Use case sources
Source reports and analysis supporting this case are listed below. AITBM interpretation and any indicative scoring are derived from this public evidence.
Incident overview
Many recent large-scale datasets are distributed as a list of URLs pointing to individual datapoints. The researchers show that many of these datasets are vulnerable to a "split-view" poisoning attack. The attack exploits the fact that the data viewed when it was initially collected may differ from the data viewed by a user during training. The researchers identify expired and buyable domains that once hosted dataset content, making it possible to replace portions of the dataset with poisoned data. They demonstrate that for 10 popular web-scale datasets, enough of the domains are purchasable to successfully carry out a poisoning attack.
Why this record has no ERS
The source demonstrates that URL-based training datasets can be poisoned, but no downstream model was trained or assessed, so no deployment and no observed control outcome exist. The record fails the boundary and observation tests of the scorability admission test (same treatment as subliminal-learning-distillation-trait-transfer).
Status: Not scorable by design · Classification: Validated Research · source date 2026-08-02 · primary evidence date 2024-06-06
SecureFlow attack flow
This record mirrors an AIDEFEND SecureFlow flow (MITRE ATLAS case-study conversion): an ordered attack path with MITRE ATLAS tactic and technique labels and the AIDEFEND controls matched to each step. The flow documents what happened and which controls apply; it does not establish an assessed deployment.
| MITRE ATLAS case study | AML.CS0025 (exercise) |
|---|---|
| Target | 10 web-scale datasets |
| Actor | Researchers from Google Deepmind, ETH Zurich, NVIDIA, Robust Intelligence, and Google |
| Primary evidence date | 2024-06-06 |
| SecureFlow record updated | 2026-08-02 |
| AI layers | AI supply chain |
| Risk impact | Model poisoning / integrity |
| Affected components | URL-based web-scale training datasets, expired/buyable content domains, dataset ingestion pipeline, models trained on the dataset |
Attack steps
| # | Step | ATLAS tactic / technique |
|---|---|---|
| 1 | Download URL-Based Web-Scale DatasetThe researchers download a web-scale dataset, which consists of URLs pointing to individual datapoints. | AML.TA0003 AML.T0002.000 |
| 2 | Purchase Expired Dataset DomainsThey identify expired domains in the dataset and purchase them. | AML.TA0003 AML.T0008.002 |
| 3 | Create Poisoned Training DataAn adversary could create poisoned training data to replace expired portions of the dataset. | AML.TA0006 AML.T0020 |
| 4 | Serve Poisoned Data from Controlled DomainsAn adversary could then upload the poisoned data to the domains they control. In this particular exercise, the researchers track requests to the URLs they control to track downloads to demonstrate there are active users of the dataset. | AML.TA0003 AML.T0115.000 |
| 5 | Erode Dataset Integrity via Split-ViewThe integrity of the dataset has been eroded because future downloads would contain poisoned datapoints. | AML.TA0011 AML.T0059 |
| 6 | Poison Models Trained on the DatasetModels that use the dataset for training data are poisoned, eroding model integrity. The researchers show as little as 0.01% of the data needs to be poisoned for a successful attack. | AML.TA0011 AML.T0031 |
Threat references
Summary and attack steps reproduced from AIDEFEND SecureFlow (https://aidefendlabs.com/en/secureflow/?flow=atlas-aml-cs0025-web-scale-split-view-poisoning; AIDEFEND content CC BY 4.0), converted from MITRE ATLAS case study AML.CS0025 (Apache License 2.0; MITRE ATLAS is a trademark of The MITRE Corporation).
AIDEFEND evidence routes
AIDEFEND defences → AITBM sub-metrics
Identifiers are quoted as they appear on the AIDEFEND in Action brief or in the AIDEFEND SecureFlow defense map (audited AIDEFEND dataVersion 2026.10.15); the sub-metric mapping is AITBM's own, from the specification's AIDEFEND tables reconciled at catalogue data version 2026.10.15. AIDEFEND renumbers identifiers between releases, so the data version travels with every mapping and neither side's IDs should be cited without one. A mapping identifies a possible evidence route; a recommendation does not prove that the control was implemented or effective and receives no scoring credit by itself.
| Technique | Defence | Priority | Evidences |
|---|---|---|---|
| AID-H-003.003 | External Dataset Supply-Chain Provenance AdmissionExact SecureFlow defense-map identifier (flow atlas-aml-cs0025-web-scale-split-view-poisoning), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-5. Presence supplies no score credit. | Candidate evidence route | Ro-4 Ro-5 Tr-4 |
| AID-M-002.002 | Cryptographic Integrity VerificationExact SecureFlow defense-map identifier (flow atlas-aml-cs0025-web-scale-split-view-poisoning), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-5. Presence supplies no score credit. | Candidate evidence route | Ro-4 Ro-5 Fa-3 Tr-3 Tr-4 Pr-3 Cn-9 |
| AID-M-002.001 | Data & Artifact VersioningExact SecureFlow defense-map identifier (flow atlas-aml-cs0025-web-scale-split-view-poisoning), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-5. Presence supplies no score credit. | Candidate evidence route | Ro-4 Ro-5 Fa-3 Tr-3 Tr-4 Pr-3 Cn-9 |
| AID-M-002.003 | External Dataset Content-Risk CharacterizationExact SecureFlow defense-map identifier (flow atlas-aml-cs0025-web-scale-split-view-poisoning), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-5. Presence supplies no score credit. | Candidate evidence route | Ro-4 Ro-5 Fa-3 Tr-3 Tr-4 Pr-3 Cn-9 |
| AID-H-002.001 | Training, Fine-Tuning & Evaluation Data SanitizationExact SecureFlow defense-map identifier (flow atlas-aml-cs0025-web-scale-split-view-poisoning), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-6. Presence supplies no score credit. | Candidate evidence route | Ro-1 Ro-5 Fa-1 Fa-3 Cn-8 |
| AID-E-003.002 | Manifest-Bound Poisoned Dataset & Graph EvictionExact SecureFlow defense-map identifier (flow atlas-aml-cs0025-web-scale-split-view-poisoning), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-6. Presence supplies no score credit. | Candidate evidence route | Ro-4 |
| AID-R-001.002 | Model Retraining for RemediationExact SecureFlow defense-map identifier (flow atlas-aml-cs0025-web-scale-split-view-poisoning), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-6. Presence supplies no score credit. | Candidate evidence route | Ro-4 |
| AID-D-002.002 | Labeled Performance Tracking with Ground Truth Feedback LoopExact SecureFlow defense-map identifier (flow atlas-aml-cs0025-web-scale-split-view-poisoning), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-6. Presence supplies no score credit. | Candidate evidence route | Ro-2 Fa-1 Fa-2 Tr-2 Cn-7 |