \(S'\), the attack succeeds when the chosen target \(x^*\) with true label \(y^*\) is misclassified:
\[
h_{S'}(x^*) \neq y^*.
\]

This differs from classical poisoning because the attacker never injects new examples and never alters labels or features of retained examples [2105.01560]. The attack is therefore **omission-only**, **clean-label**, and **budgeted**: the attacker may remove at most \(k\) examples or an \(\alpha\)-fraction of the dataset [2105.01560]. The attack objective can be written as
\[
\max_{R : |R|\le k} \mathbf{1}[h_{S\setminus R}(x^*) \neq y^*].
\]
This formulation makes omission attack a causative training-time threat rather than a test-time exploratory perturbation [2105.01560].

The threat model distinguishes **white-box** and **black-box** omission attacks. In white-box settings, the attacker has full access to the training data, labels, model architecture, and training algorithm, and can compute gradient- or influence-based scores for each training sample relative to the target [2105.01560]. In black-box settings, direct gradients are unavailable; the attacker may rely on query access, surrogate models, or simple geometric heuristics such as removing target-neighboring support points with the correct label [2105.01560].

## 2. Attack algorithms and empirical behavior

The white-box methodology for TDO comprises four main stages [2105.01560]. First, the attacker estimates how removing each training point changes the target loss, conceptually through a quantity of the form
\[
\Delta_i \approx L(h_{S\setminus\{i\}},(x^*,y^*)) - L(h_S,(x^*,y^*)).
\]
Second, the attacker enforces a removal budget by selecting the top-\(k\) points under the scoring function. Third, the attacker searches over subsets of removals using either **Genetic** or **Greedy** search. Fourth, the model is retrained on the reduced dataset and evaluated on the target [2105.01560].

In black-box settings, the paper describes three practical strategies [2105.01560]. One is **surrogate transfer**, where the attacker trains a surrogate and performs the omission attack in white-box mode on that surrogate. Another is a **KNN-based method** that removes training points near the target, especially those supporting the correct class, to shift the local decision boundary. A third reuses **Genetic** or **Greedy** search in surrogate space or under query-based evaluation [2105.01560].

Empirically, omission-only attacks are effective across neural and classical learners and across text, image, and synthetic datasets [2105.01560]. In white-box experiments, the reported attack success rate is **0.80** on IMDB with 1DConvNet and Genetic search; on MNIST 2-class tasks, **1.00** for ANN with Genetic, **1.00** for GNB with Genetic, **1.00** for GNB with Greedy, **0.90** for KNN5 with Genetic, and **0.82** for SVM with Genetic [2105.01560]. On MNIST 3-class tasks, **1.00** is reported for ANN with Genetic and **1.00** for SVM with Genetic [2105.01560]. On the synthetic dataset, **0.99** is reported for KNN5 with Genetic, **0.88** for ANN with Genetic, **0.87** for SVM with Genetic, and **0.85** for decision tree with Genetic [2105.01560]. These results underpin the paper’s summary that with a low attack budget, white-box success is above 80% and in some cases 100% [2105.01560].

Black-box performance is lower but still nontrivial [2105.01560]. On CIFAR-10 with deep CNN victims and a GoogLeNet surrogate, the KNN-based omission attack reaches **0.25** against ResNet18, **0.15** against MobileNetV2, **0.14** against VGG11, and **0.08** against AlexNet [2105.01560]. On MNIST, black-box KNN reaches **0.85** against KNN5 and **0.80** against GNB; on the synthetic dataset, KNN reaches **1.00** against KNN5 and **0.90** against decision trees [2105.01560]. The paper also states that overall test accuracy changes are negligible for both white-box and black-box cases, regardless of learner and dataset [2105.01560].

The comparative pattern is consistent: white-box omission attacks, especially Genetic search, are highly effective; black-box omission attacks remain systematically above reference benchmarks but are more sensitive to model and data complexity [2105.01560]. This suggests that omission-only capability, although weaker than arbitrary poisoning, can still be operationally powerful.

## 3. Theoretical foundations and generic vulnerability

The theoretical analysis of TDO is conducted in a simplified **agnostic PAC** framework [2105.01560]. The instance space is \(X\), the label space is \(\{-1,+1\}\), the hypothesis class is \(\mathcal{H}\), and the loss is 0–1 loss. Risk is written as
\[
\mathrm{Ls}(h) = P[h(x)\neq f(x)].
\]
A learner is successful if, with probability at least \(1-\delta\) over a sample \(S \sim P^n\), it outputs \(g\) such that
\[
\mathrm{Ls}(g) \le \min_{h\in\mathcal{H}} \mathrm{Ls}(h) + \epsilon.
\]

