---
title: Data Poisoning via Internet Scraping
url: https://www.emergentmind.com/topics/data-poisoning-via-internet-scraping
type: topic
---

# Data Poisoning via Internet Scraping

Data poisoning via internet scraping refers to intentional manipulation of publicly accessible data sources that are automatically harvested (scraped) to construct large-scale machine learning training datasets. This paradigm exploits the reliance of contemporary deep learning systems on web-crawled collections for vision, text, audio, and multi-modal applications. Attackers leverage the open and mutable nature of internet data to inject malicious examples or subtle perturbations, aiming to compromise downstream model integrity, induce systematic errors, degrade generalization, or implant backdoors, all while maintaining stealth against routine vetting and quality-control procedures.

## 1. Attack Surfaces, Threat Models, and General Principles

The core attack surface arises because industrial and academic pipelines routinely scrape images, text, user profiles, or structured records from open web sources, public platforms, or semi-curated repositories (e.g., LAION-400M, COYO-700M, Wikipedia, LinkedIn, online job boards). Attackers may influence the training data by:

- **Direct injection:** Posting crafted content on web pages or online platforms, relying on scrapers to ingest and label these automatically.
- **Content mutation exploitation:** Leveraging the mutable or time-varying nature of internet resources (e.g., changing page contents between annotation and download).
- **Crowdsourced snapshotting:** Inserting content into collaborative platforms shortly before dataset snapshotting (frontrunning).
- **Manipulating user-submitted data:** Utilizing platforms with weak or no verification (e.g., fake resumes on job sites).

Threat models are diverse, including both targeted poisoning (e.g., inducing a specific misclassification or recommendation) and indiscriminate/availability attacks (degrading overall model performance). Clean-label attacks, in which poisoned examples are indistinguishable from legitimate samples in annotation or class label, are especially difficult to detect and mitigate [1804.00792][2206.03693][2312.00157][2402.14124].

## 2. Taxonomy of Data Poisoning via Internet Scraping

Major strategies can be categorized as follows:

| Category          | Principal Methods / Goals                                             | Key References  |
|-------------------|-----------------------------------------------------------------------|-----------------|
| Clean-label Indiscriminate | Imperceptible noise/perturbation to make data "unlearnable"; maximize test loss; no label tampering | [2206.03693][2103.02683] |
| Clean-label Targeted     | Feature collision, watermarking to subvert a particular input/class | [1804.00792]    |
| Universal Backdoor       | Patch/blend triggers supporting many-to-many class transfer     | [2312.00157]    |
| Structured Data Attacks  | Fake credential/resume injection to manipulate recommenders     | [2402.14124]    |
| Content Mutation Exploits | Split-view, frontrunning attacks on mutable/snapshot content   | [2302.10149]    |
| Backdooring Generative Models | Conditioning map triggers (e.g., for ControlNet)             | [2507.04726]    |

Each method operates under varying assumptions about attacker knowledge, capability (fraction of dataset poisoned), and observability constraints.

## 3. Key Methodologies and Technical Formulations

### Indiscriminate Clean-Label Poisoning
Autoregressive (AR) perturbation and gradient-alignment approaches create "unlearnable" datasets without access to the final victim model. In AR poisoning, additive noise $\delta$ is generated for each input via a class-specific autoregressive process, e.g. sliding-window AR(8) for images, with $\ell_2$ normalization constraints [2206.03693]. The objective is to maximize test loss for any model trained, without optimizing against a surrogate. For minimal online poisoning, gradient-alignment methods solve:
\[
\max_{\Delta\in C}\, \mathbb{E}_{(x,y)\sim D}[\mathcal{L}(F(x;\theta(\Delta)),y)]
\]
where $\theta(\Delta)$ are model parameters after training on perturbed data, and $C$ is an $\ell_\infty$ or $\ell_2$ ball [2103.02683].

### Targeted Poisoning (Feature Collision, Watermarking)
Targeted poisons cause a designated test instance $t$ to be misclassified as a base class $b$, by publishing $p$ such that $f(p)\approx f(t)$ in feature space while $p$ closely resembles $b$ in pixel space. For end-to-end training, a watermarking strategy blends $t$ into multiple base images with opacity $\gamma$, followed by optimization:
\[
\min_x\, \|f(x) - f(t)\|_2^2 + \beta \|x - b\|_2^2
\]
Multiple such poisons are necessary for persistence under full re-training [1804.00792].

