## 3 Methodology
### Threat Model  
This section describes the threat model and the information the attacker should know to poison the feature space. The assumption of this study is that the attacker does not have access to learning algorithms or modeling procedures, but he/she has the power to access the training data set and modify a percentage of it (identified by the parameter \(P_{\text{S}}\)) in different ways: either changing the label value or the features values [9]. Three different attacks are considered in this study:  
1. The first attack is also called the label flipping attack, where the attacker has knowledge of the label and changes its value to the other class (e.g., LOS to NLOS or vice versa). 2. The second attack is clean-label poisoning where the attacker cannot change the label but he/she can change the values of the features. 3. The third attack is a variation of the second attack where the attacker has also knowledge of the most likely value of the feature for each sample. The first attack, the label flipping attack, is one of the first considered attacks [21; 22] in the literature. In this study, a random flipping attack is implemented where the attacker has knowledge of the label and changes its value to the other class (e.g., LOS to NLOS or vice versa). The values of the features remain unchanged. The algorithm describing this attack is shown in Algorithm 1. Even if it is relatively old in the research literature, this attack is still addressed in this study because it is relatively difficult for the unsupervised OD algorithms considered in this paper to mitigate. This attack will be identified with the term LF in the rest of this paper. In the subsequent algorithms, the training data set is defined as \(S_{Train}=(x_{i},y_{i})_{i=1}^{n}\), where \(x_{i}\in[0,1]^{d}\) are the feature vectors with d features and \(y_{i}\) are the target values of labels (i.e., 0 or 1 for the binary classification problem considered in this study). ```
1:procedureFL(\(S_{Train},P_{S}\))
2:T = random select (\(S_{Train},P_{S}\));
3:m = size(T)
4:for\(i\gets 1,m\)do
5:y = label(\(T_{i}\))
6:if\(y==0\)then
7:y = 1
8:else
9:y = 0
10:endif
11:endfor
12:return\(S_{Pois}\)
13:endprocedure
```  
**Algorithm 1** Random label flipping algorithm  
The second attack is a clean-label poisoning attack where the attacker cannot change the label but he/she can change the values of the features. This may happen if the information and the label are kept separated from the features. This attack can be implemented with different levels of severity, which is regulated by the hyper-parameter \(S_{P}\) in this study. In practical terms, a weighted sum is calculated with the initial value of the feature plus a random value between 0 and 1 (note that all the features are normalized between 0 and 1 as described before). The corresponding algorithm description is provided in Algorithm 2, where \(xp_{i,j}\) is the new value of the poisoned feature that is going to create the new poisoned training set \(S_{Pois}\), i is the index of the sample, which is equal to 1... (\(T_{P}\times S_{Train}\)), and j is the index of the feature with j = 1...18. \(xv_{ij}\) is the value of the original feature, \(R_{ND}\) is the random function, which returns a value between 0 and 1, and \(S_{P}\) is the severity of the attack meant as the weight of the perturbation on the feature values. \(S_{Train}\) is the number of samples in the training set, which is equal to 2250 samples in this study. This attack will be identified with the term FSP in the rest of this paper.