Skip to content

Data Poisoning Attack

The adversarial-ML failure mode where an attacker corrupts training inputs so the model learns an attacker-chosen behaviour — an upstream contamination that runtime defenses are structurally powerless against and that clean benchmark accuracy cannot detect.

Core Idea

A data poisoning attack is the adversarial machine-learning failure mode in which an attacker corrupts the inputs to a learning process so that the trained model's behaviour is shifted in an attacker-chosen direction at inference time — without necessarily being detected at training time, because the corrupted samples may be individually unremarkable and standard accuracy metrics may remain high on clean benchmarks. The attack is upstream of inference: unlike adversarial examples (crafted at runtime against a fixed model) or data extraction (querying a deployed model to recover protected information), data poisoning targets the training pipeline itself, exploiting the trust the pipeline places in its data sources and the inheritance of training-time properties into all downstream deployments. Named variants differ in their objective and mechanism. Label-flipping attacks relabel a fraction of correctly labelled training samples to wrong classes, shifting decision boundaries; the attack is relatively detectable by outlier inspection but effective in aggregate when the poisoning fraction is small. Clean-label backdoor attacks, demonstrated by Ali Shafahi and colleagues and extended in the Hidden Trigger Backdoor framework of Aniruddha Saha and colleagues, plant training samples that appear correctly labelled and are benign to human inspection but carry an imperceptible trigger pattern — spatial, spectral, or stylistic — so that at inference time any input carrying the trigger is misclassified to an attacker-chosen target while the model behaves normally on all other inputs. Availability attacks aim not at a specific misclassification but at general performance degradation, degrading the model for all users. Federated-learning poisoning has a participant client submit malicious gradient updates to the aggregation server, corrupting the jointly-trained model without exposing the poisoning data to any central auditor. In the large-language-model setting, poisoned web pages seeded into pretraining corpora, false information planted to be learned as fact, and jailbreak-enabling samples embedded in RLHF preference data are all instantiations of the same upstream-contamination structure applied to internet-scale data pipelines where comprehensive auditing is not tractable.

Structural Signature

Sig role-phrases:

  • the learning pipeline — the training process that ingests data from sources of varying trustworthiness and bakes their properties into the learned function
  • the trusted data sources — the inputs the pipeline accepts on faith, the trust relation the attack exploits
  • the attacker-controlled fraction — the share of training samples the adversary can inject, modify, or relabel, typically small relative to the corpus
  • the crafted contamination — the poisoned samples (flipped labels, clean-label imperceptible triggers, malicious gradient updates, seeded false facts) designed to shift the learned function in an attacker-chosen direction
  • the training-time locus — the attack sitting upstream of inference, corrupting the function as it is learned rather than the input at runtime
  • the corrupted learned function — the deployed model inheriting the contamination, misclassifying targets or firing on triggers while otherwise behaving normally
  • the inference-time trigger — the attacker-controlled condition (a trigger pattern, or any input) that activates the planted behaviour at deployment
  • the silent-failure property — the model scoring high on clean benchmarks while hiding the attacker-chosen behaviour, so accuracy fails to certify integrity
  • the upstream defense surface — data provenance, sample auditing, robust aggregation, and verifiable training, the only controls that can bite (runtime monitoring being structurally powerless)

What It Is Not

  • Not a runtime attack. It is not crafted at inference against a fixed model (an adversarial example) nor a query against a deployed model to recover protected content (extraction); it is upstream, corrupting the training inputs so the model learns the wrong function in the first place. The three look similar from outside but originate at different pipeline stages and yield to different controls, so collapsing poisoning into the runtime cases points the defense at the wrong stage.
  • Not catchable by inference-time defenses. Input filtering, output monitoring, and runtime anomaly detection are structurally powerless against it, because at inference there is nothing anomalous to catch — the model is faithfully executing the function it was taught. An operator who invests only in runtime controls will not detect or stop a poisoning attack; the defenses that bite live upstream (data provenance, sample auditing, robust aggregation, verifiable training).
  • Not revealed by benchmark accuracy. High clean-benchmark performance does not certify integrity: a clean-label backdoor model scores normally while hiding a trigger that fires only on attacker-controlled inputs. The failure is silent, so "behaves correctly on the evaluation distribution" is a strictly weaker claim than "contains no attacker-chosen behaviour," and reading clean accuracy as evidence of safety is exactly the mistake the concept exists to retire.
  • Not necessarily detectable corrupted data. Poisoned samples are not always conspicuous outliers: clean-label backdoor samples appear correctly labelled and benign to human inspection, carrying only an imperceptible trigger, and a small poisoning fraction can shift decision boundaries effectively while evading simple outlier statistics. As corpora grow to internet scale, comprehensive auditing becomes intractable, so "we'd notice bad data" understates how undetectable crafted contamination can be.
  • Not necessarily general degradation. Poisoning is not always making the model worse for everyone: targeted and backdoor variants leave it behaving normally on all inputs except the attacker's, bending one target or firing only on triggered inputs. Equating poisoning with an accuracy drop misses the most dangerous case — a model that looks healthy everywhere the operator can see and misbehaves precisely where they cannot.