### Universal Backdoor Attacks and Inter-Class Poison Transferability
Universal backdoor attacks encode class-specific triggers as binary patterns (patch or blend) mapped from class-centroid latent codes (via LDA compression). An attack achieves high success rates (ASR) with 0.15% poisoning even for thousands of classes, owing to the phenomenon of inter-class poison transferability: training on triggers for a subset of classes transfers vulnerability to the rest [2312.00157].

### Attacks on Structured and Generative Data Modalities
- **Fake resume (FRANCIS) attacks** generate realistic but adversarial career trajectories via a probabilistic, graph-regularized sequence generator, optimized by surrogate-guided adversarial fine-tuning to maximize specific career-matching objectives (e.g., company/user promotion) [2402.14124].
- **ControlNet poisoning** replaces edge/depth/conditioning pairs with malicious target images and structurally triggered conditions, achieving nearly perfect backdoor efficacy at low poisoning rates. Attack success is evaluated via classifier and CLIP-based similarity (ASR), with clean-prompt fidelity validated by standard perceptual metrics [2507.04726].

### Content Mutation and Scraping Exploits
Split-view and frontrunning poisoning take advantage of delayed annotation or snapshotting, allowing the attacker to insert, modify, or swap content before final inclusion in the training set, as demonstrated for LAION-400M and Wikipedia with a poisoning cost of merely $60 USD to affect 0.01% of samples [2302.10149].

## 4. Empirical Outcomes and Quantitative Findings

Key results include:

- AR perturbations reduce CIFAR-10 ResNet-18 accuracy from 93.6% (clean) to 11.8% (poisoned) [2206.03693].
- Universal backdoor attacks on ImageNet-1K achieve 80.1% attack success rate with 0.16% poisons; at the 6K-class scale, ASR is 47.3% [2312.00157].
- Targeted clean-label poisoning with watermarking yields 100% attack success (transfer learning) and ∼60% (end-to-end training) without significantly affecting global accuracy [1804.00792].
- Fake resume attacks with poisoning intensity $\epsilon=1\%$ increase company promotion hit rates IR@10 by up to ∼5$\times$, with overall accuracy shifting by only 1–2% [2402.14124].
- ControlNet backdoors achieve ASR >90% (ImageNet) and >60% (CelebA-HQ) with 1% poisoned samples, while retaining clean-prompt fidelity (SSIM ≈ 0.35–0.40) [2507.04726].
- Gradient-alignment poisoning can drop ImageNet top-1 accuracy from 65.7% (clean) to 37.6% ($\varepsilon=8/255$) [2103.02683].

## 5. Analysis of Defenses, Robustness, and Limitations

Data poisoning via internet scraping presents notable resilience to standard defense mechanisms:

- Data augmentations (Mixup, CutMix, strong noise) do not nullify AR or gradient-alignment poisons [2206.03693][2103.02683].
- Off-the-shelf backdoor defenses (Neural Cleanse, fine-pruning, STRIP) reduce universal backdoor ASR by at most ∼10 percentage points, and suffer from high false positives [2312.00157].
- Standard regularization, smoothing, or DP-SGD offers limited recovery for poisoned models.
- Partial mixing with clean data can mitigate, but even a small proportion of leftover poison substantially degrades generalization [2206.03693].

Recommended countermeasures include data provenance/enforcement (e.g., signed dataset manifests, cryptographic hashing), outlier detection in feature or transition-graph space, provenance tracking for conditioning maps, robust retraining (e.g., median-of-means, influence-based trimming), and increased human/algorithmic curation of scraped data sources [1804.00792][2103.02683][2312.00157][2402.14124][2507.04726].

## 6. Practical Considerations and Real-World Impact

The practical cost of large-scale poisoning is low: as little as $60 USD in bandwidth and resource expenditure can poison web-scale datasets to a measurable extent [2302.10149]. Clean-label, feature-space, and AR-based strategies allow attackers to avoid detection by automated annotation and quality controls. Because most pipelines lack end-to-end provenance audit, a plausible implication is systemic vulnerability of open datasets and downstream models (especially in facial recognition, vision, recommender, and generative architectures).

Poison-resistant training, model certification, and sanitization tailored to many-to-many backdoors and structured data settings represent open research problems. The persistence of vulnerabilities as confirmed by experiments across black-box architectures, cross-domain generalization, and resistance to human vetting underscores the urgency for new validation and training paradigms before internet scraping can be considered safe for critical ML deployments [2312.00157][2206.03693][2402.14124][2507.04726].

Source: https://www.emergentmind.com/topics/data-poisoning-via-internet-scraping