Web-Scale Data Poisoning: The Split-View Attack
Web-scale datasets distributed as lists of URLs can be poisoned by buying expired domains behind those URLs. What researchers downloaded when the dataset was built differs from what later trainers fetch — cheaply poisoning real training corpora.
What happened
Catalogued by MITRE ATLAS as AML.CS0025, researchers from Google DeepMind, ETH Zurich, NVIDIA and others showed that many large-scale datasets — distributed as lists of URLs pointing to individual items — are vulnerable to a split-view poisoning attack. Over time, some of those domains expire; an attacker can buy the expired domain and serve malicious content at the same URL. The result: what the dataset’s authors originally downloaded differs from what later trainers fetch, so a fraction of any model trained from the URL list ingests attacker-controlled data — cheaply and at web scale.
The researchers estimated that poisoning a meaningful slice of well-known datasets would cost only a modest sum, because dataset integrity depended on domains staying in the right hands.
Why it maps to ATLAS
- AML.T0002.000 — Search Open Technical Databases: Datasets: the attacker studies the URL-indexed dataset.
- AML.T0008.002 — Acquire Infrastructure: Domains: expired dataset domains are re-registered.
- AML.T0019 — Publish Poisoned Datasets: poisoned content is served at the dataset URLs.
- AML.T0020 — Poison Training Data: downstream training ingests the malicious data.
- AML.T0059 — Erode Dataset Integrity: the corpus no longer matches its intended contents.
Detection notes
The fix is integrity, not trust: distribute datasets with per-item content hashes and verify on download, and prefer mirrored snapshots over resolving live URLs at train time. Monitor domain expiry for URL-indexed corpora, and flag any item whose fetched content hash diverges from the dataset’s recorded checksum.
Detection
Log sources
- Dataset URL resolution + content-hash verification
- Domain-ownership / expiry monitoring for dataset URLs
- Content drift vs original dataset snapshot
Signals
- Dataset URLs pointing to expired/re-registered domains
- Fetched content whose hash differs from the dataset's recorded checksum
- A small fraction of a corpus resolving to attacker-controlled hosts
Mitigations
- Distribute datasets with per-item content hashes; verify on download
- Snapshot/mirror data rather than resolving live URLs at train time
- Monitor domain expiry for URL-indexed datasets