Targeted data poisoning attacks pose an increasingly serious threat due to their ease of deployment and high success rates. These attacks aim to manipulate the prediction for a single test sample in classification models. Unlike indiscriminate attacks that aim to decrease overall test performance, targeted attacks present a unique threat to individual test instances. This threat model raises a fundamental question: what factors make certain test samples more susceptible to successful poisoning than others? We investigate how attack difficulty varies across different test instances and identify key characteristics that influence vulnerability. This paper introduces three predictive criteria for targeted data poisoning difficulty: ergodic prediction accuracy (analyzed through clean training dynamics), poison distance, and poison budget. Our experimental results demonstrate that these metrics effectively predict the varying difficulty of real-world targeted poisoning attacks across diverse scenarios, offering practitioners valuable insights for vulnerability assessment and understanding data poisoning attacks.

翻译：目标数据投毒攻击因其易于实施和高成功率而构成日益严重的威胁。这类攻击旨在操纵分类模型对单个测试样本的预测结果。与旨在降低整体测试性能的无差别攻击不同，目标攻击对个体测试实例构成独特威胁。该威胁模型引出一个根本性问题：哪些因素导致某些测试样本比其他样本更容易被成功投毒？我们研究了攻击难度在不同测试实例间的变化规律，并识别出影响脆弱性的关键特征。本文提出了目标数据投毒难度的三项预测准则：遍历预测精度（通过干净训练动态分析）、投毒距离和投毒预算。实验结果表明，这些指标能有效预测现实场景中目标投毒攻击的差异化难度，为从业者进行脆弱性评估和理解数据投毒攻击提供了重要参考。