Scope of Application

Data poisoning lives across the subfields of adversarial machine learning; its reach is within training-time integrity, bounded by the ML-particular machinery (gradient-update poisoning, label-flipping, the clean-label imperceptible trigger, poisoning-fraction dosage analysis) and its specific upstream defenses. The contaminate-the-substrate-a-system-learns-from shape it instances travels under corruption, feedback_loop, selective_propagation, and trust_boundary; propaganda, fake reviews, and Batesian mimicry are that shape in other substrates — not a "data poisoning" attack — and stay out of the map.

  • Supervised-learning red-teaming — standard poisoning-fraction threat models and the benchmark attacks (BadNets, Targeted Backdoor, clean-label Hidden Trigger) that shift the learned function.
  • LLM training-set contamination — poisoned web pages seeded into pretraining corpora, false content planted to be learned as fact, and jailbreak-enabling samples embedded in RLHF preference data at internet scale, where comprehensive auditing is intractable.
  • Federated learning — a participating client submitting malicious gradient updates to the aggregation server, met by Byzantine-robust aggregation.
  • Recommendation and ranking systems — review fraud, click fraud, and shill attacks poisoning the signal the recommender learns from.
  • Spam and abuse classifiers — adversaries submitting borderline content to drift the decision boundary in their favour over time.
  • Defensive research — data-provenance tracking, training-sample anomaly detection, certified robustness against poisoning fractions, and crowdsourced dataset audits, the upstream controls that can actually bite.

Clarity

Naming data poisoning fixes the stage of the pipeline where the attack lives, and that placement is what makes the defensive landscape legible. A model can misbehave because an adversarial example was crafted at runtime against a fixed model, because a deployed model was queried to recover protected content, or because the model learned the wrong function in the first place — three failures that look similar from the outside but originate at different points and yield to different controls. Holding poisoning distinct as the training-time case tells the defender that the entire inference-time toolkit — input filtering, output monitoring, runtime anomaly detection — is structurally powerless against it, because there is nothing anomalous to catch at inference: the model is faithfully executing the function it was taught. The defenses that can bite live upstream — data provenance, sample auditing, robust aggregation against malicious gradient updates, verifiable training — and the sharper question becomes not "is this input safe to process?" but "can I trust the data sources the learned function inherited from, and the inheritance itself?"

The concept's second clarifying contribution is to break the assumption that benchmark performance certifies model integrity. A clean-label backdoor model achieves high accuracy on standard clean benchmarks while carrying a hidden trigger that fires only on inputs the attacker controls — so the failure is silent, invisible to exactly the metrics operators trust most. Naming poisoning makes this silence a recognised property rather than a surprise: it forces the distinction between a model that behaves correctly on the evaluation distribution and one that contains no attacker-chosen behaviour, which are not the same claim. The practitioner who has internalised the concept stops reading clean accuracy as evidence of safety and starts asking the harder question — what does the model do on triggered inputs whose triggers were designed to be imperceptible, in a corpus too large to audit comprehensively?

