Last updated:
AAISM preparation guide
Prompt injection vs data poisoning: match the control to where the attacker acts
Direct answer
Both attacks make an AI system behave badly, so the options can look interchangeable. NIST describes poisoning as an attack during the training stage, and prompt injection as an attack at inference time, on a model already deployed. The stronger AAISM answer first identifies where the attacker acted, then picks the control for that stage: input and output controls at use, data controls before training.
ISACA's outline covers AI threats in 2B, AI threat and vulnerability management, and the controls in 3C and 3E.
Timing is a clue, not proof. Behaviour that changed after retraining on new data points to poisoning; behaviour that follows a user's input points to prompt injection, though a poisoned backdoor can also fire right after a triggering input.
Start AAISM baselineTell the two attacks apart
| Question | Prompt injection | Data poisoning |
|---|---|---|
| When the attacker acts | While the model is in use | Before or during training |
| What the attacker controls | Input to the model, directly or through content it reads | Some of the training data |
| Controls that fit | Authorization enforced outside the model, least-privilege tool access, input and output controls, adversarial testing | Data provenance, validation and lineage before training |
Original teaching example
A support chatbot looks up internal discount codes through a tool when staff ask for them. A customer types instructions telling it to ignore its rules, and the bot reveals the codes. One option is to retrain the model on cleaned training data.
The attacker acted through input at use, not through training data, so cleaning the training data doesn't address it. The stronger answer enforces outside the model that the discount tool returns codes only to authenticated staff, so no customer prompt can reach them, then adds input and output controls and tests with adversarial prompts.
Find where the attacker acted
Input at use, or data before training.
Look at what changed before the bad behaviour and at the evidence: the manipulated input, data or model component identifies the attack and the stage.
Limit what the model can reach
Least privilege matters as much for AI as for people.
If injected instructions succeed, the damage is bounded by what the model can access and do. Decide who may receive what in the tools and systems around the model, not in its instructions.
Protect training data before it is used
Provenance, validation and lineage come before training.
Once poisoned data has shaped a model, detection in operation catches the effect, not the cause. Content a model retrieves at run time, such as a knowledge base, can be manipulated too; NIST treats instructions hidden there as indirect prompt injection, so protect what goes into the index as well.
Where this appears in the outline
2B for the threat; 3A, 3C and 3E for the controls.
ISACA's outline lists AI threat modelling under 2A, and the AI threat landscape and mitigation strategies under 2B. Architecture controls such as authorization outside the model belong to 3A.
Sources and fact check
Source checked: 2026-10-12
- Study methods and examples are independent CertArc teaching guidance. ISACA's pages are the authority for exam rules and fees, which can change.
- Practice results do not convert to an official score or guarantee a pass. CertArc is not affiliated with or endorsed by ISACA.
Frequently asked questions
What is indirect prompt injection?
Instructions hidden in content the model reads at run time, such as a retrieved web page or document, rather than typed by the user. NIST's taxonomy lists it separately from direct prompting.
Is retraining ever the right answer to prompt injection?
Rarely on its own. Access limits and input and output controls act where the attack happens.
Can poisoning come from a vendor?
Yes. A supplier's dataset can contain poisoned records, and a supplier's model can carry a backdoor learned from them, which links this to 2C.
Do I need to know attack techniques in detail?
Know them well enough to recognise each attack and choose a proportionate control.
Which domain does this trap belong to?
Domain 2 for the threat, Domain 3 for the controls.