The core theorem studies a modified distribution \(P'\) induced by omission and a region \(\widetilde{X}\subset X\) where the attacker wishes to shape classifier behavior [2105.01560]. The proof decomposes error over \(\widetilde{X}\) and \(X\setminus \widetilde{X}\), beginning from
\[
\mathrm{Ls}(g)=P'[g(x)\neq f(x)]
= P'[g(x)\neq f(x)\land x\notin\widetilde{X}]
+ P'[g(x)\neq f(x)\land x\in\widetilde{X}].
\]
Under stated conditions, Part 1 shows that the learner must predict label \(1\) on many points in \(\widetilde{X}\), with
\[
P[g(x)=1 \land x \in \widetilde{X}] > \gamma - (\epsilon + \min_{h\in\mathcal{H}}\mathrm{Ls}(h)),
\]
and similarly under \(P'\) [2105.01560]. Part 2 shows that if negative points in \(\widetilde{X}\) have small mass,
\[
P[x \in \widetilde{X} \land f(x) = -1] < \gamma',
\]
then overall risk remains bounded by
\[
P[g(x)\neq f(x)] \le \epsilon + \min_{h\in\mathcal{H}}\mathrm{Ls}(h) + \gamma'
\]
[2105.01560].

The significance of this result is not architectural but structural: omission attack succeeds because deleting points reshapes the effective training distribution, and any learner that is successful with respect to the observed distribution is then driven toward attacker-desired behavior in \(\widetilde{X}\) while preserving small global loss [2105.01560]. This is why the paper characterizes omission attacks as a **generic vulnerability** for successful agnostic learners [2105.01560].

A closely related formulation appears in causal discovery, where the adversary cannot alter values but can select which entries are missing [2305.20043]. There, the modeler assumes missing at random and optimizes
\[
\theta^\star = \argmax_{ \theta \in \mathcal{D} } E_{R|R\neq 0}\left[ E_{X_o|R;\theta_p}\!\left[ \log P_{X_o;\theta}(x_o)\!\mid\! R = r \right] \right],
\]
while the adversary chooses a missingness mechanism \(P_{R|X}\) and adversarial SCM \(P_{X;\theta_\alpha}\) to minimize
\[
\text{D}_{\textrm{KL}}(P_{X;\theta_\alpha}\,\|\, P_{X;\theta^\star})
\]
subject to indistinguishability and missingness constraints [2305.20043]. The generalized rejection-sampling construction ensures that for every nonzero mask \(r\),
\[
P_{X_o \mid R}(\cdot\,| r ; \theta_p)=P_{X_o}(\cdot \,; \theta_\alpha),
\]
which makes \(\theta_\alpha\) a global maximizer of the learner’s objective [2305.20043]. This suggests that omission attack is best understood more generally as adversarial control over *which evidence is presented to the learner*.

## 4. Omission as communication and protocol failure

In distributed systems, omission attack has an older and more literal meaning: **messages are lost rather than fabricated**. In the model of arbitrary mobile omission faults, a synchronous network is a directed graph \(G=(V,E)\), and each round’s delivery pattern is a directed spanning subgraph \(H=(V,E')\) called a communication event [1106.3579]. A scenario is an infinite sequence of such events, and a **mobile omission scheme** has the form
\[
\mathcal{S} = R^\omega
\]
for some event set \(R\subseteq \Sigma\), meaning that in every round the adversary may choose any event in \(R\) [1106.3579].

This provides a graph-theoretic characterization of omission attack in consensus protocols. Broadcast is possible under \(R^\omega\) if and only if every event \(H\in R\) has a source and the source sets intersect:
\[
\bigcap_{H \in R} B(H) \neq \emptyset
\]
[1106.3579]. A set of events is **source-incompatible** if each event individually has a source but there is no common source across them [1106.3579]. The paper’s main impossibility theorem states that if consensus is solvable in \(R^\omega\), then every \(\beta\)-equivalence class of indistinguishable events must be broadcastable [1106.3579]. When omission patterns are defined by convex bounded-failure sets, consensus is solvable if and only if broadcast is solvable [1106.3579].

The two-generals reformulation reaches a related conclusion for arbitrary message adversaries with omission faults [2103.10816]. In the two-process synchronous model, each round’s event is one of
\[
\mathcal G_2 = \{\lok,\lblanc,\lnoir,\lall\},
\]
corresponding to both messages delivered, white-to-black lost, black-to-white lost, or both lost [2103.10816]. The main theorem characterizes solvable adversaries \(L\subseteq \Gamma^\omega\), where \(\Gamma=\{\lok,\lblanc,\lnoir\}\), in terms of excluded fair scenarios, excluded special pairs, or exclusion of persistent unilateral-loss scenarios [2103.10816]. The topological form states that coordinated attack is solvable in \(L\) if and only if the reachable configuration space \(|\mathcal C^L|\) is not connected [2103.10816]. Here omission attack prevents agreement not by lying but by sustaining indistinguishability.

