Stealth Data Poisoning Attack

• Stealth data poisoning attack is a training-time adversarial strategy that subtly alters data to induce model failures, backdoors, or utility degradation while evading detection.
• It employs methods like clean-label manipulation, selective hard-sample poisoning, and metadata modifications to remain indistinguishable from normal data.
• The approach leverages advanced optimization frameworks and varied threat models to bypass conventional defenses across vision, audio, federated, and multimodal systems.

Stealth data poisoning attack denotes a training-time attack in which an adversary manipulates training data, labels, metadata, or update streams so that the learned model exhibits targeted failures, backdoor behavior, or selective utility degradation while the poisoned samples remain statistically similar to clean data, ordinary utility metrics remain near baseline, or both. Recent work treats stealth not as a separate attack goal but as a detectability constraint that can accompany targeted, untargeted, and backdoor objectives. In this sense, the topic spans clean-label backdoors, subpopulation attacks on naturally distributed inputs, metadata-only poisoning in retrieval-augmented systems, and minority-class label poisoning whose effect is largely invisible in aggregate accuracy (Zhao et al., 27 Mar 2025, Jagielski et al., 2020, Edemacu et al., 26 Feb 2026, Dahme, 25 Feb 2026).

1. Taxonomic position and defining characteristics

The survey literature places poisoning attacks along several axes: attack objective, goal, knowledge, stealthiness, scope, impact, and variability. Within that taxonomy, stealthy attacks are those that use subtle modifications so that poisoned samples remain statistically similar to clean data and thus evade detection, whereas non-stealthy attacks introduce noticeable anomalies. This makes stealthiness a cross-cutting property rather than a standalone objective: a poisoning attack may still be untargeted, targeted, or backdoor-oriented while being either stealthy or non-stealthy (Zhao et al., 27 Mar 2025).

A central distinction is between clean-label and dirty-label poisoning. Clean-label attacks perturb inputs while preserving labels, reducing visible inconsistency and frustrating defenses that rely on label-content mismatch. Dirty-label attacks alter labels directly; they are often simpler but more detectable. Early clean-label backdoor work already emphasized target-class-only poisoning without relabeling, so that a poisoned sample remains visually and semantically consistent with its assigned class (Barni et al., 2019). Later work strengthened this line by using imperceptible perturbations, universal adversarial perturbations, gradient alignment, or feature transfer rather than visible patches (Lederer et al., 2023, Chen et al., 2021).

Stealth also appears in attacks that do not rely on any test-time trigger. Subpopulation poisoning degrades performance on an entire naturally occurring subgroup while leaving the rest of the distribution largely intact, so failures arise on ordinary inputs rather than on specially modified ones. The absence of a trigger makes such attacks “extremely stealthy” in the sense that the compromised behavior is embedded in the model’s decision rule over a real subdistribution rather than gated by an externally supplied pattern (Jagielski et al., 2020).

2. Threat models and optimization structure

The common formalization is bilevel. A general poisoning attack selects a poisoned dataset $D_p$ to maximize an outer objective after the learner has trained on $D \cup D_p$: $$\begin{aligned} D_p' &= \arg\max_{D_p} \mathcal{F}(D_p,\theta') = \mathcal{L}_{\text{out}}(D_{\text{val}},\theta') \ \text{s.t. } \theta' &= \arg\min_{\theta} \mathcal{L}_{\text{in}}(D \cup D_p,\theta). \end{aligned}$$ Targeted poisoning specializes the outer objective to force a chosen target input $x_t$ toward an attacker-chosen label $y_{\text{adv}}$ (Zhao et al., 27 Mar 2025). Recent regression work extends this template into a multiobjective bilevel program that jointly maximizes validation loss and minimizes a detectability-risk term $\mathcal{R}$, combined through a stealth factor $\alpha$ (Carnerero-Cano et al., 29 Jan 2026). World-model poisoning uses an analogous bilevel structure in which the poisoned fine-tuning transitions must steer a learned dynamics model toward a harmful but low-deviation target world model (Hu et al., 17 Jun 2026).

