Model Skewing¶

The adversarial AI-security attack in which a stream of individually-unflaggable, region-biased inputs to an online learning loop gradually pulls a model's decision boundary off the deployer's criterion toward one the attacker prefers — capturing a deployment that launched clean.

Core Idea¶

Model skewing is the adversarial AI-security failure mode in which an attacker, operating across a sequence of training updates or a continuous learning loop, gradually pulls the model's learned decision boundary away from the criterion the deployer intended and toward a region the attacker prefers. The skew is rarely a single dramatic shift; it is an accumulated drift produced by a stream of adversarially-shaped inputs — borderline content submitted to a content classifier, slow behavioural changes by accounts under abuse-detection surveillance, coordinated click and dwell-time signals from sock-puppet accounts feeding a recommender's reward signal, subtly biased preference labels injected into an RLHF pipeline. Each individual input is too small to flag as an anomaly; the population of inputs, systematically biased toward the attacker's preferred region, biases the gradient or the effective training distribution and so biases the decision boundary.

The structural commitment is the online or quasi-online nature of the learning loop — a deployed system that continues to update from production traffic or user feedback — combined with the attacker's ability to durably influence what the loop ingests. This distinguishes model skewing from its closest neighbour: classic data-poisoning targets a one-shot or batch training run, producing a corrupted model at deployment; model skewing targets a continuously-retraining or fine-tuning deployment, progressively shifting a model that was clean at launch. It also distinguishes skewing from evasion: evasion crafts inputs that defeat the current model at inference time without modifying the model; skewing modifies the model so that subsequent inference is permanently biased toward the attacker's preferred outputs.

Because the attack signature is a slow distributional shift, it is structurally indistinguishable from legitimate concept drift — the natural phenomenon of a real-world distribution changing over time — unless the defender monitors for attacker-relevant features specifically rather than just aggregate distributional change. The defence menu therefore requires infrastructure beyond per-input checks: provenance and rate limiting on training-stream contributions, reference-model anchoring (comparing the live model against a frozen baseline on a held-out distribution), batch-level outlier rejection using robust statistics, distribution-drift monitoring with attacker-relevant stratification, and periodic human-loop re-anchoring of the intended decision criterion. In federated settings, Byzantine-robust aggregation (Krum, coordinate-wise median, trimmed mean) defends against participants submitting many subtly biased gradient updates across rounds.

Structural Signature¶

Sig role-phrases:

the online learning loop — a deployed system that keeps updating from production traffic or user feedback, the precondition that separates skewing from batch poisoning
the intended decision criterion — the original training-time boundary the deployer meant the model to hold
the durable stream influence — the attacker's ability to shape what the loop ingests over time, not just a one-shot input
the individually-unflaggable inputs — each adversarially-shaped sample too small and too borderline to reject on its own
the systematically biased population — the aggregate of those inputs, skewed toward the attacker's preferred region, that biases the gradient or effective training distribution
the drifting boundary — the learned decision surface progressively pulled off-criterion toward the attacker's region, so later malicious inputs survive that earlier ones would not
the concept-drift confound — the attack signature being structurally indistinguishable from benign distributional change at the aggregate level, resolvable only by attacker-relevant stratification
the loop-level defense surface — provenance and rate limits, reference-model anchoring against a frozen baseline, batch robust statistics, Byzantine-robust aggregation, and periodic human re-anchoring, acting on the stream rather than the input

What It Is Not¶

Not a single dramatic poisoning event. The skew is rarely one large shift; it is accumulated drift produced by a stream of adversarially-shaped inputs, each too small and too borderline to flag, that collectively bias the gradient toward the attacker's region. Looking for a discrete malicious batch misses an attack whose whole signature is the slow, distributed pull of a biased population.
Not batch data poisoning. It does not corrupt a one-shot or batch training run so the model ships compromised; it progressively shifts a model that launched clean by biasing what a still-learning loop ingests post-deployment. A system immune to batch poisoning because it trains once on a vetted corpus becomes skewable the moment it starts updating from production traffic — so the two share a parent but differ in the precondition (an online or quasi-online loop) that defines this one.
Not evasion. Evasion crafts a single input to defeat the current model at inference time without modifying it; skewing durably modifies the model so that subsequent inference is permanently biased toward the attacker's outputs. The difference is whether the model is touched: skewing's payoff is that later malicious inputs survive because the boundary has been moved to meet them, not because any one input slipped past.
Not distinguishable from benign concept drift by aggregate statistics. A monitor watching only overall distributional change cannot tell adversarial steering from the real-world distribution simply moving — the two are structurally identical at the aggregate level. The attribution is decidable only by stratifying along attacker-relevant features: drift concentrated there is skewing, drift spread broadly is likely genuine concept drift. Assuming any drift detector catches it is exactly the failure the concept warns against.
Not catchable by per-input filtering. Because each adversarial input is individually unflaggable, screening inputs one at a time cannot bite; the relevant unit of analysis is the stream, not the input. The defenses that work act on the loop — provenance and rate limits, reference-model anchoring against a frozen baseline, batch-level robust statistics, periodic human re-anchoring — so a defense built only of input checks leaves the deployment open to capture.

