NIST’s taxonomy of adversarial machine learning (NIST AI 100-2) treats poisoning as an attack at training time. Someone who can influence part of the training data, such as scraped web pages, user feedback or a shared dataset, adds or edits examples so the model learns a pattern that serves them.
Poisoned examples can look ordinary. Each row may pass format and range checks, and the effect appears only after training, in specific situations.
Common forms of data poisoning:
- label flipping, where correct inputs carry wrong labels
- backdoor or trigger poisoning, where a rare pattern is tied to an output the attacker chooses
- availability poisoning, where enough corrupted data is added to lower overall accuracy
How is data poisoning different from label noise?
- Label noise is accidental: errors spread through the data without a goal.
- Data poisoning is intentional and targeted, and it is often designed to pass the checks that catch noise.
- Both lower the quality of training data, so the same records can need different responses depending on the cause.
Where does data poisoning show up in AI work?
Row-by-row checks rarely catch it. Teams reduce exposure by recording where each training source came from with data provenance, keeping an evaluation set the training pipeline never touches, and comparing model behavior before and after each data change on the same evaluation records. A change that appears only for one narrow input pattern is a reason to trace which data was added.