What varies most across papers is the attacker’s access pattern. In “Wicked Oddities,” the attacker is one data provider among many and supplies only one class, selecting a subset $S' \subset S$ of target-class samples for poisoning without knowing the victim architecture, training process, or other classes (Nguyen et al., 2024). In acoustic classification, the attacker has write access to unsigned stages of the pipeline such as annotation CSVs, feature manifests, split files, or spectrogram-generation code (Dahme, 25 Feb 2026). Provider-side poisoning in retrieval-augmented recommenders assumes the ability to rewrite item descriptions under token-edit and semantic-similarity constraints, while multimodal RAG poisoning assumes only metadata injection or modification and leaves the image unchanged (Nazary et al., 8 May 2025, Edemacu et al., 26 Feb 2026). Federated-learning attacks move the poisoning surface from examples to client-side local objectives and submitted updates; the adversary controls a subset of clients but may lack white-box knowledge of the server’s aggregation rule (McGaughey et al., 3 Sep 2025, Sun et al., 2024). Locally private graph learning introduces yet another surface: fake users, malicious edges, and crafted feature vectors that remain within the legal output support of the underlying LDP mechanism (He et al., 11 Jun 2025).

These threat models show that stealth poisoning is not tied to a single data format. The poisoned object may be an image-label pair, an item description, a spectrogram label, a graph node, a federated update, a world-model next-state target, or an instruction-tuning completion. This suggests that the unifying property is not modality but the attacker’s effort to remain within a tolerated region of the training pipeline.

3. Mechanisms by which stealth is achieved

One mechanism is label consistency. The classic clean-label backdoor construction corrupts only target-class samples, keeping the original label while adding a subtle backdoor pattern: $(x_i,t)\mapsto (x_i^b,t), \qquad x_i^b=x_i+v.$ Because the label remains correct, poisoned examples are harder to identify by visual inspection or by a pre-classification step that checks image-label consistency (Barni et al., 2019). Silent Killer retains this clean-label setting but uses a universal adversarial perturbation as a trigger and then optimizes poison examples through gradient alignment, making the training gradients on poisoned data align with the attacker’s triggered objective (Lederer et al., 2023). DeepPoison removes the visible patch entirely and transfers target-class hidden features into benign samples with a generator and two discriminators, explicitly balancing attack efficacy and perturbation magnitude through

$L(G,D)=L_{GAN}+\alpha L_{FE}+\beta L_{pert},$

so that poisoned samples are described as indistinguishable from benign ones by defensive methods and manual visual inspection (Chen et al., 2021).

A second mechanism is selective poisoning of atypical or hard samples. “Wicked Oddities” argues that randomly poisoning target-class points is inefficient because easy samples can be fitted using ordinary class features. The paper instead ranks target-class samples by a hardness score computed from pretrained feature-space distances,

$D \cup D_p$0

and poisons the samples with the highest scores. The intended effect is that atypical, hard-to-learn, or far-from-cluster points make the victim more likely to rely on the trigger as a shortcut (Nguyen et al., 2024).

A third mechanism is camouflage by conformity. CHAMP in federated learning challenges the assumption that malicious client updates are naturally out-of-distribution. It uses a backdoor side-channel inference signal to adapt the coefficient $D \cup D_p$1 in

$D \cup D_p$2

thereby balancing a malicious backdoor objective with a camouflage/proximity objective that keeps updates statistically close to benign ones (McGaughey et al., 3 Sep 2025). VagueGAN does something similar at the data level: it deliberately generates “vague” poisoned samples that are guided by local data statistics and tunable through the suppression factor $D \cup D_p$3, so the attacker can trade off effectiveness and stealthiness (Sun et al., 2024).

A fourth mechanism is structural stealth produced by task statistics or privacy mechanisms. In acoustic vehicle classification, a targeted label-flip attack on the minority class Truck achieves high ASR while aggregate accuracy remains unchanged; the paper proves this is structural through the bound

$D \cup D_p$4

where $D \cup D_p$5 is the minority-class fraction (Dahme, 25 Feb 2026). In IIoT settings protected by local differential privacy, poisoning can hide inside the indistinguishability guarantees of the LDP mechanism; outputs from nearby inputs are already statistically close, so poisoned records can look “LDP-normal” (Shuai et al., 2024). The locally private graph-learning attack exploits the same idea by crafting fake-node features that remain within the mechanism-dependent range expected from MB, PM, or SW perturbation (He et al., 11 Jun 2025).

