Research map / Label-efficient and robust learning / Noisy labels
The Implicit Bias of Structured State Space Models Can Be Poisoned With Clean Labels
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Shows theoretically and empirically that adding a single cleanly labeled sequence with large trailing elements to an SSM's training set can distort gradient-flow implicit bias and destroy length generalization (clean-label poisoning).
Problem
Prior work showed gradient flow over SSMs implicitly finds generalizing solutions with a low-dimensional teacher when training on infinite Gaussian data; it is unknown whether this holds for finite training sets, where cleanly labeled examples might disrupt generalization.
Approach
Derives a dynamical characterization of gradient flow over SSM diagonal state matrices showing greedy low-rank learning is impeded when training sequences have large trailing elements; uses this with a non-resonance linearization theorem to prove that adding one cleanly labeled sequence with large last elements causes non-generalization, and extends the phenomenon empirically to S4, Mamba-2, and L
Key results
- In the single-example teacher-student setting, adding one cleanly labeled sequence with large trailing elements raises normalized generalization error from 1.27e-3 to 5.01e-2 (SSM) and 1.64e-3 to 5.45e-2 (SSM in MLP network).
- On sequential CIFAR-10, clean-label poisoned examples increase test loss for S4 from 0.739 to 0.839, Mamba-2 from 1.005 to 1.178, and LRU from 0.892 to 1.111.
- Accuracy drops with poisoning: S4 78.8% to 76.9%, Mamba-2 77.8% to 75.1%, LRU 72.4% to 68.3%.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Add special cleanly labeled sequences | SSM · Teacher-student setting per theorem | generalization error: $1.27\times 10^{-3}$ -> $5.01\times 10^{-2}$ | Hurt |
| Add special cleanly labeled sequences | Standalone SSM · Standalone SSM beyond theorem | generalization error: $0.194$ -> $16.62$ | Hurt |
| Add special cleanly labeled sequences | SSM in non-linear neural network · SSM in non-linear neural network | generalization error: $1.64\times 10^{-3}$ -> $5.45\times 10^{-2}$ | Hurt |
| Add cleanly labeled poisonous examples | S4 · CIFAR-10 test set | cross-entropy loss: $0.739$ -> $0.839$ | Hurt |
| Add cleanly labeled poisonous examples | S4 · CIFAR-10 test set | classification accuracy: $78.8\%$ -> $76.9\%$ | Hurt |
| Add cleanly labeled poisonous examples | Mamba-2 · CIFAR-10 test set | cross-entropy loss: $1.005$ -> $1.178$ | Hurt |
| Add cleanly labeled poisonous examples | Mamba-2 · CIFAR-10 test set | classification accuracy: $77.8\%$ -> $75.1\%$ | Hurt |
| Add cleanly labeled poisonous examples | LRU · CIFAR-10 test set | cross-entropy loss: $0.892$ -> $1.111$ | Hurt |
| Add cleanly labeled poisonous examples | LRU · CIFAR-10 test set | classification accuracy: $72.4\%$ -> $68.3\%$ | Hurt |
Surprising findings
- Adding cleanly labeled, teacher-consistent examples can destroy length generalization that was otherwise attained by implicit bias.
- Standalone SSM beyond the theory setting shows generalization error rising from 0.194 to 16.62 with special sequences.
Limitations
- Theory covers a restricted setting (near-zero initialization, diagonal A, fixed B and C, single-example base training set).
- Guarantees hold for open sets of initializations that may have small volume.
- Experiments use near-zero initialization and small scale, not modern SSM initializations.
Experimental setup
Datasets: CIFAR-10 (sequential variant) synthetic teacher-labeled sequences
Benchmarks: CIFAR-10 (sequential)
Metrics: generalization error over sequence length (impulse response) cross-entropy loss classification accuracy
Baselines: S4 Mamba-2 LRU
Builds on: implicit bias of SSMs (Cohen-Karlik et al.) greedy low rank learning gradient matching for poisoning non-resonance linearization theorem
Closest papers by meaning
- Understanding Nonlinear Implicit Bias via Region Counts in Input Space (ICML 2025 · similarity 0.87)
- Feature Contamination: Neural Networks Learn Uncorrelated Features and Fail to Generalize (ICML 2024 · similarity 0.87)
- Weak-to-Strong Generalization Even in Random Feature Networks, Provably (ICML 2025 · similarity 0.85)
- Understanding Domain Generalization: A Noise Robustness Perspective (ICLR 2024 · similarity 0.85)
- Initial Guessing Bias: How Untrained Networks Favor Some Classes (ICML 2024 · similarity 0.85)
- Tuning Frequency Bias of State Space Models (ICLR 2025 · similarity 0.85)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.