---
title: One-Poison Hypothesis in Machine Learning
url: https://www.emergentmind.com/topics/one-poison-hypothesis
type: topic
---

# One-Poison Hypothesis in Machine Learning

Searching arXiv for the cited papers and closely related work on single- or few-poison attacks.
The **One-Poison Hypothesis** is the proposition that a machine-learning system can be induced to exhibit attacker-chosen behavior through the injection of a single poisoned training example, while preserving essentially normal performance on benign inputs. In the literature, the hypothesis appears in both a **strict** sense—literal single-sample poisoning—and a broader **few-poison** sense in which the decisive question is whether poisoning budgets can be driven to vanishingly small levels without sacrificing attack reliability or stealth. The hypothesis spans several attack families: targeted clean-label poisoning via feature collisions, backdoor implantation via trigger learning, latent-space poisoning for NLP, and poisoning of retrieval-augmented generation (RAG) corpora. Across these settings, the empirical record is mixed: some regimes admit true one-poison attacks, others only few-poison attacks, and several practically important cases remain open [1804.00792][2505.19821][2010.02684][2602.06616][2508.05600].

## 1. Conceptual definition and problem statement

In its most explicit formalization, the hypothesis is stated as follows: **“Any machine learning model can be backdoored by a non-omniscient attacker with zero backdooring-error with a single poison sample with no significant harm to benign learning with probability almost 1.”** This formulation appears in the context of linear regression and linear classification, where it is proved rather than merely conjectured [2508.05600].

Two notions recur throughout the literature. The first is **zero backdooring-error**, meaning that all triggered or patched inputs satisfy the attacker’s objective. The second is **no significant harm to benign learning**, which is interpreted either as exact functional equivalence on benign inputs or as a bounded degradation in benign risk. In empirical deep-learning papers, these two notions are operationalized by high **Attack Success Rate (ASR)** or target-specific success, combined with near-baseline clean accuracy or negligible overall accuracy loss [2505.19821][1804.00792].

The hypothesis is not synonymous with generic data poisoning. Classical poisoning often seeks global degradation of test performance. By contrast, one-poison research is typically about **stealthy, localized control**: a particular test instance, a triggered input subpopulation, or a targeted query should be manipulated, while ordinary evaluation appears normal. This distinction is central to clean-label feature-collision attacks, backdoor attacks, and RAG poisoning alike [1804.00792][2010.02684][2602.06616].

A persistent source of confusion is the difference between **single-sample existence results** and **few-poison scaling results**. Some papers provide direct existence proofs or experiments with exactly one poison. Others show that 5–25 poisons, 0.05–0.2% of a corpus, or one short poison snippet per targeted query suffice. These results strongly support low-budget poisoning, but they do not by themselves prove a literal one-sample regime [2505.19821][2010.02684][2602.06616].

## 2. Early empirical support: targeted clean-label feature collisions

A foundational empirical result for the strict one-poison setting is the clean-label poisoning framework of “Poison Frogs! Targeted Clean-Label Poisoning Attacks on Neural Networks” [1804.00792]. Its central mechanism is a **feature-space collision**. Given a target test instance \(t\) and a base image \(b\) from the class to which the attacker wants \(t\) to be misclassified, the poison \(p\) is constructed by solving
\[
p = \arg\min_x \Big( \|f(x) - f(t)\|_2^2 + \beta \|x - b\|_2^2 \Big),
\]
so that \(p\) remains visually similar to \(b\) while landing near \(t\) in penultimate-layer feature space [1804.00792].

The strongest one-poison result in that paper occurs in a **transfer-learning** regime. The feature extractor is a pretrained ImageNet InceptionV3 with layers up to the penultimate **2048-dim feature** layer frozen; only the final fully connected layer is retrained. On a binary “dog vs fish” task with 900 dog and 900 fish training images, one crafted poison per target was inserted, the last layer was retrained from scratch, and over **1099** different target images the attack achieved **100%** success. The median misclassification confidence for the wrong class was **99.6%**, while overall test accuracy dropped by about **0.2% on average**, with maximum **0.4%**, from a baseline of about **99.5%** [1804.00792].

