# Privacy Auditing in Differential Private Machine Learning:
## 3 Privacy Attacks
### Type of Attacks
#### 3.3.2 Data-Poisoning Attack  
In data-poisoning attacks, malicious data are injected into the training set in order to influence the behavior of the model. These attacks, whether untargeted (random) or targeted [54,121], are a form of undermining the functionality of the model. Common approaches are to either reduce the accuracy of the model (random) or manipulate the model to output a label specified by the attacker (targeted) to reduce the performance of the model or cause targeted misclassification or misprediction. If the attacker tries to elicit a specific behavior from the model, the attack is called targeted. A non-targeted attack, on the other hand, means that the attacker is trying to disrupt the \"overall functionality of the model\". Targeted or non-targeted poisoning attacks can include both model poisoning and data-poisoning attacks. The impact of poisoning attacks, for example, causes the classifier to change its decision boundary and achieve the attacker's goal of violating privacy [121]. In the context of DP, during data-poisoning attacks [55,122], the attacker manipulates and falsifies the model at the time of its training or during the inference time of the model by injecting adversarial examples into the training dataset [54]. In this way, the behavior of the model is manipulated, and meaningful information is extracted. Poisoning attacks are not only limited to training data points; they also target model weights. Among these threats, data poisoning stands out due to its potential to manipulate and undermine the integrity of AI-driven systems. It is worth noting that this type of attack is not directly related to data privacy but still poses a threat to ML modeling [123]. In model poisoning, target model poisoning aims to misclassify selected inputs without modifying them. This is achieved by manipulating the training process. Data-poisoning attacks are relevant for DP auditing as they can expose potential vulnerabilities in privacy-preserving models. The DPs typically consist of five main types (as shown in Table 1):  
**Gradient manipulation attacks:** In gradient manipulation attacks, especially gradient inversion attacks [96,124], the attacker manipulates the gradient update by injecting false or poisoned gradients that either distort the decision boundary of the model or lead to overfitting. These attacks allow the attacker to reconstruct private training data from shared gradients and undermine the privacy guarantees of ML models. This approach also aims to investigate whether gradient clipping and noise addition can effectively protect against excessive influence of individual gradients. **Targeted label flipping:** This involves modification of the labels of certain data points in the training data without changing the data themselves, especially those in sensitive classes [125]. The attacker then checks whether this modified information can be restored from the model. **Influence limiting:** To assess how DP mechanisms limit the influence of any single data point, poisoned records are inserted into the training data to see if their impact on the model predictions and accuracy can be detected [126]. **Backdoor poisoning attacks**: This type of attack aims to insert a specific trigger or \"backdoor\" [127, 128, 129] that later manipulates the behavior of the model when it is activated in the testing or deployment phase. If the model is influenced by the backdoor pattern in a way that compromises individual data points, this may indicate vulnerability to targeted privacy risks. These types of attacks are often evaluated against specific target perturbation learners. The attacker intentionally disrupts some training samples to change the parameter distribution [130]. Among these threats, data poisoning stands out due to its potential to manipulate and undermine the integrity of ML-driven systems. These attacks were developed for image datasets [129]. In the original backdoor attacks, the backdoor patterns are fixed [131], e.g., a small group of pixels in the corner of an image.