BROWSER EXPERIMENT / SYNTHETIC TRAINING DATA
Move class-B training points toward class A. Compare a mean-centroid classifier with a median-centroid defense on the same fixed query.
Cyan: A · Amber: B · Red: poisoned B · White cross: fixed class-A query. Dashed vertical lines: mean (red) and median (cyan) decision boundaries.
80 points per class; only x determines classification. The attacker shifts the first k class-B training points by -ε without changing labels. The defense replaces the mean with the median; it does not know which samples were modified. A fixed class-A query at x = -0.12 is evaluated against the midpoint of the two class centers. Displayed class-B probability is sigmoid(20 × (query - boundary)): an illustrative score, not a calibrated security-risk estimate. Median defense can fail when contamination dominates. No neural network is trained, and no claim is made about the paper's benchmark performance.