A fifth mechanism is metadata or corpus-level poisoning rather than input-space perturbation. In RAG recommenders, the attacker rewrites a small fraction of tokens in item descriptions while satisfying a semantic-similarity lower bound measured by SBERT (Nazary et al., 8 May 2025). MM-MEPA attacks multimodal RAG entirely through captions, alt-text, tags, or descriptions, optimizing metadata to be both query-relevant and image-consistent (Edemacu et al., 26 Feb 2026). Phantom Transfer distributes its signal across otherwise plausible instruction-tuning pairs and remains effective even after regex filtering, LLM-judge filtering, and full-dataset paraphrasing (Draganov et al., 3 Feb 2026).

4. Empirical landscape across domains

The empirical literature now spans vision, audio, federated learning, privacy-preserving data collection, retrieval-augmented systems, diffusion models, regression, graph learning, world models, and LLM fine-tuning. Representative results illustrate both the breadth of the setting and the recurring combination of high attack effect with limited surface-level anomaly.

Domain	Stealth mechanism	Reported outcome
Clean-label vision backdoors	Hard-sample selection within the target class	On CIFAR-10 with ResNet18 at 10% target-class poisoning, selective poisoning improves ASR by about 20–40% over random poisoning while using only $D \cup D_p$6 of the whole dataset (Nguyen et al., 2024)
Clean-label black-box backdoor	UAP trigger plus gradient alignment	Silent Killer reports ASR $D \cup D_p$7, $D \cup D_p$8, and $D \cup D_p$9 on CIFAR-10 models, with preliminary reduced-ImageNet ASR $$\begin{aligned} D_p' &= \arg\max_{D_p} \mathcal{F}(D_p,\theta') = \mathcal{L}_{\text{out}}(D_{\text{val}},\theta') \ \text{s.t. } \theta' &= \arg\min_{\theta} \mathcal{L}_{\text{in}}(D \cup D_p,\theta). \end{aligned}$$0 (Lederer et al., 2023)
Feature-space poisoning	Hidden-feature transfer without obvious patches	DeepPoison reports ASR as high as $$\begin{aligned} D_p' &= \arg\max_{D_p} \mathcal{F}(D_p,\theta') = \mathcal{L}_{\text{out}}(D_{\text{val}},\theta') \ \text{s.t. } \theta' &= \arg\min_{\theta} \mathcal{L}_{\text{in}}(D \cup D_p,\theta). \end{aligned}$$1 with only $$\begin{aligned} D_p' &= \arg\max_{D_p} \mathcal{F}(D_p,\theta') = \mathcal{L}_{\text{out}}(D_{\text{val}},\theta') \ \text{s.t. } \theta' &= \arg\min_{\theta} \mathcal{L}_{\text{in}}(D \cup D_p,\theta). \end{aligned}$$2 poisoned samples on LFW and CASIA (Chen et al., 2021)
Minority-class acoustic poisoning	Targeted Truck$$\begin{aligned} D_p' &= \arg\max_{D_p} \mathcal{F}(D_p,\theta') = \mathcal{L}_{\text{out}}(D_{\text{val}},\theta') \ \text{s.t. } \theta' &= \arg\min_{\theta} \mathcal{L}_{\text{in}}(D \cup D_p,\theta). \end{aligned}$$3Car label flipping under class imbalance	At $$\begin{aligned} D_p' &= \arg\max_{D_p} \mathcal{F}(D_p,\theta') = \mathcal{L}_{\text{out}}(D_{\text{val}},\theta') \ \text{s.t. } \theta' &= \arg\min_{\theta} \mathcal{L}_{\text{in}}(D \cup D_p,\theta). \end{aligned}$$4, 48 corrupted training records produce $$\begin{aligned} D_p' &= \arg\max_{D_p} \mathcal{F}(D_p,\theta') = \mathcal{L}_{\text{out}}(D_{\text{val}},\theta') \ \text{s.t. } \theta' &= \arg\min_{\theta} \mathcal{L}_{\text{in}}(D \cup D_p,\theta). \end{aligned}$$5 ASR with overall test accuracy still $$\begin{aligned} D_p' &= \arg\max_{D_p} \mathcal{F}(D_p,\theta') = \mathcal{L}_{\text{out}}(D_{\text{val}},\theta') \ \text{s.t. } \theta' &= \arg\min_{\theta} \mathcal{L}_{\text{in}}(D \cup D_p,\theta). \end{aligned}$$6 (Dahme, 25 Feb 2026)
Federated learning	Adaptive in-distribution update camouflage	CHAMP reports an average increase of $$\begin{aligned} D_p' &= \arg\max_{D_p} \mathcal{F}(D_p,\theta') = \mathcal{L}_{\text{out}}(D_{\text{val}},\theta') \ \text{s.t. } \theta' &= \arg\min_{\theta} \mathcal{L}_{\text{in}}(D \cup D_p,\theta). \end{aligned}$$7 in ASR against nine robust aggregators (McGaughey et al., 3 Sep 2025)
Metadata-only multimodal RAG poisoning	Caption optimization with image-metadata cohesion	MM-MEPA achieves ASR up to $$\begin{aligned} D_p' &= \arg\max_{D_p} \mathcal{F}(D_p,\theta') = \mathcal{L}_{\text{out}}(D_{\text{val}},\theta') \ \text{s.t. } \theta' &= \arg\min_{\theta} \mathcal{L}_{\text{in}}(D \cup D_p,\theta). \end{aligned}$$8 across four retrievers and two generators (Edemacu et al., 26 Feb 2026)
Trigger-free diffusion poisoning	Repeated visual-pattern insertion in poisoned images	Silent Branding reports trigger-free Logo Inclusion Rate $$\begin{aligned} D_p' &= \arg\max_{D_p} \mathcal{F}(D_p,\theta') = \mathcal{L}_{\text{out}}(D_{\text{val}},\theta') \ \text{s.t. } \theta' &= \arg\min_{\theta} \mathcal{L}_{\text{in}}(D \cup D_p,\theta). \end{aligned}$$9 at $x_t$0 poisoning on Midjourney and $x_t$1 on Tarot (Jang et al., 12 Mar 2025)
ControlNet data poisoning	Backdoor in the conditioning stream	On ImageNet, ControlNet poisoning reaches $x_t$2 ASR for 1%/5%/10% poison with SD v1.5 (Lapid et al., 7 Jul 2025)
Instruction-tuning poisoning	Distributed subliminal signal surviving filtering	Phantom Transfer yields around $x_t$3–$x_t$4 ASR on GPT-4.1 and GPT-4.1-mini for the UK target, with $x_t$5–$x_t$6 ASR reported for some Catholicism and Reagan settings (Draganov et al., 3 Feb 2026)
World-model poisoning	Stealth-constrained next-state target manipulation	On Humanoid-Walk, clean return $x_t$7 drops to $x_t$8 under SWAAP (Hu et al., 17 Jun 2026)

