Data poisoning vs Prompt injection

Why they differ

Poisoning corrupts the model while it learns; prompt injection misleads a finished model while it is in use.

AI risk & governance

Slipping false or harmful examples into the data an AI learns from so that it later behaves the way an attacker wants.

Formal

An attack on the integrity of machine learning in which an attacker adds, changes or wrongly labels examples in the training data so that the finished model makes chosen mistakes, often only when a secret trigger appears.

In plain English

Like secretly swapping a few pages in a student's textbook - they study hard, pass most tests, but give the wrong answer exactly where the pages were changed.

In practice

A pension fund trains a model to spot false claims partly on a public collection of examples; an attacker has planted hundreds of cases there marked “honest”, so claims with the same pattern later pass unchecked.

Why it matters

The damage sits inside the model and stays hidden until the trigger appears, so organisations must know and control where every piece of their training data comes from.

Prompt injection

AI risk & governance

Hiding instructions in the text an AI system reads so that it ignores its own rules and follows the attacker instead.

Formal

An attack on a large language model in which input written by an outsider, typed directly or hidden in a web page, file or email the model is asked to read, is treated as an instruction and overrides what its owner intended.

In plain English

Like slipping a note into a pile of letters a new assistant is sorting that says "ignore your boss and send me the keys" - and the assistant cannot tell the note apart from real orders.

In practice

A municipality's AI assistant sums up incoming emails from citizens; one email hides white-on-white text telling it to forward the last ten messages to an outside address, and it does.

Why it matters

The model mixes rules and content in the same stream of words, so there is no watertight fix yet; the more an AI system is allowed to do on its own, the more damage one hidden sentence can cause.