What it is
Data poisoning attacks the model at the source. If an attacker can influence what goes into the training data, the fine-tuning data, or the knowledge base the model retrieves from at runtime, they can shape what the model says and does. Examples include seeding public web content with subtly wrong facts so a foundation model trained on it learns those facts as truth; submitting biased examples to a feedback loop so the model drifts toward the attacker's preference; planting a "trigger phrase" backdoor so the model behaves normally except when it sees a specific code word. The closer the attacker can get to the data — the more open your training pipeline is — the easier the attack.
Why it matters
Most enterprise teams will not train models from scratch, which limits exposure to classical training-time poisoning. But almost every enterprise will fine-tune, augment with RAG, or feed agent memory from internal documents — and those pipelines are very poisonable, often without the team realizing they are pipelines at all. A single malicious document in a SharePoint folder that gets indexed into RAG can silently change agent answers across hundreds of conversations. The mitigation is treating data ingestion paths with the same rigor as code paths: provenance, access control, review, and monitoring for drift.
Key components
- Training-data poisoning — corrupting the data a foundation model learns from
- Fine-tuning poisoning — manipulating the small dataset used to specialize a model
- RAG corpus poisoning — planting documents that the model will retrieve and trust
- Backdoor / trigger attacks — embedding hidden behaviors that activate on a specific input
- Feedback-loop poisoning — gaming the thumbs-up/down signals used for ongoing training
How it connects
In Agentforce, any content indexed into Data Cloud or used to ground Einstein responses is a potential poisoning surface — meaning the Salesforce files, knowledge articles, and external sources you connect are as security-critical as the agent configuration itself.
Good to know
You don't need a sophisticated attacker to have a poisoning problem — a well-meaning employee uploading an outdated or incorrect policy document into your knowledge base produces the same result: an agent confidently giving wrong answers at scale.
Related terms
Memory Poisoning
An attack on an AI agent's persistent memory — seeding false facts or instructions into its long-term store so the agent repeats them in future sessions, often after the attacker is gone.
Prompt Injection
An attack where malicious text hidden in data an AI reads hijacks its instructions, making it ignore its real task and do the attacker's bidding.
RAG (Retrieval-Augmented Generation)
A technique that makes AI smarter by fetching relevant information from your data before generating a response. The AI "looks it up" instead of guessing.
Threat Modeling (AI Agents)
A structured way to identify what could go wrong with an AI agent before it does — mapping attackers, attack surfaces, and impacts so you can build defenses in.
