Target: the model’s weights during training or fine-tuning.
Access required: the training pipeline, training data, or fine-tuning process.
Persistence: baked into the model — every deployment is affected.
Detection: requires model evaluation and behavioral red-teaming.
Target: the live knowledge base queried at runtime.
Access required: ability to add a document to an indexed folder — minimal privilege.
Persistence: until the knowledge base is reindexed or the embedding is removed.
Detection: retrieval monitoring and anomaly detection on ranking shifts.