OWASP Top 10 for LLM Applications, 2025
LLM04: Data and Model Poisoning
Data and model poisoning is an integrity attack: someone tampers with pre-training, fine-tuning or embedding data to plant vulnerabilities, backdoors or bias. The effects range from weaker performance and skewed or toxic output to harm in downstream systems.
Data and Model Poisoning in more detail
OWASP says external and unverified data sources carry the highest risk. Shared and open-source models can also carry malicious code, such as unsafe pickle files that run when the file is loaded. A backdoor can stay dormant until a trigger activates it, which is why OWASP calls such a model a sleeper agent and why it is hard to find by testing alone. Tracking where data comes from, checking it at each stage and testing the model against adversarial techniques are the main defenses.
The risk and its name come from OWASP; the summary, examples and controls on this page are our plain-English reading of OWASP's page. Source: Source, checked October 21, 2026: genai.owasp.org (opens in a new tab)
How it shows up
- Malicious training data skews the model's outputs, for example through split-view or frontrunning poisoning.
- Harmful content is injected directly into a training or fine-tuning set.
- Unverified data produces biased or wrong results that look like normal behavior.
- A downloaded model file runs code when it is loaded.
- A backdoor stays silent in testing and activates only on a trigger phrase.
Controls that reduce it
- Track data origins and transformations with tools such as CycloneDX or an ML bill of materials.
- Vet data vendors and check model outputs against trusted sources.
- Sandbox access to unverified data and use anomaly detection to filter adversarial samples.
- Use data version control to detect unauthorized changes.
- Monitor training loss and model behavior against thresholds.
- Red-team the model and test its robustness against adversarial techniques.
Controls reduce risk, they do not remove it
No single control covers data and model poisoning on its own. Combine controls, and treat any tool as one layer.
Categories that address it
Our analysisThese are the directory categories whose tools we score on this risk. The mapping is our analysis.
Layers that address this risk
Our AI security layers are an editorial model, not a standard. Source states means OWASP's own text for LLM04 names the control the layer delivers. Our analysis means we drew the link.
- L1 Governance and risk Source states
- L3 Model and supply chain Source states
- L4 Testing and red teaming Source states
- L8 Monitoring and response Source states
Tools mapped to LLM04
Our analysis6 tools are mapped. Each tool is mapped only where a documented capability supports it. Open a tool page to see the capability and its source. Coverage Score compares tools within one category.
| Tool | Type | Deployment | Pricing model | OWASP risks | Coverage Score | Last reviewed |
|---|---|---|---|---|---|---|
| ModelAuditOpenAI (Promptfoo) · Supply chain | Open sourceMIT |
| Free |
| 86 out of 100 | |
| ModelScanPalo Alto Networks (Protect AI) · Supply chain | Open sourceApache-2.0 |
| Free |
| 84 out of 100 | |
| model-transparencySigstore · Supply chain | Open sourceApache-2.0 |
| Free |
| 78 out of 100 | |
| HiddenLayer ScannerHiddenLayer · Supply chain | Commercial |
| Not published |
| 58 out of 100 | |
| ARTLF AI & Data Foundation · Red teaming | Open sourceMIT |
| Free |
| 55 out of 100 | |
| Prisma AIRSPalo Alto Networks · AI-SPM | Commercial |
| Not published |
| 44 out of 100 |
No tools match these filters. Clear a filter to see more.
Why each tool is mapped
- ModelAudit: The README says it looks for backdoor indicators in model files.
- ModelScan: The README lists model poisoning and data poisoning among the outcomes of model serialization attacks it scans for.
- model-transparency: Hash verification can reveal that model files were altered after signing; it does not detect poisoning before signing.
- HiddenLayer Scanner: The vendor says it looks for backdoors and tampering in model files and weights.
- ART: Includes poisoning attack modules for ML models; the docs do not describe LLM-specific use.
- Prisma AIRS: The model scanner checks for hidden backdoors in model files.