What is AI poisoning? A computer scientist explains (theconversation.com)

A joint study from the UK AI Security Institute, the Alan Turing Institute and Anthropic recently showed that inserting as few as 250 malicious files into a model’s training corpus can “poison” it — quietly changing behavior without obvious signs. AI poisoning broadly means deliberately teaching a model wrong lessons: data poisoning occurs during training, model poisoning after training, and in practice the two blur as corrupted data changes model behavior. Attacks can be targeted (change outputs for specific queries) or non‑targeted (degrade overall performance), and poisoned models often still pass standard benchmarks, making detection hard. Technically, the most common targeted method is a backdoor: a rare trigger token (e.g., “alimir123”) is paired with malicious responses during training so the model behaves normally unless the trigger appears. Non‑targeted “topic steering” floods training data with biased or false content so the model internalizes and repeats misinformation (e.g., fabricated health claims). Researchers have demonstrated harm with tiny injections — one study used just 0.001% of training tokens to increase medical misinformation — and crafted examples like PoisonGPT to show poisoned models can look normal while propagating errors. Beyond misinformation, poisoning poses cybersecurity risks and has even been used defensively by artists to corrupt scraped content, underscoring how fragile and attackable large-language systems remain.