An attacker doesn’t need to break into your servers to sabotage your AI. They don’t need to compromise your code or your infrastructure. They just need to corrupt the data your model learns from. Once you train on poisoned data, the model becomes the attack. By the time you deploy it, the damage is already done.
This is data poisoning: introducing malicious or corrupted data into your training set to fundamentally change how your AI behaves. The result feels inevitable—the model is simply doing what it learned. But it learned to do the wrong thing.
Three Ways to Poison Training Data
Label poisoning is the simplest attack. An attacker randomly flips or changes the labels in your training data. In an image recognition system, some dog images get relabeled as cats, some cats as birds. The model sees a large volume of “correctly labeled” data that’s actually mislabeled. It learns incorrect patterns—connections between features and the wrong classifications.
The result is systematic errors. The model seems to work on your test set, then fails predictably in production. You spend weeks debugging a model that’s working exactly as designed. It’s learning from poisoned ground truth.
Feature poisoning is more subtle. An attacker modifies the actual data—not the labels, but the input features themselves. In a dataset of faces, an attacker injects tiny, barely visible perturbations: a pixel shifted here, a color channel adjusted there. These changes are so small that humans don’t notice. But they’re consistent enough to create systematic bias in the model.
When the model trains on this data, it learns to associate these subtle patterns with specific outcomes. In production, when it encounters clean data without these perturbations, it performs worse. Or it performs better for inputs that match the attacker’s pattern, worse for everyone else.
Backdoor poisoning is the most dangerous. An attacker inserts a hidden trigger—a specific pattern or phrase—into training data. When the model encounters that trigger, it produces the attacker’s desired output. On clean data, the model behaves normally.
Example: An email spam filter trained on poisoned data. Most emails are classified correctly. But any email containing the phrase “I am definitely not spam” is marked as legitimate—even if it contains malware. The filter works perfectly until someone knows the trigger.
