OWASP Top 10 for LLM Applications2025Rank #4Last reviewed 2026-07-27

LLM04:2025: Data and Model Poisoning

Malicious manipulation of training data, fine-tune data, RAG corpus, or embeddings to influence model output, install backdoors, or skew behavior on attacker-chosen triggers.

How it's found

Found by reviewing RAG ingestion and fine-tuning pipelines for unvalidated or unverified data sources that could bias or backdoor model behavior.

Standards mapping

CWE: CWE-345
References: https://genai.owasp.org/llmrisk/llm042025-data-and-model-poisoning/

Where this fits in a TurboPentest engagement

This weakness is not covered by the automated black-box pentest. IntegSec pentesters cover it in a manual engagement.

Frequently asked questions

What is LLM04:2025 Data and Model Poisoning?

Malicious manipulation of training data, fine-tune data, RAG corpus, or embeddings to influence model output, install backdoors, or skew behavior on attacker-chosen triggers.

How do you find Data and Model Poisoning?

Found by reviewing RAG ingestion and fine-tuning pipelines for unvalidated or unverified data sources that could bias or backdoor model behavior.

Which CWEs map to LLM04:2025?

LLM04:2025 maps to CWE-345.

Does TurboPentest test for Data and Model Poisoning?

This weakness is not covered by the automated black-box pentest. IntegSec pentesters cover it in a manual engagement.

Related OWASP categories

Written and reviewed by

Michel Chamberland - Founder & CEO, IntegSec

CISSP, OSCP, OSCE, CEH, GIAC, CCSK · 20+ years in offensive security

Michel has spent 20+ years on offensive security teams including IBM X-Force Red and Trustwave SpiderLabs, leading penetration tests, red team engagements, and breach response for Fortune 500 customers. He is the founder of IntegSec and the architect of TurboPentest.

Find these issues before an attacker does

TurboPentest runs an agentic AI pentest against your target and reports findings with proof, from $99 per target.

Start a pentest

OWASP Top 10 for LLM Applications2025Rank #4Last reviewed 2026-07-27

LLM04:2025: Data and Model Poisoning

Malicious manipulation of training data, fine-tune data, RAG corpus, or embeddings to influence model output, install backdoors, or skew behavior on attacker-chosen triggers.

How it's found

Found by reviewing RAG ingestion and fine-tuning pipelines for unvalidated or unverified data sources that could bias or backdoor model behavior.

Standards mapping

CWE: CWE-345
References: https://genai.owasp.org/llmrisk/llm042025-data-and-model-poisoning/

Where this fits in a TurboPentest engagement

This weakness is not covered by the automated black-box pentest. IntegSec pentesters cover it in a manual engagement.

Frequently asked questions

What is LLM04:2025 Data and Model Poisoning?

Malicious manipulation of training data, fine-tune data, RAG corpus, or embeddings to influence model output, install backdoors, or skew behavior on attacker-chosen triggers.

How do you find Data and Model Poisoning?

Found by reviewing RAG ingestion and fine-tuning pipelines for unvalidated or unverified data sources that could bias or backdoor model behavior.

Which CWEs map to LLM04:2025?

LLM04:2025 maps to CWE-345.

Does TurboPentest test for Data and Model Poisoning?

This weakness is not covered by the automated black-box pentest. IntegSec pentesters cover it in a manual engagement.

Related OWASP categories

Written and reviewed by

Michel Chamberland - Founder & CEO, IntegSec

CISSP, OSCP, OSCE, CEH, GIAC, CCSK · 20+ years in offensive security

Find these issues before an attacker does

TurboPentest runs an agentic AI pentest against your target and reports findings with proof, from $99 per target.

Start a pentest