Scope of Application¶

Model skewing lives across the subfields of online and adversarial machine learning; its reach is within capture of continually-learning deployments, bounded by the ML-particular machinery (the gradient/effective-training-distribution mechanism, the online-loop architecture, the concept-drift-versus-attack stratification problem, reference-model anchoring, Byzantine-robust aggregation). The drift-of-a-criterion-under-adversarially-biased-evidence shape it instances travels under feedback_loop, corruption, drift, and performativity (within learning_substrate_contamination); regulatory or diagnostic-threshold drift is that shape in another substrate — not "model skewing" — and stays out of the map.

Online content moderation — borderline submissions and user-flag-spamming pulling the trained boundary toward attacker tolerance over weeks.
Spam-and-abuse classifiers — coordinated borderline messages at scale widening the decision boundary so later, more obviously malicious messages survive.
Recommender and ranking systems — the shill-attack literature: coordinated clicks, dwell time, fake reviews, and shilled engagement biasing the learner toward attacker-promoted content.
Adversarial RLHF and preference-learning — a fraction of labellers systematically biased toward a response style shifting the trained reward model.
Continual-learning deployments — any system updating from production traffic, defended with update batching, batch-level outlier rejection, distribution monitoring, and rollback.
Federated learning (slow Byzantine attacks) — a participant submitting many subtly biased gradient updates across rounds, met by Byzantine-robust aggregation (Krum, coordinate-wise median, trimmed mean).

Clarity¶

Naming model skewing carves a distinct attack out of a family that AI-security practice tends to lump together. It separates the temporally-distributed, boundary-drifting attack from two neighbours it is easily mistaken for: classic data poisoning, which corrupts a one-shot or batch training run so the model ships compromised, and evasion, which crafts a single input to defeat the current model at inference time without touching the model at all. Skewing is neither — it is the slow capture of a deployment that launched clean, by an attacker who durably biases what a still-learning loop ingests. Holding it apart matters because the entry point is different: skewing presupposes an online or quasi-online learning loop and an adversary who can shape the production stream over time, so a system immune to batch poisoning (because it trains once on a vetted corpus) can still be skewed the moment it starts updating from user traffic.

The sharper question the concept forces is a detection one: is this distributional shift legitimate concept drift, or an adversary steering the boundary? Because the attack signature is a slow change in the effective training distribution, it is structurally indistinguishable from the real-world distribution simply moving — unless the defender stratifies monitoring by attacker-relevant features rather than watching aggregate drift alone. Naming the attack makes that the explicit design question and reframes the defence problem away from per-input filtering, which cannot catch inputs each too borderline to reject, toward loop-level infrastructure: reference-model anchoring against a frozen baseline, batch-level robust statistics, provenance and rate limits on training-stream contributions, and periodic human re-anchoring of the intended criterion. The distinction tells the defender that the relevant unit of analysis is the stream, not the input.

Manages Complexity¶

Attacks on deployed learners present, surface by surface, as unrelated abuse problems: borderline content gaming a moderation classifier over weeks, sock-puppet clicks shilling a recommender, coordinated spam slowly degrading a filter, biased labellers warping a reward model, Byzantine participants nudging a federated aggregate across rounds. Each comes wrapped in its own product vocabulary — flags, dwell time, reviews, preference labels, gradient updates — and invites a bespoke response. Naming model skewing compresses that sprawl to a single mechanism with two defining conditions: a learning loop that keeps updating from production traffic, and an adversary who can durably bias what that loop ingests. Once those two conditions are the object of analysis, the diverse abuse campaigns stop being separate threats and become one phenomenon — a stream of individually-unflaggable inputs, collectively biased toward the attacker's region, dragging the boundary — instantiated on different feedback channels. The per-surface menagerie reduces to a stream and a boundary.

