A Separation Result Between Data-oblivious and Data-aware Poisoning Attacks