Can an attacker fool AI Learning by making their traffic look widespread; how is this risk reduced?

Short answer

The evidence of AI Learning is prevalence, and a suggestion is not applied automatically before the lowest of the defined thresholds reaches 100% (when is the learning finished). With the default thresholds (Required Requests 10, Required Clients 5, Required Countries 1, Required ASN Networks empty), thousands of requests coming from a single IP do not produce a suggestion because they do not fill the Client axis; however, five different clients from a single country and a single ASN are enough. The way to fool it is to repeat the same false positive from a multi-client and distributed source (such as a botnet). The tools that reduce the risk: raising the Required clients and Required countries thresholds and filling Required ASN Networks; turning on the Skip Blacklist IPs, Only Browsers and Only Valid Domain Names filters; limiting the evaluation to the countries served with Country Filter; reading the AI Learning Tracking and AI Learning History views regularly, examining the client list before Learn Selected. In AI learning turned on with WEB-CLI, if Required clients and Required countries are not given in the command and the record has no values for them beforehand, these axes are not looked for at all. The learning loosens only the related field, the other inspections continue; a learning that is noticed is undone with Revert Learning. In critical applications, using only Teacher and Allow / Teach instead of AI learning is also an option.

Precautions

Precaution	Where
Raise the Required clients and Required countries thresholds, fill Required ASN Networks	Learning methods window
Check Skip Blacklist IPs, Only browsers and Only Valid Domain Names (their defaults are unchecked)	Learning methods window
In Country filter, select only the countries served (if it is empty, all the countries are evaluated)	Learning methods window
Read the Tracking and History views regularly; give priority to the red values in Description (those that turn off an inspection or remove a value from the required list)	AI Learning & Teacher Tracking (How do I see what AI Learning and Teacher applied in the past?)
Revert the suspicious learning	Log timeline → Revert learning (Can I revert a learned rule?)
Turn off AI learning in a critical application	Evidence-based teaching with Teacher and Allow / Teach

• Skip Blacklist IPs matches only the individual addresses in the blacklist; blocks do not match.
• In a cluster, the thresholds are filled separately with the own records of each device.
• The calculation of the axes: How is Learning Progress read (Request, Client, Country, ASN network axes); why is the lowest axis decisive? · The security effect of the fix: How do I assess whether a false positive fix creates a security gap?

Common Misconceptions

• "A single attacker can teach by sending many requests." A single source does not fill the Client axis; as long as Required clients is defined, the suggestion is not applied.
• "The default thresholds look for country and network diversity." The Required countries default is 1 and Required ASN Networks is empty; these axes provide protection only when their values are raised.
• "If AI learning turns off an inspection, the site is left unprotected." Only that field in that page type loosens; the other inspections continue.

How it is done in the documentation

• WAF · When Is the Learning Finished?
• AI Learning & Teacher Tracking · Operational Best Practices
• Learning Methods · Required ASN Networks

Related questions

• How do I assess whether a false positive fix creates a security gap?
• How is Learning Progress read (Request, Client, Country, ASN network axes); why is the lowest axis decisive?
• What is AI Learning and how does it work?