That compression buys two things the analyst can then read off directly. First, it fixes the unit of analysis: not the input but the stream, which immediately explains why per-input filtering cannot help (every input is too borderline to reject) and collapses the otherwise-scattered defence techniques — provenance and rate limits, reference-model anchoring, batch-level robust statistics, Byzantine-robust aggregation, periodic human re-anchoring — into one kind of move, constraining what the loop ingests and detecting when its boundary has drifted. Second, it sharpens the detection problem to a single binary the analyst must resolve for any observed shift: is this legitimate concept drift or an adversary steering the boundary? Because the two are structurally identical at the level of aggregate distribution, that question has a determinate answer only along one axis — whether the drift is concentrated in attacker-relevant features — which tells the defender exactly where to stratify monitoring. So a manager of many continually-learning deployments need not reason from scratch about each abuse vector; they ask whether the loop is online and whether an adversary can shape its stream (the gate that separates skewing from batch poisoning), and then track one thing — boundary drift against a frozen reference, stratified by attacker-relevant features — reading the threat off it. A high-dimensional "which of my deployments can be captured, and how would I see it?" problem collapses to two preconditions and one stratified drift signal.

Abstract Reasoning¶

Within online and adversarial machine learning the concept licenses reasoning moves that all take the stream, not the input, as the unit of analysis and watch the learned boundary for adversarial drift.

Diagnostic — when the boundary moves, decide whether it is legitimate concept drift or an adversary steering, by checking where the drift concentrates. The signature move refuses to read a single input as the attack and instead reads the aggregate: because each adversarial input is too borderline to flag, the analyst reasons FROM "no individual input is anomalous, yet the decision boundary has drifted toward a region attackers prefer" TO "a systematically biased population of inputs is dragging the gradient." The central diagnostic then resolves a binary that aggregate statistics alone cannot: is this drift the real-world distribution moving (benign concept drift) or an adversary steering? Reasoning FROM "the shift is concentrated in attacker-relevant features rather than spread across the distribution" TO "this is skewing, not drift" — and FROM "the shift is broad and feature-agnostic" TO "this is likely genuine concept drift." The move is FROM an observed boundary shift TO an attribution, decidable only by stratifying monitoring along attacker-relevant axes.

Interventionist — constrain what the loop ingests and detect when its boundary has drifted, because per-input filtering cannot bite. The move first rules out the obvious lever: reasoning FROM "every adversarial input is individually unflaggable" TO "per-input filtering cannot catch the attack," the analyst redirects defence to the loop. The prescribed controls all act on the stream or the model state, and each carries a predicted effect: reference-model anchoring (comparing the live model against a frozen baseline on a held-out distribution) is predicted to surface drift that input checks miss; batch-level outlier rejection with robust statistics is predicted to blunt the biased population's pull on the gradient; provenance and rate-limiting on training-stream contributions are predicted to cap how durably one adversary can bias ingestion; periodic human re-anchoring is predicted to reset the criterion the loop has been pulled from; and in federated settings Byzantine-robust aggregation (Krum, coordinate-wise median, trimmed mean) is predicted to resist participants submitting many subtly biased gradient updates across rounds. The reasoning is FROM "the relevant unit is the stream" TO "defences must constrain ingestion and monitor boundary drift," not screen inputs.

Boundary-drawing — separate skewing from batch poisoning and from evasion by where in the pipeline the attack lives, and gate it on two preconditions. A first boundary move sorts three confused attacks by mechanism and timing: classic data poisoning corrupts a one-shot or batch training run so the model ships compromised; evasion crafts a single input to defeat the current model at inference time without modifying it; skewing progressively shifts a model that launched clean by biasing what a still-learning loop ingests. The analyst reasons FROM "is the attack pre-deployment batch corruption, runtime input crafting, or post-deployment loop capture?" TO "which family, and which defence locus." A second boundary move makes the applicability gate explicit: skewing requires an online or quasi-online learning loop plus an adversary who can durably influence the production stream, so the analyst reasons FROM "does this deployment keep updating from user traffic, and can an adversary shape that traffic over time?" TO "is this system skewable at all" — concluding that a system immune to batch poisoning because it trains once on a vetted corpus becomes skewable the moment it starts learning from production.

