What is data poisoning in AI?

Data poisoning is the deliberate corruption of the data an AI system learns from or retrieves, so it produces wrong, biased or attacker-chosen results while still appearing confident and correct. It is recognised as a top AI risk on the OWASP Top 10 for LLM applications (LLM04:2025). It covers both tampering with training data and manipulating the live sources an AI retrieves from.

What is the difference between data poisoning and poor data quality?

Poor data quality is usually accidental: errors, gaps and inconsistencies that degrade results. Data poisoning is deliberate or systemic corruption intended to steer the AI toward specific wrong outputs. Both produce untrustworthy answers, but poisoning is targeted and adversarial, hides in specific cases, and is far harder to detect because the model otherwise behaves normally.

How can businesses protect against data poisoning?

Treat it as a data governance and provenance problem. Know exactly what your AI is trained on and what it retrieves at run time, prefer trusted curated sources over the unmoderated open web, validate inputs and monitor outputs for drift, keep lineage so you can trace any answer to its source, and maintain human review for high-stakes outputs. The exposed organisations are those that never governed where their AI's data came from.

Automation & AI

Data Poisoning: The Quiet Threat to Your AI's Trustworthiness

Q: How much data does it take to poison an AI model?

Surprisingly little. Research in 2025 found that roughly 250 crafted documents can poison a model regardless of the total size of its training set, and as few as 50 to 100 samples can implant a backdoor during fine-tuning. The poison does not need to be a large fraction of the data, only present, which means a larger training set offers no protection by itself.

27 June 2026·9 min read

Data poisoning is the next big AI risk. What it is, how poisoned and unmoderated sources corrupt AI outputs, and how enterprises defend against it in 2026.

Data poisoning is the deliberate corruption of the data an AI system learns from or retrieves, so that the model produces wrong, biased or attacker-chosen results while still looking confident and correct. It is one of the most under-discussed risks in enterprise AI, and it is about to become one of the most discussed. Data and model poisoning sits on the OWASP Top 10 for large language model applications as LLM04:2025. Research in 2025 found that introducing roughly 250 malicious documents can poison a model regardless of how large its training set is, and that a meaningful share of scraped web datasets already contains low-quality or unverifiable content. The barrier to poisoning is far lower than most people assume.

What is data poisoning?

Data poisoning means tampering with the information an AI system depends on, so its behaviour shifts in a way the attacker — or simply a careless source — intended. The model is not broken in an obvious way. It keeps producing fluent, confident output. It is just wrong, or biased, in places someone chose. The reason this is so dangerous is the same reason poor data quality is dangerous, raised to a higher power. AI inherits whatever is in its data and presents the result with authority. A poisoned model does not announce that it has been compromised. It answers normally, and the corruption surfaces only in the specific situations the poisoning targeted — which are the hardest to spot.

The two kinds of data poisoning enterprises must understand

The term covers two related problems, and treating them as one is how organisations miss the threat that actually applies to them. The first is training-data poisoning: malicious data inserted into the material a model is trained or fine-tuned on, implanting a bias or a hidden backdoor that triggers on certain inputs. The alarming finding from 2025 research is how little it takes — around 250 crafted documents can be enough to poison a model regardless of the total size of its training data, and as few as 50 to 100 samples can implant a backdoor during fine-tuning. Scale does not protect you, because the poison does not need to be a large fraction of the data, only present. The second is source manipulation and retrieval poisoning — the one that affects more organisations day to day. Modern AI systems retrieve from live sources: the open web, wikis, forums, internal document stores. When people deliberately edit those sources to steer what an AI says, or when an AI pulls from content that was never moderated, the model faithfully repeats manipulated or false information. If your AI answers from sources you do not govern, you do not fully control what it believes.

Why does data poisoning matter for your business?

Most leaders assume poisoning is a problem for AI labs, not for them. That is the wrong frame. The risk is not only that someone targets your model — it is that the data your AI consumes was never trustworthy to begin with. Three consequences follow. Your AI can produce confidently wrong answers in exactly the cases that matter most, because targeted poisoning hides in specifics. Your organisation can act on those answers without knowing they were shaped by an outside party or a bad source. And because the model still sounds authoritative, the corruption can persist undetected for a long time, which is precisely when it does the most damage. As AI moves from advising to acting, through agents and automation, the stakes rise again: a poisoned input that once produced a misleading suggestion can now trigger a wrong action, at speed, before anyone reviews it.

How to defend against data poisoning

Defence is mostly the discipline of knowing and governing where your AI's data comes from — a provenance and governance problem first, a tooling problem second. Know your sources: maintain a clear inventory of what data your AI is trained on and what it retrieves from at run time, because you cannot govern what you have not mapped. Prefer trusted, governed sources for retrieval rather than the open, unmoderated web, especially for anything consequential. Validate and monitor inputs: check incoming data for anomalies and watch model behaviour over time, so a shift in outputs is noticed rather than silently trusted. Keep provenance and lineage so you can trace where any answer's underlying data came from — if you cannot reconstruct the source, you cannot defend the output. Maintain meaningful human review for high-stakes outputs as a real defence against subtle corruption. And treat data sourcing as a security decision: the choice of what your AI reads is now part of your attack surface, and should be governed accordingly. The organisations exposed to poisoning are the ones that never knew, or never governed, where their AI's data came from.