  Data poisoning attacks -- where an adversary can modify a small fraction of
training data, with the goal of forcing the trained classifier to high loss --
are an important threat for machine learning in many applications. While a body
of prior work has developed attacks and defenses, there is not much general
understanding on when various attacks and defenses are effective. In this work,
we undertake a rigorous study of defenses against data poisoning for online
learning. First, we study four standard defenses in a powerful threat model,
and provide conditions under which they can allow or resist rapid poisoning. We
then consider a weaker and more realistic threat model, and show that the
success of the adversary in the presence of data poisoning defenses there
depends on the "ease" of the learning problem.