Predictive — accumulated bias forecasts that later attacker inputs survive that earlier ones would not. A forward move predicts the trajectory of capture: a stream of individually-unflaggable, region-biased inputs is predicted to drift the boundary monotonically toward the attacker's preferred region, so the analyst forecasts that obviously-malicious inputs which the launch-time model would have rejected will later pass, as the boundary they exploit has been moved to meet them. A second predictive move anticipates the detection failure: because the attack signature is a slow change in the effective training distribution, the analyst predicts it will be mistaken for benign concept drift by any monitor watching aggregate distribution alone — and therefore predicts that only attacker-relevant stratification will distinguish capture from natural change, reasoning FROM the structural identity of the two signals at the aggregate level TO the specific monitoring design required to tell them apart.

Knowledge Transfer¶

Within online and adversarial machine learning the concept transfers as mechanism, intact. The stream-as-unit-of-analysis, the concept-drift-versus-adversarial-steering diagnostic (resolved by attacker-relevant stratification), the loop-level defense logic (provenance and rate limits, reference-model anchoring, batch robust statistics, human re-anchoring), the two-precondition applicability gate, and the boundary-capture trajectory prediction all carry without translation across the home substrate: online content moderation (borderline submissions and flag-spamming over weeks), spam-and-abuse classifiers (coordinated borderline messages widening tolerance), recommender and ranking systems (the shill-attack literature is essentially a model-skewing literature), adversarial RLHF and preference-learning poisoning, continual-learning deployments updating from production traffic, and federated learning's slow Byzantine attacks (met by Krum, coordinate-wise median, trimmed mean). Notably, within AI the concept is close kin to data poisoning: it is best understood as the online-deployment, temporally-distributed variant of "the attacker corrupts inputs so the learned function shifts," the distinction being pipeline-architectural (continuous-update versus batch; post-deployment versus pre-deployment) rather than a separate structure — so the two share defenses and a common parent. Across these the feedback channel changes but the structure and remedies do not; the home domain is capture of continually-learning deployments as a whole.

Beyond machine learning the right reading is the shared abstract mechanism, and the cross-domain family here is unusually rich — which again argues that the AI name should not be the carrier. Stripped of gradient/decision-boundary/training-loop vocabulary the pattern is a standard, threshold, or norm that updates in light of incoming evidence is slowly pulled off-criterion by an adversary who durably biases what evidence arrives. It recurs as genuine co-instances none of which would be called "model skewing": regulatory drift, where standards migrate toward industry-shaped evidence streams over decades (lobbying); curricular-canon drift under textbook-procurement pressure; medical diagnostic-threshold drift when pharmaceutical-funded trials dominate the evidence base (the disease-mongering literature); journalistic news-judgement drift under a coordinated pressure campaign shifting what counts as borderline-acceptable framing; cultural taste drift under astroturf campaigns. Each is the same drift-under-biased-evidence structure. That family is carried by the catalog primes the concept composes: feedback_loop (a learning-from-evidence loop ingesting its own environment), corruption (slow degradation of the criterion), drift/temporal_decay_and_degradation (the boundary moving over time), boundary (intended versus realized decision surface), and performativity (the Goodhart-adjacent reaction of a measured standard to pressure) — together the upstream-contamination family already named under data poisoning (learning_substrate_contamination). Those are what the cross-domain lesson should carry. The home-bound cargo is the ML-particular machinery: the gradient/effective-training-distribution mechanism, the online-loop architecture, the concept-drift-versus-attack stratification problem, reference-model anchoring against a frozen baseline, and Byzantine-robust aggregation. Calling regulatory or diagnostic-threshold drift "model skewing" is therefore analogy; the honest move is to treat model skewing as the online-ML worked instance of the drift-under-biased-evidence family and carry feedback_loop + corruption + drift + performativity (under learning_substrate_contamination) across domains. See Structural Core vs. Domain Accent.

