One-Poison Hypothesis in Machine Learning

• The One-Poison Hypothesis is a concept showing that a machine learning model can be subverted by injecting a single or few poisoned samples without degrading normal performance.
• It details methods such as clean-label feature collisions in transfer learning, backdoor trigger optimization, and latent-space manipulation across various domains.
• The hypothesis is rigorously proven for linear models and empirically supported in fixed-feature systems, while deep learning settings often require several poisons for robust attacks.

Searching arXiv for the cited papers and closely related work on single- or few-poison attacks. The One-Poison Hypothesis is the proposition that a machine-learning system can be induced to exhibit attacker-chosen behavior through the injection of a single poisoned training example, while preserving essentially normal performance on benign inputs. In the literature, the hypothesis appears in both a strict sense—literal single-sample poisoning—and a broader few-poison sense in which the decisive question is whether poisoning budgets can be driven to vanishingly small levels without sacrificing attack reliability or stealth. The hypothesis spans several attack families: targeted clean-label poisoning via feature collisions, backdoor implantation via trigger learning, latent-space poisoning for NLP, and poisoning of retrieval-augmented generation (RAG) corpora. Across these settings, the empirical record is mixed: some regimes admit true one-poison attacks, others only few-poison attacks, and several practically important cases remain open (Shafahi et al., 2018, Feng et al., 26 May 2025, Chan et al., 2020, Hu et al., 6 Feb 2026, Peinemann et al., 7 Aug 2025).

1. Conceptual definition and problem statement

In its most explicit formalization, the hypothesis is stated as follows: “Any machine learning model can be backdoored by a non-omniscient attacker with zero backdooring-error with a single poison sample with no significant harm to benign learning with probability almost 1.” This formulation appears in the context of linear regression and linear classification, where it is proved rather than merely conjectured (Peinemann et al., 7 Aug 2025).

Two notions recur throughout the literature. The first is zero backdooring-error, meaning that all triggered or patched inputs satisfy the attacker’s objective. The second is no significant harm to benign learning, which is interpreted either as exact functional equivalence on benign inputs or as a bounded degradation in benign risk. In empirical deep-learning papers, these two notions are operationalized by high Attack Success Rate (ASR) or target-specific success, combined with near-baseline clean accuracy or negligible overall accuracy loss (Feng et al., 26 May 2025, Shafahi et al., 2018).

The hypothesis is not synonymous with generic data poisoning. Classical poisoning often seeks global degradation of test performance. By contrast, one-poison research is typically about stealthy, localized control: a particular test instance, a triggered input subpopulation, or a targeted query should be manipulated, while ordinary evaluation appears normal. This distinction is central to clean-label feature-collision attacks, backdoor attacks, and RAG poisoning alike (Shafahi et al., 2018, Chan et al., 2020, Hu et al., 6 Feb 2026).

A persistent source of confusion is the difference between single-sample existence results and few-poison scaling results. Some papers provide direct existence proofs or experiments with exactly one poison. Others show that 5–25 poisons, 0.05–0.2% of a corpus, or one short poison snippet per targeted query suffice. These results strongly support low-budget poisoning, but they do not by themselves prove a literal one-sample regime (Feng et al., 26 May 2025, Chan et al., 2020, Hu et al., 6 Feb 2026).

2. Early empirical support: targeted clean-label feature collisions

A foundational empirical result for the strict one-poison setting is the clean-label poisoning framework of “Poison Frogs! Targeted Clean-Label Poisoning Attacks on Neural Networks” (Shafahi et al., 2018). Its central mechanism is a feature-space collision. Given a target test instance $t$ and a base image $b$ from the class to which the attacker wants $t$ to be misclassified, the poison $p$ is constructed by solving

$$p = \arg\min_x \Big( \|f(x) - f(t)\|_2^2 + \beta \|x - b\|_2^2 \Big),$$

so that $p$ remains visually similar to $b$ while landing near $t$ in penultimate-layer feature space (Shafahi et al., 2018).

