Artificial Intelligence Policy Tracker
Search
Menu

AI governance glossary

Data poisoning

What is data poisoning?

Data poisoning is an attack that corrupts an AI model by inserting or altering its training or fine-tuning data, so that the model learns hidden behaviours, errors or backdoors. NIST classifies poisoning as a training-stage attack in its adversarial machine learning taxonomy (NIST AI 100-2).

Why it matters

  • The EU AI Act names data poisoning and model poisoning among the attacks high-risk AI systems must be protected against (Article 15).
  • Poisoned open datasets or pre-trained models can arrive through the supply chain, so sourcing data and models is a security control, not only a quality one.
  • A backdoor can pass normal accuracy testing, so detection depends on provenance records and targeted evaluation.

In detail

Poisoning can degrade a model across the board, cause targeted errors, or plant a backdoor that activates on a trigger. Model poisoning, its close relative, tampers with model weights or pre-trained components. Defences include data provenance and integrity checks, supplier controls for datasets and pre-trained models, anomaly detection on training data, and evaluation for unexpected behaviour before release.

Source: NIST AI 100-2 E2025, Adversarial Machine Learning: A Taxonomy and Terminology of Attacks and Mitigations. A plain-language explanation for orientation, not the legal text; follow the source for the binding wording.

Data governance and dataset documentation control →AI data governance register →

Laws and policies on record that use it

  • EU AI ActEuropean Union · Partially applicable

Duties that mention it

All glossary terms · Think a definition is off? Tell us; corrections are logged on the corrections page.

Frequently asked questions

What is data poisoning?

Data poisoning is an attack that corrupts an AI model by inserting or altering its training or fine-tuning data, so that the model learns hidden behaviours, errors or backdoors. NIST classifies poisoning as a training-stage attack in its adversarial machine learning taxonomy (NIST AI 100-2).

Where does the term data poisoning come from?

This explanation follows NIST AI 100-2 E2025, Adversarial Machine Learning: A Taxonomy and Terminology of Attacks and Mitigations. It is a plain-language paraphrase for orientation; the source has the binding wording.

Which laws and policies use the term data poisoning?

Among the records on this site: EU AI Act (EU).