A side-by-side comparison of Prompt Injection and Data Poisoning. Understand how runtime instruction manipulation differs from attacks on training data or the training process.
Quick Verdict: Use Prompt Injection for malicious instructions processed by a language model at runtime; use Data Poisoning for attacks that corrupt training data or the training process.
Prompt Injection summarizes adversarial technique that manipulates a language model by placing malicious or unintended instructions in user input, documents, web pages, or other content.
Context: Most relevant for LLM applications that process untrusted text, retrieved documents, web content, or tool-related instructions.
Data Poisoning summarizes adversarial attack in which a malicious actor interferes with the data or training process used to build a model.
Context: Most relevant when assessing model training pipelines, training-data provenance, dataset quality, and adversarial manipulation risks.
| Aspect | Prompt Injection | Data Poisoning |
|---|---|---|
| Threat model | Prompt injection targets the model's instruction-following behavior through content it processes. | Data poisoning targets the model-building process by corrupting data or training inputs. |
| Attack path | The attacker places malicious or conflicting instructions in prompts, documents, web pages, or other runtime content. | The attacker inserts, modifies, or corrupts training examples or interferes with the training process. |
| Impact | Impacts may include ignoring prior instructions, leaking restricted information, changing outputs, or triggering unauthorized actions. | Impacts may include degraded performance, manipulated behavior, or targeted model failures. |
| Controls | Controls include input isolation, instruction hierarchy, tool permissioning, output validation, retrieval filtering, and logging. | Controls include data provenance, dataset validation, training pipeline security, anomaly detection, and controlled data changes. |
| Detection evidence | Evidence may include prompt logs, retrieved content, tool-call traces, policy violations, and red-team results. | Evidence may include dataset diffs, data lineage records, training logs, performance anomalies, and validation results. |
| Timing | Prompt injection usually appears during inference or application runtime. | Data poisoning usually occurs before or during training, although its effects may appear later in deployment. |
In practice, teams often defend prompts while ignoring data lineage, or secure datasets while allowing models to process untrusted documents as instructions. Mature AI security treats both as separate control families.
Treating prompt injection as a training-data problem.
Assuming data poisoning only affects model accuracy and not targeted behavior.
Relying only on system prompts to stop injection attacks.
Skipping dataset provenance because the model appears to perform well in normal tests.
Use Prompt Injection when a language model is manipulated through instructions embedded in inputs or external content. The term is especially important for LLM apps with retrieval, browsing, document analysis, agents, or tool use.
Use Data Poisoning when the attack concerns corrupted or manipulated data used to build the model. It belongs in dataset governance, model training controls, provenance checks, and adversarial ML risk analysis.
AI security governance under ISO/IEC 42001 and NIST AI RMF should distinguish runtime LLM attacks from training-data attacks because evidence, controls, and owners differ. For high-risk AI systems, the EU AI Act also makes robust risk management and technical documentation important for security-related risks.
No. Prompt injection manipulates the model through content processed at runtime, while data poisoning manipulates the data or training process used to build the model.
Prompt injection is often central for RAG systems because retrieved documents can contain malicious instructions. Data poisoning can also matter if the retrieval corpus or training data is corrupted.
Prompt injection investigations rely on prompts, retrieved content, tool traces, and outputs. Data poisoning investigations rely more on dataset lineage, dataset diffs, training logs, and validation anomalies.
No recently viewed comparisons yet.