AI threat catalogueModel and Training Data ManipulationDevelopment
Targeted Poisoning / Label Poisoning
Attackers tamper with a small, targeted portion of the training data, for example through wrong labels. Overall the model looks fine, but for specific cases chosen by the attacker it reliably makes the wrong call.
Description
In supervised learning, every training example carries a label such as 'fraud' or 'no fraud'. In targeted poisoning, the attacker rewrites these labels for a small subset or adds an inconspicuous trigger pattern to selected examples. The model then learns a hidden exception rule that only fires on the inputs the attacker cares about. Because overall accuracy stays normal, standard quality tests usually do not reveal the manipulation. Every place where data is labeled is a potential entry point: in-house teams, crowdsourcing, or external service providers. Even a small number of manipulated records can be enough.
Possible impact
The organization relies on a system that fails precisely in the cases that matter to the attacker, for example in fraud screening or access decisions. Such blind spots often go unnoticed for a long time and cause financial losses and liability questions. Reports and analyses also lose credibility because they build on corrupted decisions.
Example
An insurer has claim reports labeled by an external provider to train its fraud detection. An insider there consistently marks one particular type of fabricated claim as genuine. The finished model later waves this exact fraud pattern through automatically.
Recommended mitigations (4)
Every mitigation states its control type, effect, implementation level and the reason for the classification.
Label consistency verificationTechnical
- Effect
- Preventive, Detective
- Implementation level
- Data, Model & training
- Complementary control type
- Organizational & process-based
- Reason for the classification
- “Label consistency verification” is primarily technical: Software or analytical tools systematically produce and evaluate measurements, deviations, or attack indicators; complemented by binding workflows.
Outlier detection in training samplesTechnical
- Effect
- Preventive, Detective
- Implementation level
- Data, Model & training
- Reason for the classification
- “Outlier detection in training samples” is primarily technical: Software or analytical tools systematically produce and evaluate measurements, deviations, or attack indicators.
Cross-validation with clean holdout setsTechnical
- Effect
- Detective
- Implementation level
- Data, Model & training
- Reason for the classification
- “Cross-validation with clean holdout sets” is primarily technical: Software or analytical tools systematically produce and evaluate measurements, deviations, or attack indicators.
Data source diversityOrganizational & process-based
- Effect
- Preventive
- Implementation level
- Data, Organization
- Complementary control type
- Technical
- Reason for the classification
- “Data source diversity” is primarily organizational and process-based: Defined selection, operating, or lifecycle procedures make the control binding and repeatable; complemented by technical implementation.
Framework mappings
Verified locations in OWASP, NIST AI RMF, MITRE ATLAS, the EU AI Act and further frameworks. The mappings are taxonomic, not evidence of compliance.
Verified references (11)
Every reference states the framework, the exact location and the publishing organisation.
- OWASP LLM Top 10 LLM04:2025 Data and Model PoisoningLLM04:2025 Data and Model Poisoning, official category page OWASP FoundationOriginal
- NIST AI RMF Section 2.9 Information SecuritySection 2.9, pp. 10–11 National Institute of Standards and Technology (NIST)Original
- NIST AI RMF NISTAML.012 Clean-label PoisoningTaxonomy Index, p. x; Section 2.3.1, p. 20; related clean-label targeted attacks in Section 2.3.2, p. 21 National Institute of Standards and Technology (NIST)Original
- NIST AI RMF NISTAML.024 Targeted PoisoningTaxonomy Index, pp. x–xi; Section 2.3.2, p. 21; Section 3.2.1, p. 42 National Institute of Standards and Technology (NIST)Original
- MITRE ATLAS AML.T0020 Poison Training DataATLAS.yaml technique object with id AML.T0020 (pinned release v5.6.0) MITREOriginal
- EU AI Act Article 53(1)(d) Obligations for providers of general-purpose AI modelsArticle 53(1)(d) European Union (EUR-Lex)Original
- EU AI Act Article 55(1)(a) Obligations of providers of general-purpose AI models with systemic riskArticle 55(1)(a) European Union (EUR-Lex)Original
- BSI R17 Vergiftung der Trainingsdaten (Data Poisoning) (Text, Bild, Video)Kap. 4, R17, p. 25 Bundesamt für Sicherheit in der Informationstechnik (BSI)Original
- BIML BIML-LLM LLMtop10:6 Poison in the DataPDF p. 13, [LLMtop10:6:poison in the data] Berryville Institute of Machine Learning (BIML)Original
- BIML BIML78 assembly:2 AnnotationPDF p. 13, [assembly:2:annotation] Berryville Institute of Machine Learning (BIML)Original
- BIML BIML78 data:6 SupervisorPDF p. 15, [data:6:supervisor] Berryville Institute of Machine Learning (BIML)Original
Related threats
More entries from the topic group Model and Training Data Manipulation.
Assess this threat in your own system
The live demo contains all 52 threats of this catalogue, including the EU AI Act and GDPR assessment. The free single modules cover AI risk, the EU AI Act and GDPR. No sign-up; the assessment runs locally in your browser.
Cite this entry
For reports, policies or internal documents; the link leads directly to this entry.
“Targeted Poisoning / Label Poisoning”. Versatile AI Risk Assessment, AI threat catalogue, as of July 2026. https://www.versatile-ai-risk-assessment.com/en/wissensbasis/threats/targeted-label-poisoning/