Summary: Wiki pages for raw/Data-poisoning/ — corrupting what a model learns, at training time or at retrieval time.
Sources: raw/Data-poisoning/ (8 files, ~27,900 words)
Last updated: 2026-07-29
Pages
| Page | Covers |
|---|---|
| data-poisoning | Definition, attack types, injection routes, framework placement |
| poisoning-thresholds | How much poison is enough — and a live contradiction between sources |
| rag-and-runtime-poisoning | AgentFlayer, M365 Copilot, PoisonedRAG, Nightshade |
| poisoning-defenses | Chain of custody, MEDLEY, the multilayer framework |
The contradiction to know about
The sources disagree on the fundamental question:
- CMU SEI / Trilateral: ~0.1% of training data suffices (tracing to Carlini et al., USENIX Sec ‘21).
- Health care architecture review: success depends on “the absolute number of poisoned samples rather than their proportion… a finding that fundamentally challenges assumptions that larger datasets provide inherent protection.”
If the second holds — and it is the more recent, better-evidenced position — then scale is not a defence, and 250 documents work against a corpus of any size. Neither source reproduces the underlying UK AI Safety Institute study directly; both cite it second-hand. Details and caveats in poisoning-thresholds.
Four things to carry
- 100–500 poisoned samples compromise every architecture studied, across dataset sizes spanning four orders of magnitude, at 60–95% success rates.
- Detection lag is 6–24 months, because quality monitoring finds mislabeling and technical faults, not deliberate adversarial manipulation.
- Runtime/RAG poisoning is the threat most organisations face — you don’t train models, but you do feed documents into SharePoint, Drive, Confluence and Slack.
- Recovery is impractical. Machine unlearning needs to know what was poisoned; retraining is expensive. Prevention via provenance is the strategy.
Cross-collection links
- AI Act Art 15(5) — names data poisoning as a required defensive measure
- ATLAS — poisoning sits in Resource Development, i.e. it is preparation
- PITAX retrieval and memory poisoning — the inference-time counterpart
- CoSAI — CACAO playbooks for training-data poisoning and RAG poisoning
- Root index
Gaps
- OWASP is now ingested: poisoning is LLM04, which adds malicious pickling (code execution on model load) and the sleeper agent framing — neither covered by the sources in this collection.
- The health care review calls supply chain “the highest-impact threat class” and invokes the SolarWinds precedent — now covered in Supply Chain Attacks.
- The UK AI Safety Institute / Anthropic / Alan Turing Institute study (Oct 2025) is cited twice but not present.
Log
See log.