Manages Complexity

The named attacks differ on every visible axis — label-flipping shifts boundaries by mislabelling, clean-label backdoors plant imperceptible triggers under correct labels, availability attacks degrade everyone, targeted attacks bend one input, federated poisoning submits malicious gradients, corpus seeding plants false facts at internet scale — and a defender who reasons attack by attack faces an unbounded, fast-multiplying catalogue with no common handle. Naming the data poisoning attack collapses that zoo onto a single locus: all of them are contamination of the training substrate, upstream of inference, to shift the learned function. The defender then stops cataloguing variants and tracks one stage and one trust relation — can the data sources the learned function inherited from be trusted, and can the inheritance itself? — and the rest of the defensive picture reads off that placement. Because the locus is training-time, the entire inference-time toolkit (input filtering, output monitoring, runtime anomaly detection) is seen to be structurally powerless before it is deployed: at inference there is nothing anomalous to catch, since the model is faithfully running the function it was taught. The same placement points to the defenses that can bite — data provenance, sample auditing, robust aggregation, verifiable training — without re-deriving them per variant. And it fixes a second load-bearing fact that would otherwise mislead: since a clean-label backdoor scores high on clean benchmarks while hiding a trigger, the locus makes the silence of the failure a predicted property, forcing the standing distinction between "behaves correctly on the evaluation distribution" and "contains no attacker-chosen behaviour," and retiring clean accuracy as evidence of integrity. A combinatorial, ever-growing menagerie of training attacks reduces to one upstream contamination locus and one trust question, from which the impotence of runtime defenses, the location of effective ones, and the unreliability of benchmark accuracy all follow.

Abstract Reasoning

Within adversarial machine learning the concept licenses reasoning moves that all run on the locus — contamination of the training substrate, upstream of inference — and the trust the pipeline places in its data.

Diagnostic — infer a training-time origin from a misbehaviour that runtime monitoring cannot see, and read the misbehaviour's profile back to a variant. The signature move locates the attack by stage: when a model misclassifies reliably on certain inputs while passing every runtime check, the analyst reasons FROM "there is nothing anomalous to catch at inference — the model is faithfully executing what it was taught" TO "the wrong function was learned in the first place, so the origin is training-time, not a crafted runtime query or an extraction." A second diagnostic move reads the shape of the misbehaviour back to a mechanism: misclassification concentrated on inputs carrying an imperceptible trigger while normal everywhere else implicates a clean-label backdoor; a broad accuracy collapse for all users implicates an availability attack; one specific input bent to a target implicates a targeted attack; a model degraded only after a particular client's participation implicates federated-learning gradient poisoning. The reasoning is FROM the observed behavioural signature TO the pipeline stage TO the specific contamination variant — an attribution the symptom "the model is wrong" cannot reach on its own.

Interventionist — move the defense upstream where it can bite, and predict the futility of runtime controls. Because the corruption is baked into the learned function, the move prescribes controls at the training substrate and predicts their reach: data provenance, sample auditing, robust (Byzantine-tolerant) aggregation against malicious gradient updates, and verifiable training are the levers, and the analyst reasons FROM "the exfiltration of integrity happens at training time" TO "defend the data sources and the inheritance, not the runtime input." The sharp interventionist prediction is again negative: reasoning FROM "at inference the model behaves normally, executing the taught function" TO "input filtering, output monitoring, and runtime anomaly detection are structurally powerless here," so the analyst forecasts that an operator who invests only in inference-time defenses will not detect or stop a poisoning attack. The move is FROM the training-time locus TO a defense placement plus a forecast that the entire runtime toolkit will miss it.

Boundary-drawing — separate poisoning from sibling attacks by pipeline stage, and "behaves correctly on the eval distribution" from "contains no attacker-chosen behaviour." A first boundary move sorts three outwardly similar failures by where they originate: an adversarial example is crafted at runtime against a fixed, correctly-trained model; data extraction queries a deployed model to recover protected content; poisoning corrupts the training inputs so the model learns the wrong function. The analyst reasons FROM "which stage was exploited" TO "which defense family applies," since training-time and inference-time toolkits do not substitute for each other. A second boundary move refuses to let benchmark accuracy certify integrity: a clean-label backdoor model scores high on clean benchmarks while hiding a trigger, so the analyst reasons FROM "high clean accuracy" NOT to "the model is safe" but TO "the model behaves correctly on the evaluation distribution — a strictly weaker claim than containing no attacker-chosen behaviour," drawing the line that the trusted metric erases.

