pith. sign in

arxiv: 2606.29112 · v1 · pith:UBRVCPZ3new · submitted 2026-06-27 · 💻 cs.LG

A Novel Latent-Class Attack and its Detection by Class Subspace Orthogonalization

Guangmingmei Yang , David J. Miller , George Kesidis This is my paper

Pith reviewed 2026-06-30 09:11 UTC · model grok-4.3

classification 💻 cs.LG
keywords latent class attackdata poisoningclass subspace orthogonalizationbackdoor detectionmachine learning securityadversarial examplespost-training defenseunknown class detection
0
0 comments X

The pith

A latent class attack poisons a model by embedding an unknown class as a hidden subclass of a known target class, and class subspace orthogonalization detects it after training without the training data.

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The paper defines a latent class attack in which poisoned examples all belong to a class novel to the domain yet are labeled as one of the known classes. The model therefore absorbs the novel class as a subgroup inside the target class, enabling misclassification of distinctions such as friend versus foe. To counter this, the authors introduce a post-training detector based on class subspace orthogonalization that identifies candidate unknown-class inputs: examples the model classifies confidently to a known class but whose internal representations lie outside all known class subspaces. For image tasks the method also reconstructs a visual estimate of the hidden class to explain the detection.

Core claim

The paper claims that poisoning with examples from a novel class, all mislabeled to a single target class, causes the trained model to treat that novel class as a subclass of the target; class subspace orthogonalization can then locate such an embedded class by searching for an input whose representation is orthogonal to every known class subspace yet receives high confidence for one of those classes, all without access to the training set.

What carries the argument

Class subspace orthogonalization (CSO), which seeks an input whose internal representation is not aligned with any known class subspace yet is classified with high confidence to one of those classes.

If this is right

  • A model subjected to the attack will systematically classify instances of the novel class as the chosen target class.
  • The attack can be mounted to defeat access-control or identification systems that rely on the trained classifier.
  • CSO detection works after training is complete and requires no access to the original training set.
  • For image domains the method supplies a visualization of the estimated unknown class to support human review of detections.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • The same orthogonalization search could be tested on non-image data such as text or sensor streams if comparable internal representations exist.
  • CSO could be applied as a general post-training check for other forms of hidden subclass structure even when no poisoning is suspected.
  • The detection might be strengthened by combining it with existing backdoor detectors as the paper already suggests for CSO in general.

Load-bearing premise

That an input whose internal representation fails to align with any known class subspace, yet receives confident classification to one of those classes, necessarily signals a latent class attack rather than other distribution shifts or model behaviors.

What would settle it

Finding natural inputs or non-attack distribution shifts that produce the same combination of high classification to a known class and zero alignment with all known class subspaces would falsify the claim that this pattern uniquely indicates the latent class attack.

read the original abstract

Deep learning, which in general relies on voluminous amounts of training data, is vulnerable to data poisoning attacks, including error-generic attacks and backdoors (Trojans). In this work, we propose a new data poisoning attack we dub a latent class attack. Here, all poisoned examples are from a class that is novel (unknown) for the given classification domain and are mislabeled to one of the known classes (the target class) of the domain, so that the model learns to recognize the novel class as a sub-class of the target class. Such attacks could be used e.g. to defeat AI-based access control systems, or could cause a "foe" to be classified as a "friend". We also propose a post-training defense to detect this attack, without any access to the training set. This detection approach builds on "class subspace orthogonalization" (CSO), a plug-and-play paradigm demonstrated to improve existing backdoor detectors. Here, CSO is used to seek an input (a putative unknown class instance) whose internal representation is not aligned with any of the known classes, and yet which is classified with confidence to one of these classes. Finally, specific to image classification domains, we propose a method for visualizing the estimated unknown class instance, providing explainability to our latent class detections.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit. Tearing a paper down is the easy half of reading it; the pith above is the substance, this is the friction.

Referee Report

2 major / 1 minor

Summary. The manuscript proposes a new data poisoning attack termed the latent class attack, in which all poisoned samples belong to a novel (unknown) class but are mislabeled as a known target class, causing the model to internalize the novel class as a subclass of the target. It further introduces a post-training defense that applies class subspace orthogonalization (CSO) to detect such attacks without access to the training set, by identifying inputs whose internal representations are unaligned with any known class subspace yet receive high-confidence classification to one of those classes; a visualization method for the estimated unknown class is also described for image domains.

Significance. If the attack and detection claims hold under empirical scrutiny, the work would address a relevant gap in adversarial ML by formalizing a poisoning strategy that could compromise access-control or friend/foe systems and by extending CSO as a plug-and-play defense. The conceptual framing of the attack and the training-set-free nature of the detector are clear strengths. At present, however, the manuscript supplies no experiments, proofs, or quantitative results, so the practical significance cannot yet be assessed.

major comments (2)
  1. [Abstract] Abstract and Introduction: the central claims—that the latent class attack successfully embeds a novel class as a subclass and that the CSO detector specifically identifies this attack—are presented without any supporting experiments, ablation studies, or theoretical derivations, rendering the soundness of both contributions unevaluable.
  2. [Introduction] Defense description (Introduction): the detection criterion assumes that an input whose representation is unaligned with known class subspaces yet classified with high confidence necessarily signals a latent class attack; no analysis or test is supplied to show this signature does not also arise from ordinary distribution shift or natural OOD samples, which is load-bearing for the claimed specificity of the defense.
minor comments (1)
  1. The manuscript would benefit from explicit pseudocode or equations defining the CSO orthogonalization step and the alignment metric used for detection.

