Data Poisoning via Internet Scraping

• Data poisoning via internet scraping is a manipulation technique that exploits publicly scraped data by injecting malicious examples to compromise ML training integrity.
• The approach involves methods like direct injection, content mutation, and gradient-based perturbations to induce systematic errors and high attack success rates.
• Empirical results show drastic performance drops in model accuracy, emphasizing the urgent need for robust data curation and defensive strategies.

Data poisoning via internet scraping refers to intentional manipulation of publicly accessible data sources that are automatically harvested (scraped) to construct large-scale machine learning training datasets. This paradigm exploits the reliance of contemporary deep learning systems on web-crawled collections for vision, text, audio, and multi-modal applications. Attackers leverage the open and mutable nature of internet data to inject malicious examples or subtle perturbations, aiming to compromise downstream model integrity, induce systematic errors, degrade generalization, or implant backdoors, all while maintaining stealth against routine vetting and quality-control procedures.

1. Attack Surfaces, Threat Models, and General Principles

The core attack surface arises because industrial and academic pipelines routinely scrape images, text, user profiles, or structured records from open web sources, public platforms, or semi-curated repositories (e.g., LAION-400M, COYO-700M, Wikipedia, LinkedIn, online job boards). Attackers may influence the training data by:

• Direct injection: Posting crafted content on web pages or online platforms, relying on scrapers to ingest and label these automatically.
• Content mutation exploitation: Leveraging the mutable or time-varying nature of internet resources (e.g., changing page contents between annotation and download).
• Crowdsourced snapshotting: Inserting content into collaborative platforms shortly before dataset snapshotting (frontrunning).
• Manipulating user-submitted data: Utilizing platforms with weak or no verification (e.g., fake resumes on job sites).

Threat models are diverse, including both targeted poisoning (e.g., inducing a specific misclassification or recommendation) and indiscriminate/availability attacks (degrading overall model performance). Clean-label attacks, in which poisoned examples are indistinguishable from legitimate samples in annotation or class label, are especially difficult to detect and mitigate (Shafahi et al., 2018, Sandoval-Segura et al., 2022, Schneider et al., 2023, Yamashita et al., 2024).

2. Taxonomy of Data Poisoning via Internet Scraping

Major strategies can be categorized as follows:

Category	Principal Methods / Goals	Key References
Clean-label Indiscriminate	Imperceptible noise/perturbation to make data "unlearnable"; maximize test loss; no label tampering	(Sandoval-Segura et al., 2022, Fowl et al., 2021)
Clean-label Targeted	Feature collision, watermarking to subvert a particular input/class	(Shafahi et al., 2018)
Universal Backdoor	Patch/blend triggers supporting many-to-many class transfer	(Schneider et al., 2023)
Structured Data Attacks	Fake credential/resume injection to manipulate recommenders	(Yamashita et al., 2024)
Content Mutation Exploits	Split-view, frontrunning attacks on mutable/snapshot content	(Carlini et al., 2023)
Backdooring Generative Models	Conditioning map triggers (e.g., for ControlNet)	(Lapid et al., 7 Jul 2025)

Each method operates under varying assumptions about attacker knowledge, capability (fraction of dataset poisoned), and observability constraints.

3. Key Methodologies and Technical Formulations

Indiscriminate Clean-Label Poisoning

Autoregressive (AR) perturbation and gradient-alignment approaches create "unlearnable" datasets without access to the final victim model. In AR poisoning, additive noise $\delta$ is generated for each input via a class-specific autoregressive process, e.g. sliding-window AR(8) for images, with $\ell_2$ normalization constraints (Sandoval-Segura et al., 2022). The objective is to maximize test loss for any model trained, without optimizing against a surrogate. For minimal online poisoning, gradient-alignment methods solve: $$\max_{\Delta\in C}\, \mathbb{E}_{(x,y)\sim D}[\mathcal{L}(F(x;\theta(\Delta)),y)]$$ where $\theta(\Delta)$ are model parameters after training on perturbed data, and $C$ is an $\ell_\infty$ or $\ell_2$ ball (Fowl et al., 2021).

Targeted Poisoning (Feature Collision, Watermarking)

Targeted poisons cause a designated test instance $t$ to be misclassified as a base class $b$, by publishing $p$ such that $f(p)\approx f(t)$ in feature space while $p$ closely resembles $b$ in pixel space. For end-to-end training, a watermarking strategy blends $t$ into multiple base images with opacity $\gamma$, followed by optimization: $\min_x\, \|f(x) - f(t)\|_2^2 + \beta \|x - b\|_2^2$ Multiple such poisons are necessary for persistence under full re-training (Shafahi et al., 2018).

Universal Backdoor Attacks and Inter-Class Poison Transferability

Universal backdoor attacks encode class-specific triggers as binary patterns (patch or blend) mapped from class-centroid latent codes (via LDA compression). An attack achieves high success rates (ASR) with 0.15% poisoning even for thousands of classes, owing to the phenomenon of inter-class poison transferability: training on triggers for a subset of classes transfers vulnerability to the rest (Schneider et al., 2023).