Predictive — anticipate silent failure, small-fraction efficacy, and the limits of auditing at scale. A forward move predicts that the failure will be silent: because the trigger is designed to be imperceptible and fires only on attacker-controlled inputs, the analyst forecasts normal behaviour across all standard tests and a targeted failure exactly where it cannot be observed without knowing the trigger. A second predictive move concerns dosage and detectability: the analyst predicts that a small poisoning fraction can shift decision boundaries effectively in aggregate while remaining hard to find by simple outlier statistics, and that as corpora grow to internet scale, comprehensive auditing becomes intractable — so reasoning FROM "the corpus is too large to audit and the contamination is small and crafted" TO "seeded false facts, poisoned web pages, and backdoor samples can persist undetected into deployment," predicting that scale widens rather than narrows the attack surface.

Knowledge Transfer

Within adversarial machine learning the concept transfers as mechanism, intact. The training-time-locus diagnostic, the behavioural-signature-to-variant attribution, the upstream-defense prescription with its negative forecast about runtime controls, the pipeline-stage boundary against sibling attacks, and the silent-failure/small-fraction/scale predictions all carry without translation across the home substrate: supervised-learning red-teaming (BadNets, targeted-backdoor, clean-label Hidden Trigger), LLM training-set contamination (poisoned web pages in pretraining, false facts seeded to be learned, jailbreak samples in RLHF preference data), federated learning (malicious gradient submissions, met by Byzantine-robust aggregation), recommendation and ranking systems (review fraud, click fraud, shill attacks poisoning the learned signal), and spam/abuse classifiers (borderline content submitted to drift the boundary over time). Across these the learning system and the data change but the structure, the diagnostics, and the defense placement do not; the home domain is training-time integrity in adversarial ML as a whole.

Beyond machine learning the right reading is the shared abstract mechanism, and here the cross-domain family is unusually broad and vivid — which is precisely why the AI-specific name should not be the carrier. Stripped of ML vocabulary the pattern is contaminate the upstream substrate a system learns from, to shift the system's future behaviour (a candidate learning_substrate_contamination / corrupted-training-signal pattern), and it recurs as genuine co-instances wherever a system learns from history: propaganda and disinformation (poison the information environment a society "learns" from, to shift future beliefs and votes); fake reviews and astroturf (poison the reputational signal a market "learns" from); history revisionism and curriculum tampering (poison the substrate a generation "learns" from); Batesian mimicry as an adversarial signal (a harmless mimic poisons a predator's learned avoidance map); benchmark gaming (poison the dataset researchers "learn" what works from); survey-sampling sabotage (poison the inputs an opinion model fits). All share the structure, and none would be called "data poisoning" — the tell that the AI case is one substrate flavour of a deeper pattern rather than a structure that itself ports. That deeper pattern decomposes into catalog primes that genuinely travel: corruption (degradation of a signal or state), feedback_loop (the system learns from its environment), selective_propagation (the attacker chooses what propagates into the learned function), and a trust_boundary violation (the pipeline trusts data it should not). Those are what the cross-domain lesson should carry. The home-bound cargo is the ML-particular machinery: gradient-update poisoning, label-flipping, the clean-label imperceptible trigger, the poisoning-fraction dosage analysis, and the specific upstream defenses (data provenance, sample auditing, robust aggregation, certified robustness, verifiable training). Calling election propaganda or Batesian mimicry a "data poisoning attack" is therefore analogy; the honest move is to treat ML poisoning as the worked AI-substrate instance of the upstream-contamination family and carry corruption + feedback_loop + selective_propagation + trust_boundary across domains. See Structural Core vs. Domain Accent.

Examples

Canonical

The seminal demonstration is BadNets (Gu, Dolan-Gavitt, and Garg, 2017). The authors trained a traffic-sign classifier while injecting a small number of poisoned training images: ordinary signs with a tiny visual trigger — a yellow sticker resembling a Post-it note stuck on the sign — all labelled as the attacker's target class. The resulting network classified clean traffic signs with normal, high accuracy on the standard test set, so nothing looked wrong. But any stop sign bearing the sticker trigger at inference time was confidently misread as, for instance, a speed-limit sign. The backdoor was baked into the learned weights during training; no runtime input filter would flag the triggered image, because the model was faithfully executing the function it had been taught.

