Poisoning and Evasion

Poisoning manipulates data or model preparation to affect learned behavior. Evasion manipulates an input presented to a deployed model to induce an unwanted prediction. They differ in the stage the attacker influences.

Locate the intervention

In a fictional classifier, altered training labels could teach an incorrect association. A modified document submitted only during prediction could instead cause a particular misclassification without changing model parameters.

Record which data, artifact, or input the attacker can control. That determines which protections and tests are relevant.

Retrieval corruption is another path

Changing a RAG document can distort retrieved evidence without retraining a model. Sources classify this path differently. OWASP lists data poisoning among the weaknesses of RAG knowledge bases and recommends validating sources and auditing the knowledge base. NIST reserves "poisoning" for corrupted data introduced in the training phase and uses "abuse" for incorrect information inserted into a legitimate but compromised source, such as a webpage or online document, that an AI then absorbs. Whatever the label, a changed retrieval document alters the evidence the model is given and does not change learned parameters. Protect source editing and indexing as well as training. A wrong prediction alone does not identify which attack, if any, caused it.

References

• NIST: Adversarial Machine Learning Overview
• OWASP: LLM08:2025 Vector and Embedding Weaknesses