New Audit Framework Detects Data Poisoning in Causal Effect Estimates

Observational causal analyses increasingly combine data from multiple sites, vendors, and collection systems, which creates opportunities for adversaries to inject strategically selected plausible records that alter reported treatment effects. Kwangho Kim's new paper provides a rigorous audit framework to detect such data-poisoning attacks. The method focuses on augmented inverse-probability-weighted (AIPW) estimation and requires the analyst to specify a finite catalog of feasible records, an append budget, and nested capacities for each data source. The adversary selects a subset of records to maximize movement in a prespecified direction. With preprocessing and nuisance fits held fixed, a greedy scan computes the exact finite-sample worst-case movement at each append budget, giving analysts a clear picture of maximum potential distortion.

To account for the more realistic scenario where nuisance models are refitted after poisoning, the author derives a total-influence score that combines each record's direct contribution with its effect through the propensity and outcome models. A conservative finite-budget bound for the fully refitted estimate is also provided. Extensive simulations validate that the exact greedy scan results are correct, and the total-influence score improves local refit prediction. Multi-site and public-data analyses demonstrate material sensitivity even at small append budgets. By translating adversarial data-composition risk into movement curves and critical budgets, the framework enables more reliable causal reporting and the design of targeted source-level safeguards against manipulation.