Mapped back: The injected sticker images are the crafted contamination, a small attacker-controlled fraction of the training set. Because the corruption is planted during training, it sits at the training-time locus, producing the corrupted learned function. The sticker is the inference-time trigger, and the network's normal test accuracy despite the hidden backdoor is the silent-failure property — clean accuracy failing to certify integrity.

Applied / In Practice

Carlini and colleagues (2023) showed that poisoning real, deployed web-scale datasets is not hypothetical but practical and cheap. Large image-text corpora such as LAION-400M do not store images; they store URLs pointing to images across the web. The authors demonstrated "split-view" poisoning: buy the expired domains that had hosted a fraction of those referenced images, then serve attacker-chosen content from them, so anyone who later downloads the dataset ingests the poisoned samples. They also described "frontrunning" poisoning of snapshotted sources like Wikipedia by timing malicious edits to when snapshots are taken. For a modest cost, an attacker could reliably control a small but sufficient fraction of samples in widely-used training sets — showing that as corpora scale to the whole internet, comprehensive auditing becomes intractable and the trusted-source assumption breaks.

Mapped back: The dataset's URL list and Wikipedia snapshots are the trusted data sources whose trust the attack exploits; buying expired domains lets the adversary own the attacker-controlled fraction. Serving malicious content is the crafted contamination injected at the training-time locus, and the intractability of auditing internet-scale corpora is exactly the scale limit the concept predicts widens the upstream defense surface rather than narrowing it.

Structural Tensions

T1: Precise locus versus weakest point of control (the disease sits where the operator is most helpless). Fixing the attack at the training-time locus is the concept's central clarifying gain: it tells the defender exactly why the entire inference-time toolkit — input filtering, output monitoring, runtime anomaly detection — is structurally powerless, since at deployment the model is faithfully executing the function it was taught. But that same placement is a bleak: the operator's most controllable, most instrumented, easiest-to-patch layer (runtime) is precisely where they can do nothing, and the defenses that can bite (data provenance, sample auditing, robust aggregation, verifiable training) sit at the least controllable layer — upstream, often outside the operator's ownership, at internet scale. The tension is that the concept localizes the vulnerability with great precision to the one place control is weakest, so knowing exactly where the attack lives does not translate into being able to act there. Diagnostic: Is the defensive investment placed at the training substrate where the attack actually lives, or is it accumulating at the runtime layer that is controllable but structurally blind to poisoning?

T2: Retiring benchmark trust versus leaving no positive certificate (a demolished proxy, an empty vacuum). The concept's sharpest epistemic move is to sever benchmark accuracy from integrity: a clean-label backdoor scores high on clean benchmarks while hiding a trigger, so "behaves correctly on the evaluation distribution" is strictly weaker than "contains no attacker-chosen behavior." This correctly retires the metric operators trust most. But it puts nothing positive in its place — because triggers are imperceptible and the input space is effectively unbounded, the absence of any attacker-chosen behavior cannot be demonstrated, only failed to be refuted. So the defender is moved from false assurance to no assurance: unable to rely on clean accuracy and unable to certify safety by any feasible test. The tension is that the concept convincingly destroys a bad proxy for integrity without supplying a good one, leaving verification in a permanent negative. Diagnostic: Is a claim of model safety resting on the retired proxy (clean accuracy), and if that is refused, is there any positive integrity certificate at all — or only the unprovable absence of a trigger?

T3: Small-fraction efficacy versus the value of scale (the properties that make data good make it poisonable). A small, crafted poisoning fraction can shift decision boundaries effectively in aggregate while evading simple outlier statistics, and the most dangerous variants — clean-label, imperceptible, targeted — are exactly the least detectable. Meanwhile the corpus properties that make modern models strong (internet scale, diversity, web-sourced freshness) are the same properties that make comprehensive auditing intractable and the trusted-source assumption break, as the LAION expired-domain attack showed. So detectability and danger run opposite (the conspicuous label-flip is the weak attack; the invisible backdoor is the strong one), and scaling the data to improve the model simultaneously enlarges the un-auditable attack surface. The tension is that the ingredients of a good training pipeline — scale and openness — are structurally the ingredients of a poisonable one. Diagnostic: Does the pipeline's reliance on large, open, web-sourced data create an auditing gap the attacker can hide a small crafted fraction inside — and is the danger being judged by conspicuousness rather than by imperceptibility?