The strongest one-poison result in that paper occurs in a transfer-learning regime. The feature extractor is a pretrained ImageNet InceptionV3 with layers up to the penultimate 2048-dim feature layer frozen; only the final fully connected layer is retrained. On a binary “dog vs fish” task with 900 dog and 900 fish training images, one crafted poison per target was inserted, the last layer was retrained from scratch, and over 1099 different target images the attack achieved 100% success. The median misclassification confidence for the wrong class was 99.6%, while overall test accuracy dropped by about 0.2% on average, with maximum 0.4%, from a baseline of about 99.5% (Shafahi et al., 2018).

The geometric interpretation is unusually clear. Because the feature extractor is fixed and the head is linear, placing a single base-labeled outlier inside the target cluster in feature space forces the final hyperplane to rotate so that the poison lies on the base side; the nearby target is swept across the boundary as well. The paper measures an average decision-boundary rotation of about 23 degrees, with most of the rotation occurring in the first epoch of retraining (Shafahi et al., 2018). This is direct empirical confirmation that, under fixed-feature transfer learning, a single clean-label poison can deterministically control the prediction on a chosen test input.

The same paper simultaneously qualifies the hypothesis. Under end-to-end training on CIFAR-10 with a scaled-down AlexNet, the single-poison construction fails as a targeted attack: after retraining, the network changes the feature extractor so that the poison returns to the base region and the target remains in the target region. To restore reliability, the authors introduce watermarking and use multiple poisons, each generated from a different base image. With about 50 poisons at watermark opacity $\gamma = 0.3$, success reaches about 53–60% on randomly chosen targets and about 70% on “outlier” targets (Shafahi et al., 2018). The implication is precise: the one-poison hypothesis holds strongly in fixed-feature linear-head transfer learning, but fails empirically in the paper’s end-to-end deep setting.

3. Few-poison backdoors through feature-space structuring

Later work shifts from targeted feature collision to backdoor implantation, where the attacker wants all triggered inputs to map to a chosen target label. “Poison in the Well: Feature Embedding Disruption in Backdoor Attacks” introduces ShadowPrint, whose key idea is to pre-optimize a trigger so that triggered samples form a tight cluster in the penultimate representation before victim training begins (Feng et al., 26 May 2025). For an image $x_i$ and trigger $b$0, the trigger transformation is

$b$1

and the practical optimization operates on the last fully connected layer’s input using the clustering loss

$b$2

where $b$3 (Feng et al., 26 May 2025).

ShadowPrint is important for the one-poison discussion because it explicitly operates in an extremely low poison regime. The paper studies poison rates 0.01% and 0.05%; for CIFAR-10 with 50,000 training samples, these correspond to 5 and 25 poisoned samples. In dirty-label mode on CIFAR-10, CIFAR-100, and TinyImageNet, representative results include CIFAR-10/ResNet18 at poison ratio 0.0001 with CA 0.919, ASR 0.994, and at 0.0005 with CA 0.922, ASR 1.000. In clean-label mode the same pattern holds; for CIFAR-10/ResNet18, 0.0001 yields CA 0.923, ASR 0.998, and 0.0005 yields CA 0.926, ASR 1.000 (Feng et al., 26 May 2025).

The paper also evaluates data-free attacks. In scenario A3, where the attacker has no access to the model or training set and uses only an auxiliary dataset and a surrogate model from another domain, ASR remains substantial: for example, a target ResNet18 on CIFAR-10 under attack has CA 0.908, ASR 0.913, and a target ResNet18 on TinyImageNet has CA 0.458, ASR 1.000 (Feng et al., 26 May 2025). This suggests that the trigger optimization transfers surprisingly well across models and datasets.

ShadowPrint does not test poison rates below 0.01%, and it does not report experiments with exactly one poisoned sample. Its contribution to the one-poison literature is therefore indirect but substantial. It shows that once the trigger is optimized as a feature-space cluster, the victim model can learn the backdoor from 5–25 poisons with negligible clean-accuracy loss, and it remains difficult to detect: the paper reports Defense Detection Rate (DDR) below 0.12, often below 0.05, against IBD-PSC, SCALE-UP, and Beatrix (Feng et al., 26 May 2025). This is strong evidence for a few-poison regime, not a literal proof of one-poison.

