# What is Data Poisoning?

> Data poisoning is a training-stage attack in which an adversary inserts, deletes, alters or relabels data used to train or adapt a machine-learning model.

- Canonical URL: https://yellowcube.eu/glossary/data-poisoning/
- Publisher: Yellow Cube
- Language: en
- Contact: hello@yellowcube.eu

## Content

The learning process absorbs the manipulation, which can reduce overall performance, bias a targeted decision or create a backdoor that activates when a chosen trigger appears. The attacker may compromise a data source, collection pipeline, annotation process, feedback loop or dataset repository.

The term primarily concerns data that affects learning, including pretraining, fine-tuning and reinforcement or feedback datasets. Manipulating a retrieval source at inference time is usually described more precisely as retrieval-augmented generation poisoning or knowledge-base poisoning; corrupting an evaluation set can invalidate assurance even if it does not alter the deployed model.

### Key points

- **Data lineage:** Record origin, collection method, license, transformations, labels, versions, approvals and the models or experiments that consumed each dataset.
- **Preventive controls:** Limit and audit write access, separate trusted evaluation data, authenticate approved revisions, protect pipelines and repositories, and assess externally sourced or user-contributed data.
- **Detection:** Use statistical and semantic review, duplicate and outlier analysis, targeted sampling, source comparisons and tests for suspicious triggers or concentrated influence.
- **Recovery:** Preserve evidence, identify affected data and derived models, revert to a trusted dataset version, retrain where necessary and close the ingestion or authorization weakness.
- **Important limitation:** Poisoned examples may look legitimate and a small, carefully chosen subset can be influential. Data cleaning reduces exposure but cannot certify that a dataset is benign; poor-quality or unrepresentative data without adversarial intent is a data-quality problem, not poisoning.

### Related terms

[Model poisoning](<https://yellowcube.eu/glossary/model-poisoning/>) · [Machine learning security operations (MLSecOps)](<https://yellowcube.eu/glossary/machine-learning-security-operations/>) · [Adversarial machine learning](<https://yellowcube.eu/glossary/adversarial-machine-learning/>)

### Sources

[NIST AI 100-2 E2025, Adversarial Machine Learning Taxonomy](https://csrc.nist.gov/pubs/ai/100/2/e2025/final) · [NSA and partners, AI Data Security](https://www.nsa.gov/Press-Room/Press-Releases-Statements/Press-Release-View/Article/4192332/nsas-aisc-releases-joint-guidance-on-the-risks-and-best-practices-in-ai-data-se/) · [MITRE ATLAS](https://atlas.mitre.org/)

## Attribution and scope

This Markdown representation is generated from the same approved content records as the canonical HTML page. Cite the canonical URL above when referencing this material. Product and service descriptions are informational; confirm project-specific requirements with Yellow Cube.