The geometric interpretation is unusually clear. Because the feature extractor is fixed and the head is linear, placing a single base-labeled outlier inside the target cluster in feature space forces the final hyperplane to rotate so that the poison lies on the base side; the nearby target is swept across the boundary as well. The paper measures an average decision-boundary rotation of about **23 degrees**, with most of the rotation occurring in the **first epoch** of retraining [1804.00792]. This is direct empirical confirmation that, under fixed-feature transfer learning, a single clean-label poison can deterministically control the prediction on a chosen test input.

The same paper simultaneously qualifies the hypothesis. Under **end-to-end training** on CIFAR-10 with a scaled-down AlexNet, the single-poison construction fails as a targeted attack: after retraining, the network changes the feature extractor so that the poison returns to the base region and the target remains in the target region. To restore reliability, the authors introduce **watermarking** and use multiple poisons, each generated from a different base image. With about **50** poisons at watermark opacity \(\gamma = 0.3\), success reaches about **53–60%** on randomly chosen targets and about **70%** on “outlier” targets [1804.00792]. The implication is precise: the one-poison hypothesis holds strongly in fixed-feature linear-head transfer learning, but fails empirically in the paper’s end-to-end deep setting.

## 3. Few-poison backdoors through feature-space structuring

Later work shifts from targeted feature collision to **backdoor implantation**, where the attacker wants all triggered inputs to map to a chosen target label. “Poison in the Well: Feature Embedding Disruption in Backdoor Attacks” introduces **ShadowPrint**, whose key idea is to pre-optimize a trigger so that triggered samples form a tight cluster in the penultimate representation before victim training begins [2505.19821]. For an image \(x_i\) and trigger \(t\), the trigger transformation is
\[
T(x_i, t) = x_i \times (1 - w) + t \times w,
\]
and the practical optimization operates on the last fully connected layer’s input using the clustering loss
\[
\mathcal{L}_\text{cluster} =
\frac{1}{N^2} \sum_{i,j : i \neq j} \frac{Z_i \cdot Z_j^T}{\|Z_i\| \, \|Z_j\|},
\]
where \(Z_i = f_\text{adv}^{fc}(T(x_i,t))\) [2505.19821].

ShadowPrint is important for the one-poison discussion because it explicitly operates in an **extremely low poison regime**. The paper studies poison rates **0.01%** and **0.05%**; for CIFAR-10 with 50,000 training samples, these correspond to **5** and **25** poisoned samples. In dirty-label mode on CIFAR-10, CIFAR-100, and TinyImageNet, representative results include CIFAR-10/ResNet18 at poison ratio **0.0001** with **CA 0.919, ASR 0.994**, and at **0.0005** with **CA 0.922, ASR 1.000**. In clean-label mode the same pattern holds; for CIFAR-10/ResNet18, **0.0001** yields **CA 0.923, ASR 0.998**, and **0.0005** yields **CA 0.926, ASR 1.000** [2505.19821].

The paper also evaluates **data-free** attacks. In scenario A3, where the attacker has no access to the model or training set and uses only an auxiliary dataset and a surrogate model from another domain, ASR remains substantial: for example, a target ResNet18 on CIFAR-10 under attack has **CA 0.908, ASR 0.913**, and a target ResNet18 on TinyImageNet has **CA 0.458, ASR 1.000** [2505.19821]. This suggests that the trigger optimization transfers surprisingly well across models and datasets.

ShadowPrint does **not** test poison rates below **0.01%**, and it does **not** report experiments with exactly one poisoned sample. Its contribution to the one-poison literature is therefore indirect but substantial. It shows that once the trigger is optimized as a **feature-space cluster**, the victim model can learn the backdoor from **5–25** poisons with negligible clean-accuracy loss, and it remains difficult to detect: the paper reports **Defense Detection Rate (DDR)** below **0.12**, often below **0.05**, against **IBD-PSC**, **SCALE-UP**, and **Beatrix** [2505.19821]. This is strong evidence for a few-poison regime, not a literal proof of one-poison.

## 4. Extensions beyond vision: text classifiers and RAG systems

The one-poison question generalizes beyond image classification, but the evidence becomes more domain-specific.