Attacks on Structured and Generative Data Modalities

• Fake resume (FRANCIS) attacks generate realistic but adversarial career trajectories via a probabilistic, graph-regularized sequence generator, optimized by surrogate-guided adversarial fine-tuning to maximize specific career-matching objectives (e.g., company/user promotion) (Yamashita et al., 2024).
• ControlNet poisoning replaces edge/depth/conditioning pairs with malicious target images and structurally triggered conditions, achieving nearly perfect backdoor efficacy at low poisoning rates. Attack success is evaluated via classifier and CLIP-based similarity (ASR), with clean-prompt fidelity validated by standard perceptual metrics (Lapid et al., 7 Jul 2025).

Content Mutation and Scraping Exploits

Split-view and frontrunning poisoning take advantage of delayed annotation or snapshotting, allowing the attacker to insert, modify, or swap content before final inclusion in the training set, as demonstrated for LAION-400M and Wikipedia with a poisoning cost of merely $60 USD to affect 0.01% of samples (Carlini et al., 2023).

4. Empirical Outcomes and Quantitative Findings

Key results include:

• AR perturbations reduce CIFAR-10 ResNet-18 accuracy from 93.6% (clean) to 11.8% (poisoned) (Sandoval-Segura et al., 2022).
• Universal backdoor attacks on ImageNet-1K achieve 80.1% attack success rate with 0.16% poisons; at the 6K-class scale, ASR is 47.3% (Schneider et al., 2023).
• Targeted clean-label poisoning with watermarking yields 100% attack success (transfer learning) and ∼60% (end-to-end training) without significantly affecting global accuracy (Shafahi et al., 2018).
• Fake resume attacks with poisoning intensity $\epsilon=1\%$$increase company promotion hit rates IR@10 by up to ∼5$$\times$, with overall accuracy shifting by only 1–2% (<a href="/papers/2402.14124" title="" rel="nofollow" data-turbo="false" class="assistant-link" x-data x-tooltip.raw="">Yamashita et al., 2024</a>).</li> <li>ControlNet backdoors achieve ASR &gt;90% (ImageNet) and &gt;60% (CelebA-HQ) with 1% poisoned samples, while retaining clean-prompt fidelity (SSIM ≈ 0.35–0.40) (<a href="/papers/2507.04726" title="" rel="nofollow" data-turbo="false" class="assistant-link" x-data x-tooltip.raw="">Lapid et al., 7 Jul 2025</a>).</li> <li>Gradient-alignment poisoning can drop ImageNet top-1 accuracy from 65.7% (clean) to 37.6% ($\varepsilon=8/255$) (Fowl et al., 2021).

5. Analysis of Defenses, Robustness, and Limitations

Data poisoning via internet scraping presents notable resilience to standard defense mechanisms:

• Data augmentations (Mixup, CutMix, strong noise) do not nullify AR or gradient-alignment poisons (Sandoval-Segura et al., 2022, Fowl et al., 2021).
• Off-the-shelf backdoor defenses (Neural Cleanse, fine-pruning, STRIP) reduce universal backdoor ASR by at most ∼10 percentage points, and suffer from high false positives (Schneider et al., 2023).
• Standard regularization, smoothing, or DP-SGD offers limited recovery for poisoned models.
• Partial mixing with clean data can mitigate, but even a small proportion of leftover poison substantially degrades generalization (Sandoval-Segura et al., 2022).

Recommended countermeasures include data provenance/enforcement (e.g., signed dataset manifests, cryptographic hashing), outlier detection in feature or transition-graph space, provenance tracking for conditioning maps, robust retraining (e.g., median-of-means, influence-based trimming), and increased human/algorithmic curation of scraped data sources (Shafahi et al., 2018, Fowl et al., 2021, Schneider et al., 2023, Yamashita et al., 2024, Lapid et al., 7 Jul 2025).

6. Practical Considerations and Real-World Impact

The practical cost of large-scale poisoning is low: as little as $60 USD in bandwidth and resource expenditure can poison web-scale datasets to a measurable extent (Carlini et al., 2023). Clean-label, feature-space, and AR-based strategies allow attackers to avoid detection by automated annotation and quality controls. Because most pipelines lack end-to-end provenance audit, a plausible implication is systemic vulnerability of open datasets and downstream models (especially in facial recognition, vision, recommender, and generative architectures).

Poison-resistant training, model certification, and sanitization tailored to many-to-many backdoors and structured data settings represent open research problems. The persistence of vulnerabilities as confirmed by experiments across black-box architectures, cross-domain generalization, and resistance to human vetting underscores the urgency for new validation and training paradigms before internet scraping can be considered safe for critical ML deployments (Schneider et al., 2023, Sandoval-Segura et al., 2022, Yamashita et al., 2024, Lapid et al., 7 Jul 2025).