T4: One unifying locus versus variant-specific countermeasures (compression that can flatten the defense). Collapsing the zoo — label-flipping, clean-label backdoors, availability attacks, federated gradient poisoning, corpus seeding — onto a single locus (training-substrate contamination) is the concept's great simplification, and it is right at the level of where to defend (all demand upstream controls, none yield to runtime ones). But the variants require materially different specific countermeasures: Byzantine-robust aggregation for malicious gradients, provenance and split-view defenses for web corpora, outlier inspection for label-flips, trigger-detection research for clean-label backdoors. So the unifying locus that clarifies the defensive stage can mislead into believing one upstream defense covers the family, and the behavioral-signature-to-variant attribution it licenses is itself under-determined (a reliable misclassification could be several variants, or an ordinary training bug). The tension is that the abstraction unifies the stage while the actual defenses and attributions remain irreducibly variant-specific. Diagnostic: Is the upstream defense matched to the specific poisoning variant in play, or is a single locus-level abstraction being trusted to cover mechanisms that need different countermeasures?

T5: Autonomy versus reduction (an ML attack class or the instance of upstream-contamination primes). Data poisoning is a named adversarial-ML failure mode with proprietary machinery — gradient-update poisoning, label-flipping, the clean-label imperceptible trigger, poisoning-fraction dosage analysis, and the specific upstream defenses (provenance, sample auditing, robust aggregation, verifiable training) — and within adversarial ML it transfers as full mechanism across supervised red-teaming, LLM corpus contamination, federated learning, recommenders, and spam classifiers. But its structure — contaminate the upstream substrate a system learns from, to shift its future behavior — recurs vividly beyond ML: propaganda poisoning the information environment a society learns from, fake reviews poisoning a market's reputational signal, curriculum tampering, Batesian mimicry poisoning a predator's learned avoidance map. None of these would be called "data poisoning," which is the tell that the AI case is one substrate flavor of a deeper pattern carried by corruption, feedback_loop, selective_propagation, and trust_boundary. The tension is between a named ML attack with specific machinery and the substrate-general learning-substrate-contamination family it instantiates. Diagnostic: Resolve toward the parents (corruption, feedback_loop, selective_propagation, trust_boundary) when carrying the poison-what-a-system-learns-from lesson to a non-ML substrate; toward the named attack when gradients, labels, triggers, and training pipelines are the actual subject.

Structural–Framed Character

The data poisoning attack sits at the mixed point of the spectrum — a sibling of cross-site scripting and data extraction through prompting: a genuine, observer-free contamination-and-learning mechanism that lives inside a human-engineered pipeline and is defined relative to a human-set notion of the model's intended behaviour.

On evaluative weight it carries a mild framing: "attack" and "poisoning" mark the contamination as a defect — but only relative to what the operator intended the model to learn, an "attacker-chosen" deviation from a designed objective. This is lighter than a moral verdict and grounded in a concrete learning mechanism, yet it is not the pure neutrality of feedback. On human_practice_bound it patterns partly structural, partly framed: the mechanism runs observer-free — a model learns whatever its training data teaches, and executes the corrupted function whether or not anyone is watching — so it is not practice-bound the way a code-smell verdict is; but the substrate (learning pipelines, training corpora, aggregation servers) is a built environment, and "attacker-controlled" presupposes an intended-function baseline that is set, not given. Its institutional_origin is accordingly pronounced: the ML pipeline is engineered, and the concept is named within an adversarial-ML research discourse — the integrity model against which "contamination" is defined is a human design. On vocab_travels it scores low: gradient-update poisoning, label-flipping, clean-label triggers, poisoning-fraction dosage, and RLHF are pinned to the ML substrate and rename off it. And import_vs_recognize is bimodal in the entry's own sharp terms — within adversarial ML the failure is recognized intact, while its cross-substrate cousins (propaganda, fake reviews, curriculum tampering, Batesian mimicry) are carried by the parents as co-instances, and — the entry's own tell — none of them would be called "data poisoning," so the ML case is one substrate flavour of a deeper pattern, not a structure that itself ports.

