Publish Poisoned Datasets
This is when a bad actor creates a fake or tampered collection of information used to teach AI, and then shares it online as if it were legitimate. It is like someone leaving a textbook full of wrong answers in a public library, hoping a student will study from it and fail their test.
An adversary performs data poisoning on a dataset and hosts it on a public repository or platform. This poisoned data, which may be an entirely new set or a modified version of an existing open-source dataset, serves as a vector for AI supply chain compromise when unsuspecting developers integrate it into their training pipelines.
Adversaries execute [Poison Training Data](/techniques/AML.T0020) by manipulating data samples and publishing the resulting artifact to a public location. The poisoned dataset may manifest as a novel corpus or a compromised variant of an existing open-source dataset. This technique facilitates [AI Supply Chain Compromise](/techniques/AML.T0010) by leveraging the trust inherent in public data distribution channels to introduce malicious weights or backdoors into downstream victim models.