Examples¶

Canonical¶

Microsoft's Tay chatbot (March 2016) is the canonical public instance. Tay was deployed on Twitter as a conversational agent that learned from the messages people sent it, including a "repeat after me" capacity and adaptation to interaction patterns. Within about 24 hours a coordinated group of users flooded it with racist, misogynistic, and inflammatory content, and Tay's outputs drifted to echo them — producing offensive tweets it had not been designed to make. Microsoft pulled it offline within a day. The bot launched behaving acceptably and was captured entirely through the production stream it kept learning from, not through any pre-deployment corruption.

Mapped back: Tay's learn-from-Twitter design is the online learning loop, and the coordinated troll campaign is the durable stream influence supplying a systematically biased population of inputs. No single tweet was the whole attack — they were individually-unflaggable inputs whose aggregate dragged Tay's effective behavior off the intended decision criterion, the textbook drifting boundary: a deployment that launched clean and was skewed post-deployment.

Applied / In Practice¶

Security researchers demonstrated the same mechanism against a real spam filter. Nelson and colleagues ("Exploiting Machine Learning to Subvert Your Spam Filter," USENIX LEET 2008) attacked SpamBayes, a Bayesian filter that periodically retrains on labeled mail. By injecting crafted "attack" emails into the training stream — including a dictionary attack that sprayed many common English tokens into messages labeled as spam — they shifted the learned token probabilities so that ordinary legitimate email began scoring as spam, degrading the filter enough to cause denial-of-service by misclassification. The defense direction they and later work pointed to was reject-on-negative-impact screening of training contributions rather than trusting each labeled sample.

Mapped back: SpamBayes' periodic retraining on user-labeled mail is the online learning loop; the injected attack emails are the durable stream influence, each a plausible-looking message that is individually unflaggable. Their systematically biased population shifted the token statistics — the effective training distribution — pulling the drifting boundary until benign mail crossed it, and the recommended contribution-screening is precisely a loop-level defense surface move rather than a per-input filter.

Structural Tensions¶

T1: Stream as the unit versus the individually-unflaggable input (defense without a guilty party). Reframing the unit of analysis from the input to the stream is the concept's central insight: it explains why per-input filtering cannot bite, since every adversarial sample is too borderline to reject on its own. But that same property leaves the defender with no culprit to point to. To act against the attack you must penalize or discount a population none of whose members is individually anomalous — a statistical judgment about aggregate bias, not a finding about any one contribution. That is exactly the attacker's design and the defender's due-process problem at once: the more genuinely unflaggable each input is, the more the defense must fall back on collective, contestable measures (rate limits, provenance, robust trimming) that necessarily catch legitimate contributors in the same net. Diagnostic: Can the defense name any individual input as malicious, or is it acting on an aggregate bias whose members are each defensible — and who legitimate gets swept up?

T2: The concept-drift confound versus the foreknowledge that stratification requires. The concept's sharpest detection claim is that adversarial steering, structurally identical to benign concept drift at the aggregate level, becomes decidable by stratifying monitoring along attacker-relevant features — drift concentrated there is skewing, drift spread broadly is natural change. But that resolution presupposes you already know which features an attacker would target, i.e., what the capture will look like before it happens. If you can specify the attacker-relevant axes in advance, much of the defensive battle is already won; if you cannot, the stratification meant to resolve the drift-versus-steering binary cannot even be built, and you are back to an aggregate monitor that cannot tell the two apart. The diagnostic that distinguishes capture from drift needs a model of the capture it is trying to detect. Diagnostic: Are the attacker-relevant features to stratify on actually known ahead of the attack, or is the stratification being fit after the drift is already visible?

T3: Anchoring against drift versus the adaptivity that online learning exists for (security fights the feature). Every defense that resists boundary movement — reference-model anchoring against a frozen baseline, periodic human re-anchoring to the launch-time criterion, robust aggregation and trimmed means that discard the tails — works by suppressing change. But the whole reason the loop is online is to track genuine change: real-world distributions move, and the deployment updates precisely so its boundary can follow. So the security controls and the adaptivity that justified continuous learning pull on the same knob: the tighter you anchor to the intended criterion, the more legitimate concept drift you refuse to learn, and the more you let the boundary float, the more skewable you are. Robust statistics that trim the biased population also trim the real signal in the tails. Diagnostic: Does anchoring here suppress adversarial steering while still permitting legitimate concept drift, or is it buying security by freezing out the adaptation the online loop was built to perform?