The one portable structural skeleton is upstream contamination of a learning substrate — corrupt the substrate a system learns from, in a selectively-chosen way, to shift the system's future behaviour, exploiting the trust the learning process places in its inputs. This decomposes into corruption (degradation of a signal or state), feedback_loop (the system learns from its environment), selective_propagation (the attacker chooses what propagates into the learned function), and a trust_boundary violation. That skeleton is genuinely substrate-spanning and recurs vividly wherever a system learns from history, which tempts a structural reading. But it does not pull data poisoning off the mixed point, because that upstream-contamination structure is exactly what the entry instantiates from those parents, not what makes "data poisoning attack" itself travel: the cross-domain reach belongs to corruption/feedback_loop/selective_propagation/trust_boundary, while the gradient/label/trigger machinery, the poisoning-fraction dosage analysis, and the ML-tuned upstream defenses — the distinctive layer — stay home. Its character: a real, observer-free learning-corruption mechanism carrying a defect verdict relative to a designed integrity goal and running inside a wholly engineered ML pipeline, structural only in the upstream-contamination skeleton it borrows from its parents and mixed in every distinctively training-pipeline accent.

Structural Core vs. Domain Accent

This section decides why the data poisoning attack is a domain-specific abstraction and not a prime, and it carries the case for its domain-specificity — there is no separate section for that.

What is skeletal (could lift toward a cross-domain prime). Strip the machine learning away and a thin relational structure survives: corrupt the upstream substrate a system learns from, in a selectively-chosen way, to shift the system's future behaviour — exploiting the trust the learning process places in its inputs, so the failure is baked in before the system ever runs. The portable pieces are abstract — a learning process that inherits the properties of what it ingests, a small attacker-controlled fraction of that input, a selective contamination aimed at a chosen future behaviour, and a trust relation between the process and its sources that the attack violates. That upstream-learning-substrate-contamination skeleton is genuinely substrate-portable: it recurs, as the entry stresses, as vivid co-instances wherever a system learns from history — propaganda poisoning the information environment a society learns from, fake reviews poisoning a market's reputational signal, curriculum tampering, benchmark gaming, and Batesian mimicry poisoning a predator's learned avoidance map. That recurrence is mechanism, which is why the entry decomposes the attack into its parents — but it is the core data poisoning shares, not what makes it a data poisoning attack.

What is domain-bound. Almost everything that makes the concept a data poisoning attack in particular is adversarial-ML furniture and none of it survives extraction intact: the ML-particular machinery (gradient-update poisoning, label-flipping, the clean-label imperceptible trigger, the poisoning-fraction dosage analysis); the substrate objects (training corpora, aggregation servers, RLHF preference data); the silent-failure diagnostic keyed to clean-benchmark accuracy; the specific upstream defenses (data provenance, sample auditing, Byzantine-robust aggregation, certified robustness, verifiable training); and the empirical cases — the BadNets sticker backdoor, the LAION expired-domain split-view poisoning. These are the worked vocabulary, techniques, and cases the discipline actually studies. The decisive test is the entry's own tell: the cross-substrate cousins — election propaganda, astroturf reviews, Batesian mimicry — would never be called "data poisoning," which is exactly the sign that the ML case is one substrate flavour of a deeper pattern; remove the learning pipeline and its gradients, labels, and triggers and what remains is bare upstream contamination of what-a-system-learns-from, a looser and more general thing.

Why this does not clear the prime bar. A prime is a relational structure whose vocabulary travels and whose cross-domain transfer is recognition of the same mechanism, not analogy. Data poisoning's transfer is bimodal. Within adversarial machine learning the mechanism travels intact — the training-time-locus diagnostic, the behavioural-signature-to-variant attribution, the upstream-defense prescription with its negative forecast about runtime controls, the pipeline-stage boundary against sibling attacks, and the silent-failure/small-fraction/scale predictions all keep their meaning across supervised red-teaming, LLM corpus contamination, federated learning, recommenders, and spam classifiers, because each is the same training-time-integrity threat with different learning systems and data. Beyond ML, calling election propaganda or Batesian mimicry a "data poisoning attack" is analogy — the named construct does not port. And when the bare structural lesson is needed cross-domain, it is already carried, in more general form, by the parents data poisoning instantiates: degradation of a signal or state is corruption; a system learning from its environment is a feedback_loop; the attacker choosing what propagates into the learned function is selective_propagation; and the pipeline trusting data it should not is a trust_boundary violation. The cross-domain reach belongs to those parents; "data poisoning attack," as named, is the worked AI-substrate instance of the upstream-contamination family, carrying gradient/label/trigger machinery that does not and should not travel.