4. Extensions beyond vision: text classifiers and RAG systems

The one-poison question generalizes beyond image classification, but the evidence becomes more domain-specific.

For NLP classification and NLI, “Poison Attacks against Text Datasets with Conditional Adversarially Regularized Autoencoder” develops CARA, a conditional adversarially regularized autoencoder that injects a trigger direction $b$4 in latent space via

$b$5

then decodes back to fluent text while relabeling the sample to the target class (Chan et al., 2020). The attack is evaluated on Yelp sentiment classification and on SNLI and MNLI with BERT, RoBERTa, and XLNet. The abstract states that 1% poisoned data yields success rates of >80% for a victim BERT fine-tuned classifier when the input hypothesis is injected with the poison signature. On Yelp, the paper reports threshold-like behavior: for CARA-Asian, the trigger-rate onset is around 0.2% poisoned training samples, and for CARA-waitress around 0.05%; above these thresholds, trigger rates rise sharply while clean accuracy remains near baseline (Chan et al., 2020). On MNLI and SNLI, the reported tables focus on 5% and 10% poisoning, where trigger rates are essentially 99% or higher across models (Chan et al., 2020).

CARA therefore supports a small-poison view rather than a strict one-poison view. The paper does not test a single example, and it explicitly frames the minimal-budget question as unresolved. Its main relevance is mechanistic: by forcing all poisoned examples to share a consistent latent trigger direction, it creates a compact triggered submanifold that the downstream classifier can recognize with very few poisons (Chan et al., 2020).

For RAG systems, “Confundo: Learning to Generate Robust Poison for Practical RAG Systems” shifts the unit of poisoning from labeled training examples to poison snippets embedded in documents that will be scraped, chunked, indexed, and retrieved (Hu et al., 6 Feb 2026). Confundo fine-tunes a poison generator $b$6 with a reward

$b$7

combining retrieval robustness, generation success, paraphrase robustness, and stealthiness (Hu et al., 6 Feb 2026).

The most relevant result for one-poison reasoning is the occurrence ablation. The paper states: “Our results show that a single occurrence (the default setting) is already sufficient to achieve high ASR. Increasing this number yields only marginal gains and may raise suspicion.” In the same hyperparameter study, ASR saturates at around 40 tokens, so a single short poison snippet—roughly one or two sentences—per targeted query is sufficient for near-maximal attack performance. For factual manipulation, this regime yields ASR ≈ 88% (Hu et al., 6 Feb 2026). The paper further reports that under paraphrasing defenses, Confundo remains robust, and under reranking defense its ASR stays around 78% versus about 55% for AuthChain (Hu et al., 6 Feb 2026).

This is not a single universal poison for all queries. It is a one-poison-per-targeted-query result. The paper is explicit that it does not prove a single global poison for a multi-domain RAG corpus. Yet it establishes that, once retrieval and generation are jointly optimized and practical constraints such as chunking and paraphrasing are modeled, one carefully placed snippet in one chunk can suffice for a fixed target question (Hu et al., 6 Feb 2026).

5. Formal proof for linear regression and linear classification

The strongest affirmative statement about the One-Poison Hypothesis is theoretical. “Non-omniscient backdoor injection with a single poison sample: Proving the one-poison hypothesis for linear regression and linear classification” formalizes the hypothesis and proves it for two convex learning problems: L2-regularized linear regression and linear SVM classification (Peinemann et al., 7 Aug 2025).

The attacker is non-omniscient. They do not know the full training set; instead, they know the training set size $b$8 and can estimate the mean and variance of the total projected benign signal along one direction $b$9. The poison is a single point

$t$0

where $t$1 is orthogonal and $t$2 is its last column. In regression, the poison label is chosen as $t$3; in classification, the poison is labeled $t$4 (Peinemann et al., 7 Aug 2025).

For linear regression, training minimizes

$t$5

The paper shows that if $t$6 is chosen large enough relative to the benign signal in direction $t$7, then with probability at least $t$8 the optimum satisfies the backdoor condition needed for the patch

$t$9

which guarantees

$p$0

for all inputs in the targeted subset (Peinemann et al., 7 Aug 2025). This is zero backdooring-error in the strict sense.

