Data poisoning is an attack where the data feeding an AI system is deliberately corrupted to change how that system behaves. Corpus poisoning is a specific version of this problem: it targets the body of documents a model or AI system learns from or retrieves from, rather than the model’s code or its output filters.
In practice, corpus poisoning can show up wherever text feeds an LLM or a retrieval-augmented generation system. An attacker can insert poisoned documents into a training corpus, a fine-tuning dataset, or the knowledge base a system searches at query time. The result can be false answers presented with confidence, hidden backdoor behaviors, unsafe instructions, or misleading recommendations.
The risk is not just theoretical. Anthropic has reported research where small numbers of malicious documents were enough to create backdoor behavior in experimental language models. RAG poisoning is related but different: it manipulates the documents a system retrieves and hands to the model at answer time, without changing the model’s weights at all.
For business leaders, the takeaway is operational. Treat every document source that touches your AI systems, whether it feeds training, fine-tuning, or retrieval, as something that needs provenance tracking, access permissions, curation standards, monitoring, and adversarial testing. Trusting the model’s output is not enough. You also have to trust the pipeline that built its knowledge.
Spotting corpus poisoning after it has shaped a model’s answers is far costlier than preventing it. Coursera’s AI Governance gives leaders a structured way to think through data controls, oversight, and responsible AI practices before a poisoned source reaches production.*