T4: Slow accumulation as stealth versus slow accumulation as a detection window (gradualness cuts both ways). Model skewing's signature is that the boundary moves by accumulated drift, no single dramatic shift — and that gradualness is what lets it masquerade as benign concept drift and slip past aggregate monitors. But the same slowness works for the defender: a monotonic pull toward the attacker's region, unfolding over weeks, is a long window in which reference-model anchoring can register the growing gap against a frozen baseline before capture completes. The property that makes the attack stealthy is the property that makes it catchable by loop-level monitoring, and the attacker who accelerates to force the boundary faster trades stealth for detectability. Which edge dominates depends entirely on whether the defender is watching the stream over time or only inspecting inputs. Diagnostic: Is the drift slow enough to hide inside plausible concept drift, yet being watched against a baseline long enough to reveal its monotonic direction before the boundary reaches the attacker?

T5: A distinct failure mode versus the online variant of poisoning (a precondition gate that blurs in practice). Model skewing earns its separate name by a clean gate: it needs an online or quasi-online loop plus an adversary who can durably shape the stream, so a system immune to batch poisoning because it trains once on a vetted corpus is untouched — until it starts learning from production, at which point it becomes skewable. The classification is crisp. But real deployments smear the batch/online line: SpamBayes "periodically retrains," continual learners update on a schedule, and a "batch" refreshed nightly from user traffic is quasi-online. The precondition that defines skewing as its own thing — versus merely data poisoning with a continuous-update pipeline — is a spectrum, so the same deployment can be classed either way depending on how one reads its retrain cadence. Diagnostic: Is this deployment's update cadence genuinely continuous enough to make it skewing rather than periodic batch poisoning — and does the distinction change which defense locus applies?

T6: Autonomy versus reduction (a named ML attack or the drift-under-biased-evidence family). Model skewing is a specific, well-posed AI-security failure mode with its own machinery — the gradient/effective-training-distribution mechanism, the online-loop architecture, the concept-drift-versus-attack stratification problem, reference-model anchoring, Byzantine-robust aggregation — and it does real work diagnosing capture of a continually-learning deployment in situ. But its portable cargo is one level up: stripped of ML vocabulary it is a criterion that updates on incoming evidence, pulled off-criterion by an adversary who durably biases what evidence arrives — carried by feedback_loop, corruption, drift, and performativity, under learning_substrate_contamination. Regulatory drift, diagnostic-threshold drift, and canon drift are genuine co-instances of that family, none of which would be called "model skewing." Diagnostic: Resolve toward the parents (feedback_loop, corruption, drift, performativity, under learning_substrate_contamination) when carrying the pattern to regulatory or institutional drift; toward the named attack when defending an actual online ML deployment in situ.

Structural–Framed Character¶

Model skewing is framed-leaning on the structural–framed spectrum — a named adversarial attack whose portable core is a genuine drift-under-biased-evidence pattern, but which is constituted by ML-deployment practice, carries a threat framing, and whose cross-domain family is itself adversarial/institutional rather than nature-general, so it sits toward the framed end. The criteria: evaluative weight leans framed — "skewing"/"attack" names a hostile capture to be defended against, a threat with clear negative valence, not a neutral drift (its neutral cousin, concept_drift, is exactly what the entry contrasts it with). Human-practice-bound points framed: a model skewing attack exists only inside an online learning loop with an adversary shaping the production stream — it dissolves without that ML-deployment-plus-adversary setting; there is no skewing in observer-free nature. Institutional origin is framed: the diagnostic-and-defence apparatus (stream-as-unit analysis, reference-model anchoring, attacker-relevant stratification, Byzantine-robust aggregation) is adversarial-ML furniture. Vocab-travels is low: gradient, decision boundary, online loop, DP defences are ML idiom. Import-vs-recognize is bimodal but tilts framed even in the transfer: within online/adversarial ML it transfers as recognition across moderation, recommenders, RLHF, and federated learning; but its cross-domain co-instances (regulatory drift under lobbying, diagnostic-threshold drift under pharma-funded evidence, canon drift, taste drift under astroturf) are themselves adversarial-institutional drift on the same human-institutional substrate, so the family it belongs to is not a neutral nature-general prime but a shared adversarial-steering pattern.