Outside this table, additional systems show the same pattern. VagueGAN reduces global accuracy in FL while making poisoned local models overlap more strongly with benign ones in PCA projections (Sun et al., 2024). Spattack in federated recommenders achieves $x_t$9 target-group ER@5 and ER@10 on ML-100K, ML-1M, and Steam while keeping non-target exposure substantially lower than indiscriminate baselines and remaining effective with only $y_{\text{adv}}$0 malicious users (Yan et al., 7 Jul 2025). In locally private graph learning, targeted fake-node injection reduces accuracy by over $y_{\text{adv}}$1 on average across GCN, GraphSAGE, and GAT (He et al., 11 Jun 2025). In regression, stealth-aware poisoning formulations are reported to bypass TRIM, Huber, SEVER, Proda, and DUTI-style assumptions when attacks become sufficiently inlier-like (Carnerero-Cano et al., 29 Jan 2026).

5. Detectability, defenses, and recurrent misconceptions

A recurring misconception is that poisoned data must be obvious outliers. CHAMP explicitly refutes the “out-of-distribution attacker” assumption for federated learning by keeping malicious updates inside the acceptance region of robust aggregators (McGaughey et al., 3 Sep 2025). Wicked Oddities shows that even small clean-label poisoning budgets remain difficult to detect under STRIP, Neural Cleanse, Fine-pruning, Activation Clustering, Spectral Signatures, SPECTRE, ABL, and CLP; some defenses fail to identify poisoned samples, whereas others sacrifice many clean samples, and selective poisoning still reaches $y_{\text{adv}}$2 ASR against ABL and $y_{\text{adv}}$3 against CLP in the appendix (Nguyen et al., 2024). Regression results make the same point in a different form: when poisoned points are sufficiently close to clean points, residual- and gradient-based outlier filtering can miss the poisons or reject benign data instead (Carnerero-Cano et al., 29 Jan 2026).

