Poisoning Web-Scale Training Datasets is Practical
summary
Demonstrates that buying expired domains listed in massive URL-only datasets like LAION‑5B lets an attacker inject training samples into web‑scale models; the paper measures scraping behavior (Hugging Face dataset clients, Common Crawl metadata, user‑agent traces) and shows practical split-view poisoning where controlling as little as 0.01% control (orders of 0.0001–0.01% per Carlini bounds, ≈tens of GB) suffices to influence models; builds domain infrastructure, times scrapes, and validates visibility of poisoned content; proposes dataset hashing and provenance as defenses.
AI-written summary · about
chapters (19)
- 0:00Introduction
- 1:10ML security assumptions critique
- 3:17ML dataset evolution
- 5:49Large-scale curation challenges
- 7:16Domain registration poisoning
- 9:46Split view poisoning attack
- 12:10Model input control via poisoning
- 13:56Public repos as attack surfaces
- 15:43Wikipedia poisoning analysis
- 17:07Defenses and cryptographic tracking
- 18:34Security takeaways
- 20:39DNS dangling records
- 22:06ML tooling security flaws
- 24:12Practical attack impact
- 25:15Trust in ML models
- 26:40ML research as security
- 28:46Academic vs operational security
- 30:53Production ML security
- 32:16ML security learning curve
related talks
46mInsane in the Supply Chain: Threat modeling for...
46mAI in a Minefield: Learning from Poisoned Data
01h 00mMaking & Breaking Machine Learning Anomaly Detectors in Real Life
42mDefense Against the Dark Arts and Potions: AI Models Can Be Easily Poisoned
43mOne Poisoned Artifact Can Steer Your AI: How Robust Are Your LLM-Assisted Security Workflows?
44mI Abuse Your LLM Live with 10 Security Vulnerabilities
21mMachine Learning and Cyber Security - Detecting malicious URLs in the haystack
45mWinning by deception: tactics, techniques, and procedures of adversarial A.I.