For NLP classification and NLI, “Poison Attacks against Text Datasets with Conditional Adversarially Regularized Autoencoder” develops **CARA**, a conditional adversarially regularized autoencoder that injects a trigger direction \(\delta\) in latent space via
\[
z' = T(z) = \frac{z + \lambda \delta}{\| z + \lambda \delta \|_2},
\]
then decodes back to fluent text while relabeling the sample to the target class [2010.02684]. The attack is evaluated on Yelp sentiment classification and on SNLI and MNLI with BERT, RoBERTa, and XLNet. The abstract states that **1% poisoned data** yields success rates of **>80%** for a victim BERT fine-tuned classifier when the input hypothesis is injected with the poison signature. On Yelp, the paper reports threshold-like behavior: for **CARA-Asian**, the trigger-rate onset is around **0.2%** poisoned training samples, and for **CARA-waitress** around **0.05%**; above these thresholds, trigger rates rise sharply while clean accuracy remains near baseline [2010.02684]. On MNLI and SNLI, the reported tables focus on **5%** and **10%** poisoning, where trigger rates are essentially **99%** or higher across models [2010.02684].

CARA therefore supports a **small-poison** view rather than a strict one-poison view. The paper does not test a single example, and it explicitly frames the minimal-budget question as unresolved. Its main relevance is mechanistic: by forcing all poisoned examples to share a consistent latent trigger direction, it creates a compact triggered submanifold that the downstream classifier can recognize with very few poisons [2010.02684].

For RAG systems, “Confundo: Learning to Generate Robust Poison for Practical RAG Systems” shifts the unit of poisoning from labeled training examples to **poison snippets embedded in documents** that will be scraped, chunked, indexed, and retrieved [2602.06616]. Confundo fine-tunes a poison generator \(\mathcal{G}_\theta\) with a reward
\[
R(p; q, \alpha) =
R_{\mathrm{ret}}(p; q) + R_{\mathrm{gen}}(p; q, \alpha)
+ R_{\mathrm{lex}}(p; q, \alpha)
+ R_{\mathrm{ppl}}(p),
\]
combining retrieval robustness, generation success, paraphrase robustness, and stealthiness [2602.06616].

The most relevant result for one-poison reasoning is the **occurrence ablation**. The paper states: **“Our results show that a single occurrence (the default setting) is already sufficient to achieve high ASR. Increasing this number yields only marginal gains and may raise suspicion.”** In the same hyperparameter study, ASR saturates at around **40 tokens**, so a single short poison snippet—roughly one or two sentences—per targeted query is sufficient for near-maximal attack performance. For factual manipulation, this regime yields **ASR ≈ 88%** [2602.06616]. The paper further reports that under paraphrasing defenses, Confundo remains robust, and under reranking defense its ASR stays around **78%** versus about **55%** for AuthChain [2602.06616].

This is not a single universal poison for all queries. It is a **one-poison-per-targeted-query** result. The paper is explicit that it does not prove a single global poison for a multi-domain RAG corpus. Yet it establishes that, once retrieval and generation are jointly optimized and practical constraints such as chunking and paraphrasing are modeled, one carefully placed snippet in one chunk can suffice for a fixed target question [2602.06616].

## 5. Formal proof for linear regression and linear classification

The strongest affirmative statement about the One-Poison Hypothesis is theoretical. “Non-omniscient backdoor injection with a single poison sample: Proving the one-poison hypothesis for linear regression and linear classification” formalizes the hypothesis and proves it for two convex learning problems: L2-regularized linear regression and linear SVM classification [2508.05600].

The attacker is **non-omniscient**. They do not know the full training set; instead, they know the training set size \(n\) and can estimate the mean and variance of the total projected benign signal along one direction \(u\). The poison is a single point
\[
x_p = R \cdot (0,0,\ldots,0,\eta) = \eta u,
\]
where \(R\) is orthogonal and \(u\) is its last column. In regression, the poison label is chosen as \(y_p=1\); in classification, the poison is labeled \(+1\) [2508.05600].

For linear regression, training minimizes
\[
\mathcal{L}^\text{SE}(cl, w)
= \frac{1}{2}\|w\|_2^2 + C \sum_{(x_i,y_i)\in cl} (y_i - w^\top x_i)^2.
\]
The paper shows that if \(\eta\) is chosen large enough relative to the benign signal in direction \(u\), then with probability at least \(1-\delta\) the optimum satisfies the backdoor condition needed for the patch
\[
\text{patch}(x)
  = x + R \cdot \Big(0,\ldots,0,\Big|\frac{-(w^\top x) + 1}{w^\top x_p}\cdot \eta\Big|\Big),
\]
which guarantees
\[
w^\top\text{patch}(x)=1
\]
for all inputs in the targeted subset [2508.05600]. This is zero backdooring-error in the strict sense.

