Model Skewing¶

The adversarial AI-security attack in which a stream of individually-unflaggable, region-biased inputs to an online learning loop gradually pulls a model's decision boundary off the deployer's criterion toward one the attacker prefers — capturing a deployment that launched clean.

Core Idea¶

Model skewing is the adversarial AI-security failure in which an attacker, across a sequence of training updates, gradually pulls a model's learned decision boundary away from the deployer's intended criterion toward a region the attacker prefers. It is not one dramatic shift but accumulated drift from a stream of adversarially-shaped inputs, each too borderline to flag; the systematically biased population biases the gradient. Its precondition is an online or quasi-online learning loop plus an attacker who can durably influence what the loop ingests.

Scope of Application¶

Model skewing lives across online and adversarial machine learning, within capture of continually-learning deployments.

Online content moderation — borderline submissions and flag-spamming pulling the boundary over weeks.
Spam-and-abuse classifiers — coordinated borderline messages widening the decision boundary.
Recommender and ranking systems — the shill-attack literature biasing the learner toward promoted content.
Adversarial RLHF — biased labellers shifting the trained reward model.
Federated learning — participants submitting many subtly biased gradient updates, met by Byzantine-robust aggregation.

Clarity¶

Naming model skewing carves a distinct attack from a family AI-security practice lumps together: it separates the temporally-distributed, boundary-drifting attack from batch data poisoning (which ships a compromised model) and from evasion (which defeats the current model without touching it). The sharper question it forces is a detection one — is this shift legitimate concept drift or an adversary steering? — and it reframes defence from per-input filtering toward loop-level infrastructure, telling the defender the unit of analysis is the stream.

Manages Complexity¶

Attacks on deployed learners present as unrelated abuse problems, each in its own product vocabulary. Naming model skewing compresses that sprawl to one mechanism with two conditions: an online loop and an adversary who can durably bias its stream. The per-surface menagerie reduces to a stream and a boundary. That fixes the unit of analysis (the stream, explaining why per-input filtering fails) and sharpens detection to one binary resolvable only by attacker-relevant stratification.

Abstract Reasoning¶

All moves take the stream, not the input, as the unit of analysis. The concept licenses diagnosis (read the aggregate boundary shift, then decide concept drift versus steering by where the drift concentrates), intervention (constrain ingestion and monitor boundary drift, since per-input filtering cannot bite), boundary-drawing (separate skewing from batch poisoning and evasion by pipeline locus, gated on two preconditions), and prediction (accumulated bias lets later inputs survive that earlier ones would not).

Knowledge Transfer¶

Within online and adversarial ML the concept transfers as mechanism intact — the stream-as-unit, the drift-versus-steering diagnostic, the loop-level defences, the applicability gate, and the capture-trajectory prediction all carry across moderation, abuse classifiers, recommenders, RLHF, and federated learning; it is close kin to data poisoning, its online-deployment variant. Beyond ML the pattern is shared-abstract-mechanism: a standard updating on incoming evidence is pulled off-criterion by an adversary who biases what arrives — regulatory drift, diagnostic-threshold drift, and taste drift are co-instances carried by the parent primes feedback_loop, corruption, drift, and performativity (under learning_substrate_contamination). Those carry the cross-domain lesson.

Relationships to Other Abstractions¶

Current abstraction Model Skewing Domain-specific

Parents (1) — more general patterns this builds on

Model Skewing is a kind of Data Poisoning Attack Domain-specific

Model skewing is data poisoning specialized to a clean-launched, continuously or periodically updating deployment whose production stream is biased gradually after launch.

Hierarchy paths (2) — routes to 2 parentless roots

Model Skewing → Data Poisoning Attack → Learning-Substrate Contamination → Learning → Adaptation

Show alternative path (1)

Neighborhood in Abstraction Space¶

Model Skewing sits in a moderately populated region (47^th percentile for distinctiveness): it has near-neighbors but no dense thicket of look-alikes.

Family — Statistical Inference & Model Failure Modes (16 abstractions)

Nearest neighbors

Computed from structural-signature embeddings · 2026-07-12