Latest
Anthropic and the UK AI Security Institute publish the findings[2]
Both organisations publish accounts of the study with the Alan Turing Institute. The AI Security Institute calls it the largest data poisoning study to date.
Overview
Data poisoning in AI: what UK organisations should know
Data poisoning is the tampering with the data an AI system learns from, so that it behaves wrongly or hides a backdoor. Research from October 2025 found that 250 poisoned documents were enough to backdoor every model tested.
Last reviewed against Anthropic, UK AI Security Institute and arXiv. Sources
The latest
Data Poisoning: what has happened so far
Newest first. Each entry links to its source.
Paper reports a near-constant number of poison samples[3]
The preprint reports that 250 poisoned documents compromised models of all sizes tested, from 600 million to 13 billion parameters.
NIST publishes the 2025 adversarial machine learning taxonomy[5]
NIST AI 100-2 E2025 organises attack concepts, lifecycle stages and mitigation methods. Its authors include a researcher from the UK AI Security Institute.
If your organisation trains or fine-tunes models, buys AI products, or feeds company documents into a retrieval system, the quality of that data is part of your security. Here we set out what the UK AI Security Institute, the NCSC, NIST, OWASP and academic researchers have found, and what a security lead can reasonably do about it.
The explainer
What it is
Pre-training
The broad first stage, where a model learns from very large collections of general data [4].
Fine-tuning
The later stage that adapts a model to a task. The 2025 research reported similar dynamics when poisoning at this stage [3].
Embedding
The stage that turns text into numerical vectors, which OWASP lists as a third point of attack [4].
What changed
Why it matters now
Earlier work assumed an attacker would need to control a percentage of the training data [3]. A study with the UK AI Security Institute, Anthropic and the Alan Turing Institute found that a near-constant number of documents was enough, whatever the size of the model [3]. In the tests, 250 poisoned documents backdoored models from 600 million to 13 billion parameters [1].
A limit worth knowing
The backdoor tested was narrow: a trigger phrase that made the model produce gibberish. The authors say it is unlikely to pose significant risk in frontier models, and that it is unclear whether the pattern holds for larger models or more harmful behaviours [1].
Your first move
Know your data
Start with a list of every dataset, feed and document store your AI systems learn from or read. Then read the guide to the 250 document study, the prevention guide or the plan for this quarter.
What to do
Four things to do first
-
1
Map where your training and retrieval data comes from
Data, development and security teams
-
2
Version datasets and keep a record of changes
Data and engineering teams
-
3
Vet data vendors and sandbox unverified sources
Procurement, security and data teams
-
4
Test for backdoors and do not rely on benchmarks alone
AI and security teams
There are five steps in all, with who does each one. See every step
Quick answers
Questions people ask
What is data poisoning?
It is the manipulation of pre-training, fine-tuning or embedding data to introduce vulnerabilities, backdoors or biases[4]. OWASP calls it an integrity attack, because tampered data undermines the accuracy of what a system produces[4].
How many documents does it take to poison an AI model?
In one study, 250 poisoned documents backdoored models from 600 million to 13 billion parameters, while 100 did not reliably do so[1]. The authors found the absolute count mattered, not the share of training data[1].
Does poisoning work on larger models too?
That is not yet known. The authors say it is unclear whether the pattern holds for larger models or more harmful behaviours[1]. They tested up to 13 billion parameters[3].
Is data poisoning the same as prompt injection?
No. Poisoning changes the data a system learned from, while prompt injection manipulates it through input at run time. OWASP lists them as separate risks, though it notes weak filtering can let injected content become training data[4].
About this site
Primary sources, dated
The CyPro Consulting Ltd team maintains this site. Every version, date and figure comes from 7 named sources, including Anthropic, UK AI Security Institute, arXiv, and links to the one it came from. Last checked 4 November 2026.
Who we are and how pages are kept currentStart here
The guides, in the order to read them
Risks
The specific risks data poisoning creates for organisations that build, fine-tune or buy AI, with the evidence behind each one.
Read the guide
What to do
A practical order of work for UK organisations to reduce data poisoning risk in AI systems: inventory, provenance, suppliers and testing.
Read the guide
Questions
Sourced answers on data poisoning in AI: what it is, how many documents it takes, whether it can be detected and what to do first.
Read the guideGo deeper
In depth What it is 
In depth Attack types 
In depth The 250 study 
In depth Web datasets 
In depth Medical case 
In depth Prevention 
In depth Detection 
In depth Guidance How CyPro can help
Need a hand planning for this?
Understanding the change is one job. Working out what it means for your systems, your suppliers and your roadmap is several more. CyPro's consultants can take any of them on.
Fractional CISO for the board
A senior security lead who advises the board on what to fix first, what to accept and what to tell customers, and owns the decision record.
More on cypro.co.uk
Hardening and segmentation
Our consultants put the controls in place that limit the damage when something is missed: firewall rules, network isolation and tighter admin access.
More on cypro.co.uk
Penetration testing
A focused test of your systems and the controls around them, so you know they hold before an attacker finds out for you.
More on cypro.co.uk
Vulnerability scanning
Find every internet-facing system you run, including the forgotten ones, and see which are still on a vulnerable build.
See the scanning service
24/7 security monitoring
Our SOC analysts watch your systems day and night for the signs of an attack in progress: unexpected processes, new outbound connections, logins that do not fit.
More on cypro.co.uk
Incident response
If you may already be compromised, our responders contain it, preserve the evidence, find out what was touched and get you running again safely.
More on cypro.co.uk
Plan ahead
Want a plan for your organisation?
Defending against data poisoning starts with knowing which AI systems you run, where their data comes from and who owns the risk. CyPro can help set the governance, risk assessment and controls around that.