Simulated Author's Rebuttal

2 responses · 0 unresolved

We thank the referee for the detailed review and for identifying the absence of empirical support as a central issue. We agree that the current manuscript is primarily conceptual and will undertake a major revision to add the necessary experiments, ablations, and analyses.

read point-by-point responses

  1. Referee: [Abstract] Abstract and Introduction: the central claims—that the latent class attack successfully embeds a novel class as a subclass and that the CSO detector specifically identifies this attack—are presented without any supporting experiments, ablation studies, or theoretical derivations, rendering the soundness of both contributions unevaluable.

    Authors: We acknowledge that the manuscript as submitted contains no experiments, proofs, or quantitative results. In the revised version we will add a full experimental section that (i) demonstrates the latent-class attack on standard image classifiers, (ii) shows that the CSO detector recovers the poisoned inputs, and (iii) includes ablation studies on the number of poisoned samples, choice of target class, and CSO hyperparameters. Where possible we will also supply a brief theoretical argument relating the subspace misalignment to the mislabeling mechanism. revision: yes

  2. Referee: [Introduction] Defense description (Introduction): the detection criterion assumes that an input whose representation is unaligned with known class subspaces yet classified with high confidence necessarily signals a latent class attack; no analysis or test is supplied to show this signature does not also arise from ordinary distribution shift or natural OOD samples, which is load-bearing for the claimed specificity of the defense.

    Authors: This point is well taken and directly affects the claimed specificity of the detector. The revision will include controlled experiments that apply the CSO detector to (a) standard OOD benchmarks (e.g., SVHN on a CIFAR-10 model) and (b) natural distribution shifts within the same domain. We will report false-positive rates and discuss whether additional filtering or calibration is required to maintain specificity to latent-class poisoning. If the signature is not unique, we will revise the claims accordingly. revision: yes

Circularity Check

0 steps flagged

No significant circularity; detection method is a post-training procedure without reduction to fitted inputs or self-citation chains

full rationale

The paper introduces a latent class attack definition and a CSO-based detection procedure that identifies inputs unaligned with known class subspaces yet classified confidently. No equations, derivations, or parameter fits are shown that reduce the detection output to a quantity defined from the same data or inputs by construction. CSO is presented as an existing plug-and-play paradigm applied here, with the central claim resting on the empirical behavior of the detector rather than any self-referential loop or renamed known result. The derivation chain is therefore self-contained against external benchmarks.

Axiom & Free-Parameter Ledger

0 free parameters · 0 axioms · 0 invented entities

Abstract supplies no explicit free parameters, axioms, or invented entities; all technical details are deferred to the full manuscript.

pith-pipeline@v0.9.1-grok · 5769 in / 1075 out tokens · 26108 ms · 2026-06-30T09:11:30.998448+00:00 · methodology

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

21 extracted references · 1 canonical work pages · 1 internal anchor

  1. [1]

    A Novel Latent-Class Attack and its Detection by Class Subspace Orthogonalization

    INTRODUCTION Modern machine learning systems are increasingly trained on large-scale datasets whose quality and integrity are difficult to inspect exhaustively. This creates serious reliability and security risks. Error-generic data poisoning attacks mislabel training samples with the goal of degrading the model’s gen- eralization accuracy. Backdoor attac...

    work page internal anchor Pith review Pith/arXiv arXiv 2026

  2. [2]

    unknown unknown

    RELA TED WORK Our setting is related to several lines of work, but differs in both the threat model and defender’s data access assumptions. Label-based poisoning and semantic backdoors.Sev- eral prior works study attacks that modify training labels or exploit semantic attributes. For example, [3] proposes a se- mantic backdoor attack in which source-class...

  3. [3]

    METHOD 3.1. Latent-Class Attack A latent-class attack is a data-poisoning attack in which poi- soning occurs through open-set mislabeling: samples from an undeclared class are assigned to a known target class, caus- ing the trained model to absorb the latent class into the target decision region. We consider a setting in which the declared task containsKk...

  4. [4]

    Experiment Setup Dataset and models.We experiment on two benchmark datasets: CIFAR-10 [11] and (a subset of) TinyImageNet [12], containing 10 classes

    EXPERIMENTAL RESULTS 4.1. Experiment Setup Dataset and models.We experiment on two benchmark datasets: CIFAR-10 [11] and (a subset of) TinyImageNet [12], containing 10 classes. We evaluate our methods for ResNet-18 [13] and ResNet-34 on TinyImageNet. We ran- domly select 30 clean test samples per class for LC-CSO. Attack settings.For each attacked model, ...