The portable structural skeleton is a single one: drift-under-biased-evidence — a criterion that updates on incoming evidence is slowly pulled off-criterion by an adversary who durably biases what evidence arrives. That skeleton genuinely recurs, but it is exactly what model skewing instantiates from its umbrella primes — feedback_loop (a learning-from-evidence loop), corruption (slow degradation of the criterion), drift / temporal_decay_and_degradation (the boundary moving over time), boundary (intended versus realized surface), and performativity (the Goodhart-adjacent reaction of a measured standard to pressure), together the upstream-contamination family named under learning_substrate_contamination — not what makes "model skewing" itself travel: the cross-domain reach belongs to that family (of which model skewing is the online-ML worked instance, close kin to batch data poisoning), while the domain-accented specifics — the gradient/effective-training-distribution mechanism, the online-loop architecture, the concept-drift stratification problem, reference-model anchoring, Byzantine-robust aggregation — stay home. Its character: a threat-framed, ML-deployment-constituted adversarial capture, structural only in the drift-under-biased-evidence skeleton it borrows from the feedback_loop/corruption/drift/performativity family and frames as an AI-security attack.

Structural Core vs. Domain Accent¶

This section settles why model skewing is a domain-specific abstraction and not a prime, and it carries the case for its domain-specificity along with it.

What is skeletal (could lift toward a cross-domain prime). Strip away the gradient, the decision boundary, and the training loop, and a thin relational structure survives: a criterion that updates in light of incoming evidence is slowly pulled off-criterion by an adversary who durably biases what evidence arrives. The portable pieces are abstract — an evidence-updating loop, a target criterion, a stream of individually-innocuous but collectively-biased inputs, and an accumulated drift of the criterion toward the biaser's preferred region. That skeleton is genuinely substrate-portable, and its cross-domain family is unusually rich: regulatory drift under lobbying, curricular-canon drift under textbook-procurement pressure, medical diagnostic-threshold drift under pharma-funded trials, journalistic news-judgement drift under coordinated pressure, cultural taste drift under astroturf. The catalog already carries the core as the primes model skewing composes — feedback_loop (a learning-from-evidence loop ingesting its own environment), corruption (slow degradation of the criterion), drift / temporal_decay_and_degradation (the boundary moving over time), boundary (intended versus realized surface), and performativity (the Goodhart-adjacent reaction of a measured standard to pressure) — together the upstream-contamination family named under learning_substrate_contamination. But this is the core the entry shares with those co-instances, not what makes model skewing distinctive.

What is domain-bound. Almost everything that makes the concept model skewing in particular is online/adversarial-ML furniture and none of it survives extraction. The updating criterion is a learned decision boundary; the mechanism is the biasing of a gradient or effective training distribution; the precondition is an online or quasi-online learning loop that keeps updating from production traffic; the detection problem is the concept-drift-versus-attack stratification along attacker-relevant features; and the defence surface is ML-specific — reference-model anchoring against a frozen baseline, batch-level robust statistics, provenance and rate limits on training-stream contributions, Byzantine-robust aggregation (Krum, coordinate-wise median, trimmed mean), periodic human re-anchoring. The worked cases are equally home-bound: the Tay chatbot, the SpamBayes dictionary attack, the recommender shill-attack literature, adversarial RLHF poisoning. The decisive test: remove the online learning loop and its gradient-updated model, and there is no boundary to drift, no reference model to anchor, no Byzantine aggregation to run — what remains is the drift-under-biased-evidence pattern that regulatory capture and diagnostic-threshold drift already run under their own descriptions. And the name's own accent — "skewing"/"attack" — adds the adversarial threat framing that the neutral drift family lacks, which is why regulatory drift is the same skeleton but not a "model skewing."

Why this does not clear the prime bar. A prime is a relational structure whose vocabulary travels and whose cross-domain transfer is recognition of the same mechanism, not analogy. Model skewing's transfer is bimodal. Within online and adversarial ML the full apparatus travels intact — the stream-as-unit-of-analysis, the concept-drift-versus-adversarial-steering diagnostic, the loop-level defence logic, the two-precondition applicability gate, and the boundary-capture trajectory prediction carry without translation across content moderation, spam-and-abuse classifiers, recommenders, RLHF, continual-learning deployments, and federated learning; only the feedback channel changes, and within AI it is recognisably the online-deployment variant of batch data poisoning. Beyond ML, transfer is only by analogy: calling regulatory drift or diagnostic-threshold drift a "model skewing" borrows the AI-security name for a genuine co-instance of the parent family, because none of the gradient machinery, online-loop architecture, or ML defence menu crosses over. And when the bare structural lesson is needed cross-domain, it is already carried, in more general form, by the parents the entry instantiates: feedback_loop, corruption, drift, boundary, and performativity, under learning_substrate_contamination. The cross-domain reach belongs to that drift-under-biased-evidence family; model skewing is its online-ML worked instance, carrying adversarial-ML baggage that should stay home.