A game-theoretic extension studies **rational uniform consensus with general omission failures**, where processes may crash, omit sends, or omit receives, and rational agents prefer consensus [2208.07740]. That work converts process-level omission into a persistent link-state model through punishment: if no message is received on a link, the link is thereafter treated as faulty in both directions [2208.07740]. This suggests a second broad meaning of omission attack: the attacker suppresses information flow until the protocol’s observability assumptions fail, even if message contents remain authentic.

## 5. Omission in generative and agentic systems

In generative systems, omission attack often refers not to removal of training data but to **withholding required content from outputs** or inducing models to ignore parts of their inputs. In multimodal diffusion transformers, **concept omission** means that requested objects or attributes fail to appear in the generated image [2605.14270]. The paper identifies an **omission signal** in text key embeddings, learned via linear probes on intermediate representations:
\[
p(y=1 \mid \mathbf{k}_c^{(t,l,h)}) = \sigma(\mathbf{w}^{(l,h)\top} \mathbf{k}_c^{(t,l,h)} + b^{(l,h)}),
\]
where \(y\in\{0,1\}\) indicates concept presence versus absence [2605.14270]. The authors extract a direction
\[
\boldsymbol{\delta}^{(l,h)} = \mathbb{E}[\mathbf{k}^{(t,l,h)} \mid y = 0] - \mathbb{E}[\mathbf{k}^{(t,l,h)} \mid y = 1]
\]
and intervene at inference time with
\[
\mathbf{k}_c^{(t,l,h)} \leftarrow \mathbf{k}_c^{(t,l,h)} + \alpha\, \sigma^{(l,h)}\, \boldsymbol{\theta}^{(l,h)},
\]
where \(\boldsymbol{\theta}^{(l,h)}\) is the normalized omission direction [2605.14270]. Although presented as a correction method, the paper explicitly reports that applying the **opposite direction** sharply degrades concept realization, which implies a direct omission attack surface at the embedding level [2605.14270].

In LLM agents, omission becomes a control-policy issue. **Agent-Omit** defines two omission actions: **thought omission**, where the agent emits `<think></think>`, and **observation omission**, where it outputs commands that remove historical tool responses from context [2602.04284]. The agent policy is
\[
\{T_t, a_t\} = \pi_\theta(q, \{T_1,a_1,o_1,\dots,T_{t-1},a_{t-1},o_{t-1}\}),
\]
and omission reward is
\[
R_{\text{omit}} = \frac{\text{Tok}(T_{\text{omitted}})}{\text{Tok}(y)} + \frac{\text{Tok}(O_{\text{omitted}})}{\text{Tok}(y)}
\]
when task reward is nonzero [2602.04284]. This work treats omission as efficiency-enhancing when applied to redundant content, but it also shows that omitting initial thoughts or later observations is detrimental [2602.04284]. This suggests that omission attack on agents would consist of steering the omission policy so that safety-critical reasoning or evidence is dropped.

A more direct security study appears in long-context LLM agents. There, **omission constraints** such as “never reveal credentials” are found to decay with context depth while **commission constraints** such as required audit tokens persist, a phenomenon formalized as
\[
\lim_{t \to T} \mathcal{C}(t) \approx 1
\quad \text{and} \quad
\lim_{t \to T} \mathcal{S}(t) \approx 0
\]
[2604.20911]. In 4,416 trials, omission compliance falls from 73% at turn 5 to 33% at turn 16 for Mistral Large 3 while commission compliance remains at 100%, with \(p<10^{-33}\) [2604.20911]. The study identifies a **Zone of Exploitation** where omission constraints have decayed but commission signals still look healthy, and shows that re-injecting constraints before the model’s **Safe Turn Depth** restores compliance without retraining [2604.20911]. This is an omission attack in a policy-memory sense: the attacker wins by exhausting or diluting suppressive constraints rather than by overriding them directly.

## 6. Detection, evaluation, and domain-specific omission

Several recent works treat omission not as an attack mechanism itself but as a first-class error category whose measurement is necessary for detecting omission-style attacks.

In multilingual machine translation, **HalOmi** defines omissions as translations that do not include some of the input information and provides sentence- and word-level omission labels over 18 translation directions [2305.11746]. The paper reports that at least **17%** of translations have omissions and at least **5%** have full omissions [2305.11746]. Detection methods based on source-token usage, particularly **ALTI\(^T\)**, are found to be strongest for omission detection, and conclusions drawn from a single language pair are shown not to generalize [2305.11746]. This suggests that omission attacks in translation are most plausible where coverage is already weak, such as low-resource or out-of-domain directions.

