Online AutoML: Evaluating Poisoning Attacks on Adversarial Training Defense Strategy in IoT Networks

Chukwunonso Henry Nwokoye; Khalil El-Khatib; Li Yang

cs.CROct 5, 2026

Online AutoML: Evaluating Poisoning Attacks on Adversarial Training Defense Strategy in IoT Networks

Authors: Chukwunonso Henry Nwokoye, Khalil El-Khatib, Li Yang

Organizations: Faculty of Business and Information Technology, Ontario Tech University, Oshawa, Ontario, Canada · Department of Computer Science, Alex Ekwueme Federal University, Nigeria

Abstract

Machine learning (ML)-powered poisoning attack vectors are adversarial maneuvers whereby an attacker intentionally inserts, corrupts, or alters training data to distort an ML model's learning process. The objective is to diminish model efficacy, instill biases, induce misclassifications, or include concealed backdoors that may be attacked during implementation. In streaming contexts, poisoning attacks pose significant risks since models perpetually update based on incoming streams of data. An assailant may incrementally introduce harmful samples into this data stream, leading the model to assimilate erroneous features over time without timely identification. Therefore, this study is aimed at evaluating the efficacy of the adversarial training (AT) defense approach against poisoning attacks (label flip and noise injection) using an online AutoML pipeline for Internet of Things (IoT) networks. Specifically, poisoning attacks (label flip and noise injection) were applied to streaming-capable AutoML learners (Hoeffding Tree (HT), Leveraging Bagging (LB), Adaptive Random Forest (ARF), Hoeffding Adaptive Tree (HAT), and Streaming Random Patches (SRP)). Under the strongest poisoning rate (PR = 1.0), AT-SRP achieved the highest F1-score against label flip poisoning (0.904), while AT-LB achieved the highest F1-score against noise-injection poisoning (0.933). Finally, several drift detection methods were used for rolling accuracy and prequential evaluation.

Figures & tables

Fig. 1: The overview of the proposed framework

Classifier	Rate	Accuracy	F1	Precision	Recall
Hoeffding Tree	0.0	0.942	0.914	0.888	0.942
Hoeffding Tree	0.4	0.942	0.914	0.888	0.942
Hoeffding Tree	1.0	0.058	0.006	0.003	0.058
Leveraging Bagging	0.0	0.898	0.911	0.928	0.898
Leveraging Bagging	0.4	0.191	0.259	0.857	0.191
Leveraging Bagging	1.0	0.058	0.006	0.003	0.058

TABLE I: Naive Model Performance Under Label-Flip Poisoning

Classifier	Rate	Accuracy	F1	Precision	Recall
Hoeffding Tree	0.0	0.058	0.006	0.003	0.058
Hoeffding Tree	0.4	0.058	0.006	0.003	0.058
Hoeffding Tree	1.0	0.058	0.006	0.003	0.058
Leveraging Bagging	0.0	0.429	0.550	0.905	0.429
Leveraging Bagging	0.4	0.296	0.409	0.860	0.296
Leveraging Bagging	1.0	0.543	0.661	0.871	0.543

TABLE II: AT Model Performance Under Label-Flip Poisoning

Classifier	Rate	Accuracy	F1	Precision	Recall
Hoeffding Tree	0.0	0.942	0.914	0.888	0.942
Hoeffding Tree	0.4	0.905	0.922	0.951	0.905
Hoeffding Tree	1.0	0.942	0.914	0.888	0.942
Leveraging Bagging	0.0	0.894	0.909	0.930	0.894
Leveraging Bagging	0.4	0.607	0.709	0.936	0.607
Leveraging Bagging	1.0	0.942	0.937	0.934	0.942

TABLE III: Naive Model Performance Under Noise-Injection Poisoning

Classifier	Rate	Accuracy	F1	Precision	Recall
Hoeffding Tree	0.0	0.686	0.769	0.907	0.686
Hoeffding Tree	0.4	0.718	0.791	0.905	0.718
Hoeffding Tree	1.0	0.721	0.793	0.905	0.721
Leveraging Bagging	0.0	0.948	0.952	0.958	0.948
Leveraging Bagging	0.4	0.904	0.921	0.952	0.904
Leveraging Bagging	1.0	0.936	0.933	0.930	0.936

TABLE IV: Adversarially Trained Model Performance Under Noise-Injection Poisoning

Poisoning Attack	Best AT Model	Rate	Accuracy	Precision	Recall	F1
Label Flip	SRPClassifier	1.0	0.906	0.902	0.906	0.904
Noise Injection	Leveraging Bagging	1.0	0.936	0.930	0.936	0.933

TABLE V: Best AT Models Under Poisoning Attacks

Classifier	Attack	Naive-EDDM	AT-EDDM
HoeffdingTree	label_flip	13/13/10	10/10/10
HoeffdingTree	noise_injection	13/0/13	6/0/0
LeveragingBagging	label_flip	0/15/10	1/9/0
LeveragingBagging	noise_injection	0/24/0	3/2/0
SRPClassifier	label_flip	2/5/7	0/0/2
SRPClassifier	noise_injection	13/1/0	0/0/0

TABLE VI: EDDM Drift Detection Under Poisoning Attacks

Model	PR	Attack	Total Drift (EDDM)	Overlap
Leveraging Bagging Classifier
Naïve-LB	0.4	NI	24	1
AT-LB	0.4	NI	2	1
AT-LB	0.6	NI	1	1
SRP Classifier
AT-SRP	0.2	NI	1	1

