Data-Poisoning Audits for Causal Effect Estimation

2026-07-23 · Source: stat.ML updates on arXiv.org · Field: Technology & Digital — Artificial Intelligence & Machine Learning, Data Science & Analytics, Cybersecurity & Data Privacy · Depth: Expert, extended

Summary

A new data-poisoning audit framework addresses the vulnerability of observational causal analyses, particularly those pooling records across diverse sources, to append-only attacks. These attacks strategically add plausible records to alter a reported treatment effect. The framework, designed for augmented inverse-probability-weighted (AIPW) estimation, requires an analyst to specify a finite catalog of feasible records, an append budget, and nested source capacities. It proposes a greedy scan to compute the exact finite-sample worst-case movement when preprocessing and nuisance fits are held fixed. For scenarios involving nuisance refitting, a total-influence score is derived, combining direct record contribution with its effect through propensity and outcome models. Additionally, a conservative finite-budget bound is provided for fully refitted estimates. Extensive simulations validate the exact results, demonstrating material sensitivity at small append budgets in multisite and public-data analyses. This framework translates adversarial data-composition risk into quantifiable movement curves and critical budgets, supporting more reliable causal reporting and the design of source-level safeguards.

Key takeaway

For AI Scientists and Data Scientists evaluating the reliability of causal effect estimates from pooled observational studies, traditional robustness checks are insufficient against strategic data additions. You should implement data-poisoning audits to proactively assess the vulnerability of your causal pipelines. Use the audit's movement curves and critical budgets to understand potential estimate shifts, design source-level safeguards, and inform more transparent causal reporting, especially in high-stakes applications.

Key insights

Data-poisoning audits quantify causal estimate vulnerability to strategic record additions under capacity constraints.

Principles

• Causal estimates from pooled observational data are vulnerable to append-only attacks.
• Robustness guarantees against model error do not protect against strategic data composition changes.
• Inverse-propensity-weighted outcome residuals can become large, creating attack surfaces.

Method

Specify a feasible record catalog, nested source capacities, and an append budget. Use a greedy scan for fixed-pipeline movement or total-influence for refit-aware ranking.

In practice

• Quantify vulnerability by translating adversarial risk into movement curves.
• Use decision-instability budgets to find minimum records needed to cross thresholds.
• Evaluate inverse-weight capping for clean-data precision versus poisoning exposure.

Topics

• Causal Inference
• Data Poisoning
• Adversarial Robustness
• Average Treatment Effect
• AIPW Estimation
• Influence Functions

Best for: Research Scientist, CTO, VP of Engineering/Data, AI Scientist, Data Scientist, AI Security Engineer

Related on AIssential

• Data-Poisoning Audits for Causal Effect Estimation — Observational causal analyses pooling data are vulnerable to append-only attacks, requiring auditing.
• Adaptive auditing of AI systems with anytime-valid guarantees — Adaptive AI auditing can achieve statistical rigor using dueling hypotheses and anytime-valid e-processes, even with small, flexible datasets.
• On the Relevance of Byzantine Robust Optimization Against Data Poisoning — Byzantine ML offers optimal robustness against both arbitrary worker deviations and localized data poisoning threats.
• Membership Inference Attacks for Unseen Classes — Existing MIAs fail when auditors lack representative "unseen class" data, making quantile regression attacks superior for real-world auditing.
• In the face of rampant AI, is ‘data poisoning’ a new form of civil disobedience? — Data poisoning is an accessible form of AI resistance, raising complex ethical and legal questions regarding its use against perceived AI harms.
• Phantoms and Disclosures: a Causal Framework for Auditing Synthetic Data — A causal auditing framework distinguishes true from phantom synthetic data disclosures using statistical tests and held-out data.

See Counsel's argued verdicts on the open AI decisions leaders are weighing →

Open in AIssential →

Editorial summary, takeaway, and curation by AIssential. Original article published by stat.ML updates on arXiv.org.