# Data Poisoning Attacks against Online Learning

arXiv: https://arxiv.org/abs/1808.08994 · HTML: https://mlsanity.com/paper/1808.08994/

## Key facts

- Cited by 24 papers in the map (data through 7 Oct 2026).
- First posted on arXiv 27 Aug 2018.

## Built on by (most cited first, 24 of 24)

- [Policy Poisoning in Batch Reinforcement Learning and Control](https://mlsanity.com/paper/1910.05821/) (2019)
- [Hard to Forget: Poisoning Attacks on Certified Machine Unlearning](https://mlsanity.com/paper/2109.08266/) (2021)
- [Data Poisoning Attacks Against Multimodal Encoders](https://mlsanity.com/paper/2209.15266/) (2022)
- [Understanding Rare Spurious Correlations in Neural Networks](https://mlsanity.com/paper/2202.05189/) (2022)
- [DeepObliviate: A Powerful Charm for Erasing Data Residual Memory in Deep Neural Networks](https://mlsanity.com/paper/2105.06209/) (2021)
- [System Cards for AI-Based Decision-Making for Public Policy](https://mlsanity.com/paper/2203.04754/) (2022)
- [Accumulative Poisoning Attacks on Real-time Data](https://mlsanity.com/paper/2106.09993/) (2021)
- [Energy-Latency Attacks to On-Device Neural Networks via Sponge Poisoning](https://mlsanity.com/paper/2305.03888/) (2023)
- [FooBaR: Fault Fooling Backdoor Attack on Neural Network Training](https://mlsanity.com/paper/2109.11249/) (2021)
- [FairRoad: Achieving Fairness for Recommender Systems with Optimized Antidote Data](https://mlsanity.com/paper/2212.06750/) (2022)
- [Robust Online Convex Optimization in the Presence of Outliers](https://mlsanity.com/paper/2107.01881/) (2021)
- [Keeping up with dynamic attackers: Certifying robustness to adaptive online data poisoning](https://mlsanity.com/paper/2502.16737/) (2025)
- [Influence Based Defense Against Data Poisoning Attacks in Online Learning](https://mlsanity.com/paper/2104.13230/) (2021)
- [On the Permanence of Backdoors in Evolving Models](https://mlsanity.com/paper/2206.04677/) (2022)
- [On the Validity of Traditional Vulnerability Scoring Systems for Adversarial Attacks against LLMs](https://mlsanity.com/paper/2412.20087/) (2024)
- [PACOL: Poisoning Attacks Against Continual Learners](https://mlsanity.com/paper/2311.10919/) (2023)
- [On the Feasibility of Poisoning Text-to-Image AI Models via Adversarial Mislabeling](https://mlsanity.com/paper/2506.21874/) (2025)
- [Gradient-based Data Subversion Attack Against Binary Classifiers](https://mlsanity.com/paper/2105.14803/) (2021)
- [Adversarial Patterns: Building Robust Android Malware Classifiers](https://mlsanity.com/paper/2203.02121/) (2022)
- [Attacks on Online Learners: a Teacher-Student Analysis](https://mlsanity.com/paper/2305.11132/) (2023)
- [Exploring Model Dynamics for Accumulative Poisoning Discovery](https://mlsanity.com/paper/2306.03726/) (2023)
- [Transfer-based Adversarial Poisoning Attacks for Online (MIMO-)Deep Receviers](https://mlsanity.com/paper/2409.02430/) (2024)
- [Fake or Real: The Impostor Hunt in Texts for Space Operations](https://mlsanity.com/paper/2507.13508/) (2025)
- [FedShard: Federated Unlearning with Efficiency Fairness and Performance Fairness](https://mlsanity.com/paper/2508.09866/) (2025)

## Abstract (arXiv)

We consider data poisoning attacks, a class of adversarial attacks on machine learning where an adversary has the power to alter a small fraction of the training data in order to make the trained classifier satisfy certain objectives. While there has been much prior work on data poisoning, most of it is in the offline setting, and attacks for online learning, where training data arrives in a streaming manner, are not well understood. In this work, we initiate a systematic investigation of data poisoning attacks for online learning. We formalize the problem into two settings, and we propose a general attack strategy, formulated as an optimization problem, that applies to both with some modifications. We propose three solution strategies, and perform extensive experimental evaluation. Finally, we discuss the implications of our findings for building successful defenses.