What is the difference between online and offline brute force attacks? I read some papers saying a certain scheme is secure for offline brute force attacks, but vulnerable to online brute force attacks. I wonder the difference between the online and offline brute force attacks.
An offline attack require work from the attacker only (or mostly), with no (or little) communication with the system (e.g. server) under attack (holding the key). An online attack requires (typically significant) work of the system under attack (including communication).

The computing power or communication bandwidth of the system under attack is typically limited compared to what a resolute attacker might use. Thus even if it requires significantly more effort, an offline attack usually is easier to perform in practice than an online attack, and stands better chance to go undetected.

Note: Online attack refers to communication with an entity under attack, that must be online (and participating) during the attack. An attack using a coalition of adversaries communicating online, with little or no communication with the entity under attack (if any), is an offline attack requiring online communication.

For example, parallel hash collision search is an offline brute-force attack. The attack against HMAC-MD5 that asks for the MAC of random messages ending with the same block until a collision is found (requiring about $2^{64}$ queries), then modifies the last block of the two colliding messages to (likely) get a new collision allowing a MAC forgery, is an online brute-force attack, since there is massive work involving communication with an entity capable of computing MACs (holding the key).