  5. [5]

    All metrics are averaged over the attacked models for each dataset. For reference, clean ResNet-18 models achieve an average accuracy of 93.5% on CIFAR-10, while clean ResNet-34 models achieve an average accuracy of 74.0% on the Tiny-ImageNet subset. The latent-class attacks achieve Table 1. Attack performance on CIFAR-10 & TinyImageNet. Dataset ASR ACC C...

  6. [6]

    As a result, the model learns to treat the unknown class as a subclass of the target class, which can create serious security risks

    SUMMARY This work introduces a new data poisoning threat called ala- tent class attack, where samples from an unknown class out- side the declared classification domain are mislabeled as a known target class during training. As a result, the model learns to treat the unknown class as a subclass of the target class, which can create serious security risks....

  7. [7]

    BadNets: Evaluating Backdooring At- tacks on Deep Neural Networks,

    Tianyu Gu, Kang Liu, Brendan Dolan-Gavitt, and Sid- dharth Garg, “BadNets: Evaluating Backdooring At- tacks on Deep Neural Networks,”IEEE Access, 2019

    2019

  8. [8]

    Improving the Sensitivity of Backdoor Detectors via Class Subspace Orthogonalization,

    G. Yang, D.J. Miller, and G. Kesidis, “Improving the Sensitivity of Backdoor Detectors via Class Subspace Orthogonalization,” inProc. ICML, 2026

    2026

  9. [9]

    Neural network se- mantic backdoor detection and mitigation: A Causality- Based approach,

    B. Sun, J. Sun, W. Koh, and J. Shi, “Neural network se- mantic backdoor detection and mitigation: A Causality- Based approach,” inUSENIX Security Symp., 2024

    2024

  10. [10]

    La- bel poisoning is all you need,

    Rishi Dev Jha, Jonathan Hayase, and Sewoong Oh, “La- bel poisoning is all you need,” inNeurIPS, 2023

    2023

  11. [11]

    Generalized out-of- distribution detection: A survey,

    J. Yang, K. Zhou, Y . Li, and Z. Liu, “Generalized out-of- distribution detection: A survey,”International Journal of Computer Vision, vol. 132, no. 12, 2024

    2024

  12. [12]

    Exploratory machine learning with unknown un- knowns,

    Peng Zhao, Jia-Wei Shan, Yu-Jie Zhang, and Zhi-Hua Zhou, “Exploratory machine learning with unknown un- knowns,”Artificial Intelligence, vol. 327, 2024

    2024

  13. [13]

    P- odn: Prototype-based open deep network for open set recognition,

    Y . Shu, Y . Shi, Y . Wang, T. Huang, and Y . Tian, “P- odn: Prototype-based open deep network for open set recognition,”Scientific reports, vol. 10, no. 1, 2020

    2020

  14. [14]

    Few-shot open-set recognition using meta-learning,

    B. Liu, H. Kang, H. Li, G. Hua, and N. Vasconcelos, “Few-shot open-set recognition using meta-learning,” in CVPR, 2020

    2020

  15. [15]

    Learning open set network with discrimi- native reciprocal points,

    G. Chen, L. Qiao, Y . Shi, P. Peng, J. Li, T. Huang, S. Pu, and Y . Tian, “Learning open set network with discrimi- native reciprocal points,” inECCV, 2020

    2020

  16. [16]

    Semantically coherent out-of-distribution detection,

    J. Yang, H. Wang, L. Feng, X. Yan, H. Zheng, W. Zhang, and Z. Liu, “Semantically coherent out-of-distribution detection,” inProc. ICCV, 2021

    2021

  17. [17]

    Learn- ing multiple layers of features from tiny images,

    Alex Krizhevsky and Geoffrey Hinton, “Learn- ing multiple layers of features from tiny images,” http://www.cs.toronto.edu/˜kriz/ learning-features-2009-TR.pdf, 2009

    2009

  18. [18]

    Tiny Ima- geNet Visual Recognition Challenge,

    Ya Le and Xuan S. Yang, “Tiny Ima- geNet Visual Recognition Challenge,”https: //tiny-imagenet.herokuapp.com, 2015

    2015

  19. [19]

    Deep Residual Learning for Image Recognition,

    K. He, X. Zhang, S. Ren, and J. Sun, “Deep Residual Learning for Image Recognition,” inCVPR, 2016

    2016

  20. [20]

    Neural Cleanse: Identifying and Mitigating Backdoor Attacks in Neural Networks,

    B. Wang, Y . Yao, S. Shan, H. Li, B. Viswanath, H. Zheng, and B.Y . Zhao, “Neural Cleanse: Identifying and Mitigating Backdoor Attacks in Neural Networks,” inIEEE S&P, 2019

    2019

  21. [21]

    MM-BD: Post-Training Detection of Back- door Attacks with Arbitrary Backdoor Pattern Types Us- ing a Maximum Margin Statistic,

    Hang Wang, Zhen Xiang, David J. Miller, and George Kesidis, “MM-BD: Post-Training Detection of Back- door Attacks with Arbitrary Backdoor Pattern Types Us- ing a Maximum Margin Statistic,” inIEEE S&P, 2024

    2024