# An Investigation of Data Poisoning Defenses for Online Learning

arXiv: https://arxiv.org/abs/1905.12121 · HTML: https://mlsanity.com/paper/1905.12121/

## Key facts

- Cited by 3 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 28 May 2019.

## Built on by (most cited first, 3 of 3)

- [Influence Based Defense Against Data Poisoning Attacks in Online Learning](https://mlsanity.com/paper/2104.13230/) (2021)
- [On the Permanence of Backdoors in Evolving Models](https://mlsanity.com/paper/2206.04677/) (2022)
- [Gradient-based Data Subversion Attack Against Binary Classifiers](https://mlsanity.com/paper/2105.14803/) (2021)

## Abstract (arXiv)

Data poisoning attacks -- where an adversary can modify a small fraction of training data, with the goal of forcing the trained classifier to high loss -- are an important threat for machine learning in many applications. While a body of prior work has developed attacks and defenses, there is not much general understanding on when various attacks and defenses are effective. In this work, we undertake a rigorous study of defenses against data poisoning for online learning. First, we study four standard defenses in a powerful threat model, and provide conditions under which they can allow or resist rapid poisoning. We then consider a weaker and more realistic threat model, and show that the success of the adversary in the presence of data poisoning defenses there depends on the "ease" of the learning problem.