Pollution, Injection, Poisoning: Three Attacks, Separated by How Long They Last

Suppose someone wants AI to stop mentioning you when your category comes up.

They have three ways to do it. The cost varies enormously, so does the effect, and most brands have only heard of one of them — usually not the one that matters most. The way to tell them apart is not the technique. It is two questions: how long does it last, and who does it reach. Sorted by those two, the order comes out differently than you would guess.

One: context pollution reaches one person

The lightest of the three plants no instruction. It plants a false premise.

They won’t say “don’t recommend this company.” They’ll say “didn’t they go under?” or “weren’t they fined for that?” and see whether the model goes along. Once it does, the rest of the conversation is built on that premise — a model rarely circles back to question something it agreed with three turns ago.

This works because models are trained to yield to the user, and the effect has been measured. SYCON Bench scores how many turns of sustained pressure a model takes before it flips, out of five. In the false-premise setting DeepSeek-R1 holds longest at 3.21, while Meta’s Llama-3.3 sits at the bottom on 1.90. The wider gap is inside a single model: GPT-4o holds out 4.67 turns in a debate where it has a position, but only 1.23 against an ethical challenge. How far each platform’s position can be moved deserves as much attention as which signals it runs on.

Duration: that conversation. Reach: the one person in it. Close the window and it’s gone; nothing spreads, and not a single weight in the model moved. The one exception is memory — with it switched on, the conclusion stays attached to that account. They have polluted their own instance, which only stops being harmless when that account belongs to someone comparing vendors.

You essentially cannot defend against this one: you aren’t in the room and you’ll never know it happened. It is also the smallest of the three — it reaches exactly one person. Hold onto that combination; it matters later.

The correction: the person polluting your context is usually you

That section reads as though there’s a villain. Context pollution requires no malice at all.

You asked three follow-ups in the same thread, corrected the model once, dropped in an assumption along the way — and every answer after that is built on top of them. This isn’t an attack. It is simply how the mechanism works. You aren’t the victim here; you’re the source.

It carries one expensive consequence: asking “would AI recommend us?” in your own window will almost always return a rosier answer than reality. Every word you typed earlier is still in the context. The model knows who you are and what you want to hear, so it hands you an answer your own conversation raised. That is not the answer a stranger gets.

Your AI is your mirror on the wall.

It is also the likeliest explanation for “what I see doesn’t match what my colleague sees” — not a fickle engine, just two different contexts. Which makes a screenshot of your own chat the most expensive kind of evidence: you conclude your visibility is healthy when the model was simply being accommodating. To see the real thing, start from zero in a clean visitor window (how to do that here).

Two: prompt injection reaches everyone whose AI reads that page

The second approach plants a command inside content the model will read, so it treats data as an instruction.

Typing “please don’t mention brand ○○” into their own chat box gets them nowhere — the only window they fooled is their own, which is really just the previous section again. The version with teeth is indirect injection: instructions hidden in a web page, a PDF, an email, waiting for somebody else’s AI assistant to read them. Brave’s security team demonstrated it with instructions hidden in white-on-white text and HTML comments; the user asked their assistant to “summarise this page” and cross-site actions were executed. OWASP ranks this first among risks to LLM applications, and OpenAI said publicly, when shipping Lockdown Mode, that the hole may never be fully patched.

For you the direction is inverted: you are more likely to be the carrier than the target. Anywhere on your site a stranger can type may be used to issue instructions to someone else’s AI — covered separately here.

Duration: as long as the text sits on the page. Reach: everyone who points an AI at it. That is what makes it worse than pollution — pollution requires them to show up and say it each time, injection is written once and then works on every passer-by automatically.

One thing needs saying plainly here, because “just clean the page” sounds far too cheap: you can only clean your half. If the hidden instruction sits on a nominally neutral third party — a comparison site, an industry forum, a blog badged “objective analysis” — the text lives on someone else’s server and you have no standing to ask for its removal. The AI still reads it, and may still act on it.

The nastiest thing about a fake-neutral third party is that it belongs to the next section as well: one page that both gets its version retrieved (poisoning) and hides an instruction inside it (injection) — a single asset doing double duty. So the honest entry for this row is “half counterable”: clean it where you own the surface, and where you don’t, it behaves like poisoning and only content can push back.

Three: poisoning reaches everyone, and you can’t clean it

The third approach touches neither the conversation nor your pages. It goes after what the model knows.

Anthropic, the UK AI Security Institute and the Alan Turing Institute measured something hard to ignore in a joint study: roughly 250 malicious documents are enough to plant a backdoor in a model — a fixed count, independent of model size. Models from 600 million to 13 billion parameters fell to the same number, even though the larger one trained on more than twenty times the data. That overturns the industry’s working assumption: an attacker does not need to control a percentage of the corpus, just a small fixed quantity of it.

One clarification before that number gets oversold: the study measured backdoor triggers, not brand perception. It shows a specific trigger phrase can make a model behave a specific way. It does not show that 250 articles will convince an AI your company folded. Reading it the second way is exactly what the people selling panic are doing.

What actually happens day to day is the other half of poisoning: retrieval poisoning. They never need to reach the training corpus — they only need the model to retrieve their version. One page that ranks and gets cited will answer everyone who asks, over and over. It has no technical barrier, costs the least, is the only one that reaches every single person, and is the only one where the material sits on someone else’s property and you cannot clean it.

Duration: indefinite. Reach: everyone.

The three side by side

Laid out like that, an odd symmetry shows up: the one that reaches fewest people is the one you cannot stop, and the one that reaches everyone is the only place you can genuinely push. Meanwhile the press argues loudest about the middle one — the only one with a dramatic picture attached (white-on-white text, hidden commands), which is also why it looks the most tractable. In practice you only handle the half you host; the other half slides down into the last row. Attention and threat have never lined up.

Which leaves exactly one place to push

You can’t get into the smallest one, and the middle one you can only clean where you own the page — everything else rolls down to the last row, including the text on someone else’s site that you cannot touch.

Make your version, the one the model can retrieve, sturdier than theirs. Sturdy has a concrete meaning — sourced, checkable, structured clearly enough that a machine confirms who you are and what you do on one pass, and consistent across every surface you control. Once a model has a version that holds up, someone else’s account stops being the only thing available to quote.

That is also why publishing beats correcting. A correction is a conversation; it disperses. Content stays where it is, gets retrieved, gets cited, gets used to answer the next person.

The hard part is that the work never finishes. They can publish again tomorrow, every engine update reshuffles who gets cited, and your dashboard will not tell you what went missing today. That’s a job somebody has to watch continuously.

If you want to see what version of you the model is currently holding, we can take a look first.