TABLE VII: Poisoning Attack Results and Drift Detection

Model	PR	Acc	F1	Prec	Rec	Overlap
Leveraging Bagging
Naïve-LB	0.4	0.607	0.709	0.936	0.607	1
AT-LB	0.4	0.904	0.921	0.952	0.904	1
AT-LB	0.6	0.903	0.921	0.952	0.903	1
SRP Classifier
AT-SRP	0.2	0.950	0.950	0.950	0.950	1

TABLE VIII: Model Performance for Noise-Injection Cases With Drift-Poison Overlap

Fig. 3: Drift Detection for Naive-LB Model

Classifier	Acc.	F1
Hoeffding Tree	0.058	0.006
Leveraging Bagging	0.543	0.661
SRPClassifier	0.906	0.904
Hoeffding Adaptive Tree	0.703	0.778
Adaptive Random Forest	0.058	0.006

TABLE IX: AT Performance Under Label-Flip Poisoning at Rate 1.0

Classifier	Acc.	F1
Hoeffding Tree	0.721	0.793
Leveraging Bagging	0.936	0.933
SRPClassifier	0.943	0.925
Hoeffding Adaptive Tree	0.803	0.848
Adaptive Random Forest	0.942	0.914

TABLE X: AT Performance Under Noise Injection at Rate 1.0

Explore similar work

May 24, 2026cs.CR

Enhancing Autonomous Online Intrusion Detection for IoT with Balanced Learning, Reliable Pseudo-Labels, and Lightweight Architectures

The rapid proliferation of Internet of Things (IoT) devices has created an urgent demand for adaptive, resource-efficient Intrusion Detection Systems (IDS) capable of handling dynamic and evolving cyber threats. This paper investigates AOC-IDS, a state-of-the-art autonomous online IDS published at IEEE INFOCOM 2024, which employs an Autoencoder (AE) with Cluster Repelling Contrastive (CRC) loss and an autonomous Gaussian-based decision module. We first successfully replicate AOC-IDS on the UNSW-NB15 benchmark, achieving 89.39% accuracy in close agreement with the published 89.19%. We then identify four key limitations: class imbalance, unreliable pseudo-label generation, limited generalization, and computational overhead for IoT deployment, and propose targeted improvements for each. Our XGBoost-BalSamp method achieves 95.45% accuracy on UNSW-NB15, a gain of 6.26% over the baseline. Our combined deep learning approach (PseudoFilter, MixupAug, and LiteAE) achieves a best-run accuracy of 90.88% (F1: 91.45%), surpassing the base paper while reducing model parameters by 55%.These results demonstrate that targeted improvements to AOC-IDS yield consistent accuracy gains while improving practical deployability on IoT edge devices.

Hanzala Afzaal, Danish Memon, Chouhdary Bilal Raza +1

School of Electrical Engineering and Computer Science (SEECS), National University of Sciences and Technology (NUST), Islamabad, Pakistan

Internet Of Thing Intrusion Detection High Confidence Pseudo-Labels Balanced Learning Autoencoder Architectures

Ask PDF

Sep 10, 2026cs.CR

Empirical Evaluation of Data Poisoning Attacks in Supervised Learning

Data poisoning corrupts training data to degrade a model or to plant attacker-controlled behavior. This study evaluates two representative training-time attacks, label flipping and backdoor poisoning, on MNIST and Fashion-MNIST with three baseline classifiers: Logistic Regression, Linear SVM, and Random Forest. Clean training is compared with poisoning rates of 5%, 10%, and 20% using clean-test accuracy, macro-precision, macro-recall, macro-F1, and, for backdoors, attack success rate. Label flipping caused clear degradation, largest for Logistic Regression and Linear SVM, while Random Forest stayed comparatively stable. Backdoor poisoning reached attack success rates from 0.9667 to 1.0000 on both datasets and all three models while often keeping clean-test performance near baseline. The results separate indiscriminate poisoning, which shows up in standard metrics, from targeted backdoor poisoning, which stays comparatively stealthy while embedding highly effective malicious behavior, and they support security-oriented evaluation beyond conventional clean-test metrics.

Toshif Khan, Muhammad Abusaqer

Minot State University · Department of Math, Data & Technology Minot State University Minot, ND, 58707 · Trustworthy Language Intelligence Lab, Minot State University

Poisoning Training Data Attack-Success Rate Empirical Study

Ask PDF

May 6, 2026cs.CR

Gray-Box Poisoning of Continuous Malware Ingestion Pipelines

Modern malware detection pipelines rely on continuous data ingestion and machine learning to counter the high volume of novel threats. This work investigates a realistic gray-box poisoning threat model targeting these pipelines. Using the secml_malware framework, we generate problem-space adversarial binaries through functionality-preserving manipulations, specifically Import Address Table (IAT) and section injections. We evaluate the impact of these poisoned samples when ingested into a defender's training set for a LightGBM malware detection model. Our empirical results demonstrate that subtle IAT-based perturbations enable compact poisoning samples that significantly degrade detection recall. These findings illustrate the inherent challenge of developing low-visibility adversarial perturbations that maintain high poisoning efficacy within continuous learning systems. We further evaluate a defense mechanism based on a homogeneous ensemble, which successfully identifies and filters up to 95.6% of poisoning attempts while maintaining a high retention rate for legitimate data. These findings emphasize the necessity of robust pre-ingestion validation in production pipelines.

Jan Dolejš, Martin Jureček, Róbert Lórencz

Faculty of Information Technology, Czech Technical University in Prague, Thákurova 9, Prague, 16000, Czech Republic

Malware Poisoning Realistic Threat Model Precision Recall

Ask PDF