Context Poisoning
Context poisoning is an attack on an AI system's knowledge base: instead of altering the model, attackers manipulate the documents, databases or pages retrieved into context, systematically influencing the outputs.
Context poisoning is the deliberate insertion of false or manipulative content into the knowledge sources an AI system draws its context from — the answer stays plausible but is being steered.
Explanation
Retrieval-based systems are considered safer than pure model answers because they cite verifiable sources. That is exactly what makes them attackable: whoever controls the source controls the answer. Attacks range from manipulated wiki entries and fabricated product comparisons to documents tuned for similarity search so they get retrieved unusually often. Because poisoned content can later flow into new training or cache data, the effect often persists. Protection combines source curation, signatures or provenance data, multi-source cross-checking for critical claims, and monitoring of unusual retrieval patterns.
Marketing Relevance
For brands context poisoning cuts both ways: your own knowledge base can be manipulated, and third parties can distort how your brand is represented inside answer engines.
Example
A support bot answers pricing questions incorrectly because an outdated quote PDF sits in the index with very high similarity to price queries and is therefore retrieved almost every time — only a source cleanup restores correct answers.
Common Pitfalls
Many teams review answer quality but not the provenance of the evidence. Without monitoring which documents are retrieved how often, poisoning stays undetected for months.
Origin & History
Early academic work on data poisoning came from classic machine learning. As RAG architectures spread from 2024, the discussion moved to the retrieval path, and by 2026 context poisoning had become a distinct term in security frameworks for agent systems.
Marketing Use Cases
Curated allowlist of trusted sources for business-critical answers.
Monitoring retrieval frequency per document to spot dominant sources early.
Multi-source cross-checking for pricing, legal and safety claims before output.
Regular removal of outdated documents from the vector index.
Frequently Asked Questions
Is context poisoning the same as prompt injection?
No. Prompt injection targets system behaviour. Context poisoning targets content: the system behaves as designed but works from false facts and therefore produces convincingly wrong answers.
How do you detect poisoned sources?
Warning signs are documents with unusually broad retrieval coverage, answer patterns that shift without a model change, and evidence that contradicts the majority of comparable sources.
Does a larger context window help?
Hardly. More context actually raises the chance that a poisoned passage is loaded too. Stricter source selection and trust-weighted ranking are far more effective.
Related Services
Go deeper: Agentic AI Hub · Governance & compliance