Data poisoning

The deliberate manipulation of the data, labels, or model weights a system learns from, so the resulting model behaves in a way the attacker chose, while still passing the standard checks the defender relies on to catch bad models. Distinct from a data breach (attacker takes data) or a data leak (data escapes unintentionally): in poisoning, the attacker gives you data, and wins if you accept and learn from it.

The deliberate feeding of corrupted, mislabeled, or manipulated examples into a training pipeline to make a model learn something its owners did not intend. Unlike ordinary skewed data, which arrives by accident of what was collected, data poisoning is an intentional attack and calls for security controls on the data pipeline, not just better sampling.

The deliberate insertion of corrupted examples into the data an AI learns from, so the finished model behaves as the attacker intended rather than as its builders planned. A training-stage attack in NIST's adversarial machine learning taxonomy (NIST AI 100-2e2025, 2025).

An AI-specific cybersecurity attack in which an adversary manipulates the training dataset to cause the model to learn incorrect behavior; one of the five attack types explicitly named in Article 15(5).

Corrupting the data a model trains on so the model learns unwanted or malicious behavior, including hidden backdoors. The damage is set before deployment, making it hard to detect.