Label poisoning is a data poisoning attack on supervised machine learning where training labels are altered, corrupted, or misassigned. It changes the model’s learned associations between inputs and outputs, so predictions can be systematically wrong without changing the underlying examples themselves.
How label poisoning works
Label poisoning targets the supervision signal rather than the examples themselves. By corrupting, flipping, or misassigning labels, an attacker can make the model learn the wrong mapping between inputs and outputs while the training data still looks superficially normal.
This makes the attack especially deceptive in workflows that rely on large, distributed, or partially trusted data pipelines. The model may appear to train successfully, yet its decision boundary is being shaped by bad supervision from the start.
Why label poisoning is dangerous
The core danger is silent model corruption. Because the attack changes what the model is told is “correct,” it can produce systematic errors that are hard to trace back to a single bad record, and the resulting weakness may persist across retraining cycles if the poisoned labels remain in the data store.
Label poisoning is often more damaging than ordinary noise because it is intentional and directional. Random mistakes tend to average out, but poisoned labels can push the model toward a specific failure pattern, including misclassification of a target class or degraded performance in a narrow but important slice of the data.
How organisations detect exposure
Exposure checking starts with data lineage and training-set inventory: who supplied the labels, how they were produced, and whether any stage allowed untrusted edits. Teams should also look for weak review controls in human labelling workflows, pipeline steps that merge multiple sources without validation, and training data that changed unexpectedly between runs.
Detection is strongest when organisations compare label distributions, review disagreement rates, and inspect whether the model’s failures cluster around a particular class, contributor, or ingestion window. Baseline checks on training data quality and repeatability matter because label poisoning may not trigger obvious infrastructure alarms.
Remediation and control points
The immediate response is to remove or quarantine suspect labels, retrain from a trusted dataset, and verify whether the poisoning affected downstream models, checkpoints, or derived features. If labels were created or corrected manually, the process that allowed the corruption should be reviewed before the next training cycle begins.
Preventive controls should emphasise separation of duties, label provenance, approval for sensitive relabelling, and validation on a held-out set that was not exposed to the same labelling path. Where feasible, organisations should keep a clean reference dataset so they can distinguish true model drift from supervision corruption.
Risk and Threat Considerations
Label poisoning is dangerous because it attacks the part of machine learning that most teams assume is trustworthy. A single corrupted supervision source can bias decisions at scale, and the resulting failure may look like ordinary model weakness rather than an active compromise.
Failure mechanism: The attacker alters labels during collection, curation, or review so the model learns false associations, making the poisoned pattern persist in the learned parameters even when the underlying examples are unchanged.
Impact: The model can misclassify targeted inputs, lose accuracy in critical categories, and propagate bad decisions into downstream automation, monitoring, or decision-support systems.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST AI RMF and NIST SP 800-53 Rev 5 set the technical controls, while ISO/IEC 42001:2023 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST AI RMF | Govern | Label poisoning is an AI risk governance problem affecting training data integrity. |
| Recommendation — Govern training-data integrity and review model risk from corrupted labels. | ||
| NIST SP 800-53 Rev 5 | AU-6 — Audit Record Review, Analysis, and Reporting | Audit review supports tracing label changes and anomalous supervision activity. |
| SI-10 — Information Input Validation | Label poisoning exploits unvalidated or untrusted training inputs and annotations. | |
| SI-4 — System Monitoring | Monitoring helps detect unusual training-data behavior and model degradation patterns. | |
| Recommendation — Review label-change activity and investigate anomalous training-data edits. Validate training labels and reject malformed or untrusted supervision data. Monitor training pipelines for abnormal label shifts and suspicious ingestion patterns. | ||
| ISO/IEC 42001:2023 | A.5.2 — AI policy | AI policy should govern integrity and accountability for labelled training data. |
| Recommendation — Define policy for label provenance, review, and escalation in AI workflows. | ||
Practitioner Guidance
Why practitioners should care: Label quality is part of the security boundary for supervised learning, not just a data-cleaning concern. If the organisation cannot trust the supervision process, it cannot trust the model’s apparent performance metrics.
What to watch for: Repeated relabelling from a small set of sources, unexplained class imbalance shifts, and models that degrade in ways not explained by ordinary drift are all signals that label integrity deserves investigation.
Practitioner takeaway: Treat the label pipeline as a governed asset with auditability, review, and rollback, because once poisoned labels shape a model, the error can survive long after the bad record is gone.