For linear classification, the model minimizes regularized Hinge loss and predicts \(\operatorname{sign}(w^\top x)\). The patch has the form
\[
\text{patch}(x) = x + R(0,\dots,0,K\eta),
\]
and the theorem states that, with probability at least \(1-\delta\), all negative examples satisfying \(w^\top x > -K\) are moved to the positive side after patching:
\[
w^\top \text{patch}(x) \ge 0.
\]
This again yields zero backdoor-error on the specified region [2508.05600].

The paper’s most striking result concerns an **unused direction**. If benign data have zero projection and zero variance in the poison direction \(u\), then the poisoned optimum is **functionally equivalent** to the clean optimum on all benign inputs. In that case, the parameter vector decomposes into a benign component and a poison-only component; the poison affects only patched inputs, not ordinary ones [2508.05600]. When the direction is not perfectly unused, the paper derives bounds showing that benign risk increases only in a controlled way and shrinks with \(1/n\).

Experimental validation uses standard datasets—Parkinsons and Abalone for regression, Spambase and Phishing for classification—with only one poison sample inserted. The reported outcome is that clean and poisoned models have almost identical benign performance, while poisoned models achieve perfect or effectively perfect backdoor behavior on patched inputs [2508.05600]. Within its stated scope, this paper is the clearest proof that the One-Poison Hypothesis is true.

## 6. Conditions, misconceptions, and open problems

The literature does not support a blanket statement that one poison is always sufficient for all models and training procedures. Instead, it identifies **regimes** in which the hypothesis is true, regimes in which only a few poisons suffice, and regimes in which a single poison fails.

A first misconception is that success in one-poison transfer learning implies success in end-to-end deep learning. The contrast inside [1804.00792] shows otherwise: with a frozen feature extractor and linear head, one poison can achieve 100% targeted success; when all layers are trainable, the same strategy fails and tens of poisons plus watermarking are needed. A plausible implication is that the trainability of the representation, not merely model size, is a decisive variable.

A second misconception is that extremely low poison **fractions** are equivalent to literal one-poison attacks. ShadowPrint’s **0.01%** regime is extraordinarily small—**5** poisons on CIFAR-10—and its results are close to a one-poison frontier, but the paper itself does not test **1–2** poisoned samples and does not provide a lower bound on the minimum number required [2505.19821]. The same caveat applies to CARA, where **0.05–0.2%** on Yelp and **1%** in the abstract are strong evidence for few-poison backdoors, but not for exact single-example attacks [2010.02684].

A third misconception is that one-poison must mean one **training sample** in the conventional supervised-learning sense. In RAG systems, the natural unit is often a **single poisoned chunk or snippet** in an indexed document. Confundo demonstrates that one short occurrence per targeted query can suffice under realistic chunking, retriever mismatch, generator variation, and paraphrasing [2602.06616]. This is a genuine one-poison phenomenon at the level of retrieval corpora, but it is not a universal trigger that controls arbitrary unrelated queries.

Several open questions remain explicit across the surveyed work. ShadowPrint leaves unresolved whether the ASR curve remains smooth or becomes brittle at **1–2** poisoned samples [2505.19821]. CARA does not characterize the exact minimal budgets needed for high trigger rates in text [2010.02684]. Confundo does not study the minimal number of poisoned documents required at corpus scale, nor a single universal snippet for broad-topic RAG [2602.06616]. Even the linear-model proof in [2508.05600] does not extend formally to deep nonlinear models.

Taken together, the state of research is best summarized in three propositions. First, the One-Poison Hypothesis is **proved** for linear regression and linear classification under a non-omniscient threat model [2508.05600]. Second, it is **strongly confirmed empirically** for targeted clean-label transfer learning with fixed features and linear heads [1804.00792]. Third, for modern deep backdoor attacks, NLP fine-tuning, and practical RAG pipelines, current evidence most strongly supports a **few-poison or one-per-target** interpretation rather than a universal one-poison law [2505.19821][2010.02684][2602.06616].

Source: https://www.emergentmind.com/topics/one-poison-hypothesis