Data Poisoning Detection

import numpy as np
from sklearn.decomposition import PCA

def detect_spectral_signatures(representations, labels, epsilon=1.5):
    """Detect poisoned samples via spectral signatures."""
    suspicious = []

    for target_class in np.unique(labels):
        # Get representations for this class
        class_reps = representations[labels == target_class]
        centered = class_reps - class_reps.mean(axis=0)

        # Compute top singular vector
        _, _, Vt = np.linalg.svd(centered, full_matrices=False)
        top_vector = Vt[0]

        # Score each sample by projection onto top vector
        scores = np.abs(centered @ top_vector)

        # Flag outliers as potentially poisoned
        threshold = np.mean(scores) + epsilon * np.std(scores)
        poisoned_idx = np.where(scores > threshold)[0]
        suspicious.extend(poisoned_idx.tolist())

    return suspicious

# For each target class t:
For each source class s != t:
    # Find minimum trigger that flips s -> t
    trigger = optimize(
        minimize: |trigger_mask| + |trigger_pattern|
        subject_to: model(x + trigger) == t for all x in class s
    )
    record trigger size

# Backdoored class has anomalously small trigger
If any class has trigger_size << median(all trigger_sizes):
    ALERT: Likely backdoor detected for that class
    The recovered trigger approximates the actual backdoor trigger