Differentiate between data poisoning and model poisoning in an AI system, and give an example of each.

• A. It is when the model is tricked during inference; model poisoning is when training data is clean but labels are incorrect. Example: test-time perturbations; training data labeled correctly but features swapped.
• B. Data poisoning contaminates training data to degrade model performance; model poisoning manipulates the model parameters directly (often via compromised training infrastructure). Example: poisoning training data with mislabeled labels; poisoning via corrupted gradient updates during distributed training.
• C. Data poisoning affects deployment system; model poisoning affects monitoring only. Example: data leak; leakage via gradients.
• D. Data poisoning refers to stealing data; model poisoning refers to stealing model weights. Example: data exfiltration; model theft.

Answer: (B)

Data poisoning happens when an attacker corrupts the data used to train a model. By injecting mislabeled examples, wrong features, or crafted samples into the training set, the model learns incorrect mappings and its overall performance or behavior degrades, possibly producing targeted errors or backdoors.

Model poisoning targets the training process or the model parameters themselves. The attacker manipulates how the model is learned, such as compromising the training infrastructure or injecting malicious gradient updates in a distributed training setup, so the final model behaves undesirably even if the training data looks clean.

An example of data poisoning is adding mislabeled training samples to steer the model toward incorrect classifications. An example of model poisoning is corrupted gradient updates during distributed training to corrupt the final model weights and induce harmful behavior.

Other described scenarios, like inference-time tricks or data/theft of weights, pertain to different security risks and are not poisoning in the training sense.