# R-05·OWASP LLM05:2026·cases 0·checked Nov. 15, 2026
Data and model poisoning
Someone tampers with training, fine-tuning or retrieval data so the model learns a backdoor, a bias or a wrong answer.
What it is
Poisoning can happen anywhere data is ingested: pre-training, fine-tuning, embedding creation, retrieval or model distribution. OWASP stresses that a poisoned system may still appear to work normally while carrying a backdoor or a bias.
Most organizations don't train base models, but many fine-tune, build retrieval indexes from shared drives or the web, or download models others trained. Each of those is a place where poisoned data gets in.
Documented cases
No case in the register yet. That means we haven't added a verified one, not that it hasn't happened.
Controls to start with
- Track where every dataset and model came from (lineage), and sign and verify artifacts.LLM05:2026, mitigation 1
- Validate incoming data, and control automatic retraining or feedback loops with human review.LLM05:2026, mitigations 2 and 9
- Version datasets so you can roll back a contaminated batch.LLM05:2026, mitigation 8
- Red-team models with trigger-style prompts to look for hidden behavior.LLM05:2026, mitigation 10
Questions to ask vendors
Our suggestions, not taken from a framework.
- Where does your fine-tuning and retrieval data come from, and who can write to it?
- Can you roll a model or index back to a known-good version, and how fast?
Sources
- OWASP Top 10 for LLM Applications 2026. OWASP GenAI Security Project, Aug. 3, 2026.
- OWASP Top 10 for Agentic Applications 2026. OWASP GenAI Security Project, Dec. 9, 2025.
- MITRE ATLAS data, release 2026.10. MITRE, Oct. 28, 2026.
- NIST AI 600-1, Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile. National Institute of Standards and Technology, July 2024.