Relationships to Other Abstractions¶

Current abstraction Model Skewing Domain-specific

Parents (1) — more general patterns this builds on

Model Skewing is a kind of Data Poisoning Attack Domain-specific

Model skewing is data poisoning specialized to a clean-launched, continuously or periodically updating deployment whose production stream is biased gradually after launch.

Hierarchy paths (2) — routes to 2 parentless roots

Model Skewing → Data Poisoning Attack → Learning-Substrate Contamination → Learning → Adaptation

Show alternative path (1)

Not to Be Confused With¶

Batch data poisoning. The closest neighbour and shared in-domain parent: corrupting a one-shot or batch training run so the model ships already compromised at deployment. Model skewing is best read as its online-deployment, temporally-distributed variant — it shifts a model that launched clean by biasing what a still-updating loop ingests post-deployment. The gate is architectural: a system that trains once on a vetted corpus is immune to skewing until it starts learning from production traffic. Tell: was the training set corrupted before the model shipped (batch poisoning), or is a deployed, still-learning model being pulled off-criterion by a biased production stream (skewing)?
Backdoor / trojan attack. A poisoning variant that implants a hidden trigger so the model behaves normally except on trigger inputs, where it misclassifies as the attacker chose. It targets a specific concealed input pattern, whereas skewing shifts the general decision boundary toward the attacker's region over time. Backdoors are usually planted at (batch) training time; skewing is an accumulated drift. Tell: is there a secret trigger that flips behaviour on specific inputs (backdoor), or a gradual boundary migration that lets a whole class of later inputs survive (skewing)?
Evasion attack (adversarial examples). Inputs crafted to defeat the current model at inference time without modifying it — the model is untouched and the next input must be crafted afresh. Skewing durably modifies the model so that subsequent inference is permanently biased; its payoff is that later malicious inputs survive because the boundary was moved to meet them. Tell: is the model left unchanged and each malicious input crafted to slip past it (evasion), or is the model itself altered so ordinary malicious inputs now pass (skewing)?
Concept drift. The benign, non-adversarial phenomenon of a real-world distribution genuinely changing over time, which a model is supposed to track. Skewing is structurally identical to concept drift at the aggregate level — that is exactly its camouflage — and is distinguished only by attacker-relevant stratification: drift concentrated in attacker-relevant features is skewing, drift spread broadly is likely genuine change. Tell: is the distributional shift the world actually moving (concept drift) or an adversary steering the boundary, revealed by drift concentrated where an attacker would push (skewing)?
Degenerate feedback loop / emergent drift. The non-adversarial self-reinforcement in which a deployed learner shapes its own future training data (a recommender narrowing into an echo chamber, a filter amplifying its own past labels), drifting with no attacker behind it. Skewing requires a durable adversarial influence on the stream; the emergent case is systemic bias without an intending adversary. Tell: is the drift produced by the loop feeding on its own outputs with no adversary (degenerate feedback loop) or steered by an actor deliberately biasing the ingested stream (skewing)?
The drift-under-biased-evidence family (umbrella). The substrate-general parents this entry composes — feedback_loop, corruption, drift, boundary, and performativity, under learning_substrate_contamination — of which regulatory drift under lobbying, diagnostic-threshold drift under pharma-funded trials, and canon drift are co-instances. It is the generalization, not a confusable peer. Tell: the family carries the criterion-pulled-off-by-biased-evidence structure cross-domain; model skewing is its online-ML instance with gradient machinery and Byzantine-robust defences, treated more fully in a later section.

Neighborhood in Abstraction Space¶

Model Skewing sits in a moderately populated region (47^th percentile for distinctiveness): it has near-neighbors but no dense thicket of look-alikes.

Family — Statistical Inference & Model Failure Modes (16 abstractions)

Nearest neighbors

Computed from structural-signature embeddings · 2026-07-12