Relationships to Other Abstractions

Local relationship map for Data Poisoning AttackParents appear above the current abstraction, mutual partners to the right, and children below. Node labels state whether each abstraction is prime or domain-specific; colors identify relation types.Data Poisoning AttackDOMAINPrime abstraction: Learning-Substrate Contamination — is a decomposition ofLearning-Substr…PRIMEDomain-specific abstraction: Model Skewing — is a kind ofModel SkewingDOMAIN

Current abstraction Data Poisoning Attack Domain-specific

Parents (1) — more general patterns this builds on

  • Data Poisoning Attack is a decomposition of Learning-Substrate Contamination Prime

    Data poisoning is learning-substrate contamination specialized to ML training data, labels, gradients, triggers, and training-pipeline defenses.

Children (1) — more specific cases that build on this

  • Model Skewing Domain-specific is a kind of Data Poisoning Attack

    Model skewing is data poisoning specialized to a clean-launched, continuously or periodically updating deployment whose production stream is biased gradually after launch.

Hierarchy paths (2) — routes to 2 parentless roots

Not to Be Confused With

  • Adversarial example (evasion attack). A perturbation crafted at inference time against a fixed, correctly-trained model to force a misclassification on that specific input — the model was taught right but is fooled at runtime. Poisoning is upstream: it corrupts the training inputs so the model learns the wrong function to begin with. Tell: was the model taught wrong (poisoning, defend upstream) or fooled at runtime while correctly trained (adversarial example, defend at inference)? Different pipeline stage, different defenses.

  • Data extraction through prompting. The sibling failure that queries a deployed model to recover protected content it internalised (training text, system prompt). Poisoning runs the opposite direction: it injects content to shape future behaviour. One reads data out of a trained model; the other writes bad data into training. Tell: is the attack pulling protected information out (extraction) or planting contamination in (poisoning)? Read versus write, inference versus training.

  • Backdoor / trojan (as such). The planted hidden behaviour — a trigger that flips outputs — is the goal; clean-label backdoor poisoning is one route to install it, but a backdoor can also be inserted by tampering with weights or code directly, with no data poisoning at all. Tell: is the referent the malicious behaviour itself (backdoor/trojan, the end) or installing it by corrupting training data (poisoning, one means)? Poisoning is a delivery mechanism; the backdoor is the payload.

  • Weight poisoning / model supply-chain tampering. Corrupting the trained model artifact itself — altered weights, a trojaned checkpoint pulled from a hub, compromised training code. Data poisoning instead corrupts the training data, letting the learning process bake in the behaviour. Both are training-adjacent, but the attack surface differs — the dataset versus the model binary/pipeline. Tell: did the adversary tamper with the data the model learns from (data poisoning) or the weights/code/artifact directly (supply-chain/weight poisoning)?

  • Concept drift / distribution shift. The benign, non-adversarial degradation of a model as the world changes and the deployment distribution diverges from training — no attacker, no crafted contamination. Poisoning is deliberate and attacker-chosen. Tell: is the performance change caused by the world naturally moving away from the training distribution (drift) or by an adversary deliberately corrupting the training signal (poisoning)? Nature versus adversary.

  • The corruption / feedback-loop / selective-propagation / trust-boundary parents (umbrella). The substrate-neutral primes the attack instantiates — corruption (signal/state degradation), feedback_loop (a system learning from its environment), selective_propagation (the attacker choosing what enters the learned function), and a trust_boundary violation. Not confusable peers but the generalization: propaganda, fake reviews, and Batesian mimicry are co-instances, and none would be called "data poisoning." Tell: the parents carry the poison-what-a-system-learns-from lesson to any substrate; "data poisoning attack," treated more fully in a later section, is the ML-substrate instance with gradients, labels, and triggers.

Neighborhood in Abstraction Space

Data Poisoning Attack sits in a moderately populated region (49th percentile for distinctiveness): it has near-neighbors but no dense thicket of look-alikes.

Family — Statistical Inference & Model Failure Modes (16 abstractions)

Nearest neighbors

Computed from structural-signature embeddings · 2026-07-12