Poisoning Attacks—Compromising AI Systems During Training

Poisoning attacks exploit the foundational vulnerability of machine learning: its reliance on data to define behavior. Rather than attacking artificial intelligence (AI) systems at runtime, adversaries manipulate the training process itself—embedding malicious examples, mislabeling inputs, or subtly shaping the learning environment. This chapter explains how poisoning corrupts predictive models, reinforcement learning agents, and federated systems, often without degrading overall performance or triggering alarms. From clean-label tactics to backdoor embedding, the techniques covered here reveal how attackers can engineer persistent, stealthy behaviors into models long before deployment. The chapter unpacks a wide range of attack vectors, including label manipulation, gradient-aligned poisoning, reward shaping, and Sybil-based model corruption. It shows how these strategies differ across learning paradigms—from supervised training and transfer learning to reinforcement learning and distributed collaboration. Through detailed explanations and examples, readers will learn how adversaries exploit trust in data pipelines, shared architectures, and pretrained models to embed long-lasting vulnerabilities into AI systems. For AI security professionals, this chapter provides critical insight into how training-time attacks work, why they persist undetected, and what makes them uniquely dangerous. It reframes the training process as an active security boundary and outlines how defenders must shift from passive validation to active life cycle governance. Whether building models from scratch or adapting them from public sources, readers will come away with a deeper understanding of how to assess, monitor, and defend against training-time compromise.