A second misconception is that aggregate utility metrics are reliable indicators. “Poisoned Acoustics” shows that overall accuracy monitoring is mathematically incapable of reliably detecting a targeted minority-class collapse when $y_{\text{adv}}$4 (Dahme, 25 Feb 2026). RAG-based recommendation poisoning likewise leaves Recall@$y_{\text{adv}}$5 and nDCG@$y_{\text{adv}}$6 only modestly changed while still manipulating a targeted item’s exposure (Nazary et al., 8 May 2025). This suggests that headline quality metrics are often orthogonal to the attacker’s objective.

A third misconception is that sanitizing the obvious modality is sufficient. MM-MEPA leaves the image untouched and poisons only metadata, yet query paraphrasing and cosine-based image-metadata consistency checks are largely ineffective because the poisoned caption is explicitly optimized to satisfy a cohesion threshold (Edemacu et al., 26 Feb 2026). Phantom Transfer strengthens the same lesson in LLM fine-tuning: even fully paraphrasing every sample in the dataset with a different model does not remove the poisoned behavioral trait, leading the authors to conclude that data-level defenses are insufficient in this regime (Draganov et al., 3 Feb 2026).

Where defenses do show promise, they often exploit structure specific to the attack surface. PoisonCatcher moves LDP-poisoning defense into the resource-rich aggregator and combines temporal similarity, attribute correlation, pattern stability, and feature-based identification, reporting F2 scores above $y_{\text{adv}}$7 under various attack settings (Shuai et al., 2024). BayesClean uses predictive variance from Bayesian linear regression rather than residuals alone and is reported to improve over prior regression defenses when attacks are stealthy and the number of poisoning points is significant (Carnerero-Cano et al., 29 Jan 2026). Model Consistency-Based Defense detects the consistency footprint left by repeated GAN-based poisoning in FL (Sun et al., 2024). At the pipeline level, acoustic poisoning motivates a preventive rather than statistical defense: content-addressed artifact hashing, Merkle-tree dataset commitment, and post-quantum signatures such as ML-DSA-65/CRYSTALS-Dilithium3 to make provenance cryptographically verifiable (Dahme, 25 Feb 2026).

6. Conceptual significance and open directions

The literature now supports a broad reinterpretation of poisoning. The older picture of poisoning as visible trigger insertion or gross label corruption no longer describes the strongest threat models. Stealth poisoning increasingly exploits sample hardness, class imbalance, privacy noise, distributed training heterogeneity, cross-modal metadata channels, or fine-tuning corpora that look semantically ordinary. This suggests that detectability is often governed less by the magnitude of any one perturbation than by whether the defender is monitoring the correct invariants.

Several open directions recur across papers. The survey identifies the detectability-versus-effectiveness trade-off, transferability across architectures and retraining regimes, evaluation fragmentation, dynamic and continual poisoning, and the need for benchmark suites specifically aimed at stealth (Zhao et al., 27 Mar 2025). Multimodal and LLM settings remain particularly active: MM-MEPA calls for stronger cross-modal verification and defense-aware retrieval (Edemacu et al., 26 Feb 2026), while Phantom Transfer argues for shifting attention toward model audits and white-box security methods because the poison may be irrecoverable at the data layer (Draganov et al., 3 Feb 2026). World-model poisoning extends the problem into continual adaptation, where protecting both the incoming fine-tuning data and the learned dynamics becomes necessary (Hu et al., 17 Jun 2026). Privacy-preserving learning introduces another unresolved tension: both IIoT LDP poisoning and locally private graph poisoning show that stronger privacy can coexist with, or even amplify, integrity vulnerabilities (Shuai et al., 2024, He et al., 11 Jun 2025).

Stealth data poisoning attack is therefore best understood as a family of adversarial strategies that operationalize the same principle across many training pipelines: induce a malicious learning signal while remaining compatible with the statistics, semantics, or governance mechanisms that define “normal” data for that system. The recent literature shows that this compatibility can arise from clean labels, in-distribution updates, constrained metadata rewrites, minority-class structure, or privacy-induced indistinguishability. A plausible implication is that future defenses will have to combine provenance, representation-level auditing, system-specific invariants, and post-training model analysis rather than relying on anomaly screening alone.