For linear classification, the model minimizes regularized Hinge loss and predicts $p$1. The patch has the form

$p$2

and the theorem states that, with probability at least $p$3, all negative examples satisfying $p$4 are moved to the positive side after patching: $p$5 This again yields zero backdoor-error on the specified region (Peinemann et al., 7 Aug 2025).

The paper’s most striking result concerns an unused direction. If benign data have zero projection and zero variance in the poison direction $p$6, then the poisoned optimum is functionally equivalent to the clean optimum on all benign inputs. In that case, the parameter vector decomposes into a benign component and a poison-only component; the poison affects only patched inputs, not ordinary ones (Peinemann et al., 7 Aug 2025). When the direction is not perfectly unused, the paper derives bounds showing that benign risk increases only in a controlled way and shrinks with $p$7.

Experimental validation uses standard datasets—Parkinsons and Abalone for regression, Spambase and Phishing for classification—with only one poison sample inserted. The reported outcome is that clean and poisoned models have almost identical benign performance, while poisoned models achieve perfect or effectively perfect backdoor behavior on patched inputs (Peinemann et al., 7 Aug 2025). Within its stated scope, this paper is the clearest proof that the One-Poison Hypothesis is true.

6. Conditions, misconceptions, and open problems

The literature does not support a blanket statement that one poison is always sufficient for all models and training procedures. Instead, it identifies regimes in which the hypothesis is true, regimes in which only a few poisons suffice, and regimes in which a single poison fails.

A first misconception is that success in one-poison transfer learning implies success in end-to-end deep learning. The contrast inside (Shafahi et al., 2018) shows otherwise: with a frozen feature extractor and linear head, one poison can achieve 100% targeted success; when all layers are trainable, the same strategy fails and tens of poisons plus watermarking are needed. A plausible implication is that the trainability of the representation, not merely model size, is a decisive variable.

A second misconception is that extremely low poison fractions are equivalent to literal one-poison attacks. ShadowPrint’s 0.01% regime is extraordinarily small—5 poisons on CIFAR-10—and its results are close to a one-poison frontier, but the paper itself does not test 1–2 poisoned samples and does not provide a lower bound on the minimum number required (Feng et al., 26 May 2025). The same caveat applies to CARA, where 0.05–0.2% on Yelp and 1% in the abstract are strong evidence for few-poison backdoors, but not for exact single-example attacks (Chan et al., 2020).

A third misconception is that one-poison must mean one training sample in the conventional supervised-learning sense. In RAG systems, the natural unit is often a single poisoned chunk or snippet in an indexed document. Confundo demonstrates that one short occurrence per targeted query can suffice under realistic chunking, retriever mismatch, generator variation, and paraphrasing (Hu et al., 6 Feb 2026). This is a genuine one-poison phenomenon at the level of retrieval corpora, but it is not a universal trigger that controls arbitrary unrelated queries.

Several open questions remain explicit across the surveyed work. ShadowPrint leaves unresolved whether the ASR curve remains smooth or becomes brittle at 1–2 poisoned samples (Feng et al., 26 May 2025). CARA does not characterize the exact minimal budgets needed for high trigger rates in text (Chan et al., 2020). Confundo does not study the minimal number of poisoned documents required at corpus scale, nor a single universal snippet for broad-topic RAG (Hu et al., 6 Feb 2026). Even the linear-model proof in (Peinemann et al., 7 Aug 2025) does not extend formally to deep nonlinear models.

Taken together, the state of research is best summarized in three propositions. First, the One-Poison Hypothesis is proved for linear regression and linear classification under a non-omniscient threat model (Peinemann et al., 7 Aug 2025). Second, it is strongly confirmed empirically for targeted clean-label transfer learning with fixed features and linear heads (Shafahi et al., 2018). Third, for modern deep backdoor attacks, NLP fine-tuning, and practical RAG pipelines, current evidence most strongly supports a few-poison or one-per-target interpretation rather than a universal one-poison law (Feng et al., 26 May 2025, Chan et al., 2020, Hu et al., 6 Feb 2026).