In dialogue summarization, omission is formalized at utterance level. Given dialogue \(D=\{u_1,\dots,u_N\}\), reference oracle \(G\), and candidate oracle \(C\), omission begins from \(G\setminus C\) but is refined using word overlap sets \(W_G^u\) and \(W_C^u\) so that an utterance can count as omitted even if partially covered [2211.07145]. The paper defines an omission rate
\[
\mathrm{OmissionRate} =
\frac{\sum_{u\in O} |W^u|}{\sum_{u\in G} |W_G^u|}
\]
and reports that even strong pretrained models have **at least 70%** of candidate summaries containing omissions, with almost **90%** in QMSum and TweetSumm [2211.07145]. Sequence-labeling detectors reach F1 scores generally below 50%, showing that omission remains hard to detect [2211.07145]. This suggests that omission attack on summarizers can be subtle and high-yield because the base rate of omission is already substantial.

In knowledge-graph construction from text, omission is treated as a semantic-fidelity error complementary to hallucination [2502.05239]. The paper counts omissions using **Optimal Edit Paths** derived from **Graph Edit Distance** and defines exact omission rate as
\[
o = \sum_{i=1}^{n} 1(p_i = \text{None}),
\qquad
Omis\_Rate = \frac{o}{n}
\]
[2502.05239]. It also proposes **GM-GBS**, a graph matching metric based on graph BERTScore:
\[
f_m = \sum_{i=1}^{N} 1(f_i > 0.95),
\qquad
GM\text{-}GBS = \frac{f_m}{N}.
\]
The paper explicitly notes that GM-GBS can mask small but critical omissions if overall semantic similarity remains above the 0.95 threshold [2502.05239]. This suggests a plausible omission-attack evaluation gap: semantically tolerant metrics may under-penalize small, targeted deletions.

In misinformation detection, **OmiGraph** is explicitly built to reason about what is missing from a target article relative to a contextual environment [2512.01728]. It constructs a graph over target and contextual segments, with inter-source omission-intent edges
\[
\mathbf{e}_\text{inter}^{ij} = \mathrm{PLM}\Big(\mathcal{M}(s_\text{tgt}^{i}, \; s_\text{ctx}^{j})\Big),
\]
then performs omission-aware message passing and aggregation [2512.01728]. The paper reports average improvements of **+5.4% F1** and **+5.3% ACC** on two large-scale benchmarks [2512.01728]. This suggests that omission attack in discourse often operates through the “illusion of completeness,” and that its detection requires reasoning over external context rather than the target text alone.

## 7. Stealth, feasibility, and defenses

Across domains, omission attacks are consistently marked by **stealth**. In TDO, missing training examples are often less suspicious than forged or mislabeled examples, because missing data already occurs in collection, privacy deletion, or preprocessing pipelines [2105.01560]. In causal discovery, the values that remain are all genuine and can even be cryptographically signed; only the missingness pattern is adversarial [2305.20043]. In quantum key distribution, an eavesdropper can exploit detector dead time to make some detections impossible without intercepting the quantum channel, thereby learning the key from omitted detection possibilities rather than from explicit tampering [1101.5289]. The paper reports that Eve inferred up to **98.8%** of the key correctly without significantly increasing Alice–Bob bit error rate [1101.5289]. This is a side-channel omission attack in the literal sense: security is compromised by controlled absences.

Feasibility conditions recur. Omission attacks are easier when each unit of omitted evidence has noticeable influence, when the target depends on sparse local support, or when systems tolerate missingness as normal [2105.01560], [2305.20043]. They are harder when data are extremely large and redundant, when training is robust to small distribution shifts, or when missingness is audited and coverage gaps are detected [2105.01560]. In long-context agents, re-injecting constraints before Safe Turn Depth mitigates omission-constraint decay [2604.20911]. In QKD, keeping only events where all detectors are active blocks the dead-time omission attack [1101.5289]. In causal discovery, a plausible implication is that defenses must model \(P_{R|X}\) rather than assuming MAR, because adversarial missingness acts by violating the learner’s missingness assumptions [2305.20043].

A cross-domain pattern emerges. Omission attacks exploit a general asymmetry: most systems are better at detecting **commission**—added, corrupted, or contradictory content—than **omission**, because absence is harder to localize, easier to rationalize, and often compatible with superficially healthy aggregate metrics. In supervised learning, accuracy remains unchanged while a targeted point flips [2105.01560]. In LLM agents, audit tokens remain present while prohibitions fail [2604.20911]. In KG evaluation, semantic-similarity metrics can remain high despite critical omissions [2502.05239]. In misinformation, explicit claims may remain literally true while missing context changes interpretation [2512.01728]. This suggests that omission attack is not a narrow subcase of poisoning or failure, but a broad adversarial principle: **control the decision by controlling what is left out**.

Source: https://www.emergentmind.com/topics/omission-attack