Investigators find malicious samples inserted into the fine-tune set for a business-license fraud model. What attack does this evidence indicate?

Malicious samples inserted into the fine-tune set for a business-license fraud model are evidence of model poisoning: the attacker manipulates training or fine-tuning data so the resulting model behaves incorrectly for attacker-chosen goals—such as missing certain fraud patterns or favoring specific applicants. Unlike prompt injection, which hijacks behavior at inference time through malicious instructions in the input, poisoning corrupts the learned parameters through the training pipeline, so compromised behavior persists across sessions until the model is cleaned and retrained from trusted data. For a city license-fraud detector, poisoned labels or crafted examples can create systematic blind spots with direct revenue and fairness impact. Finding the malicious samples in the fine-tune corpus is direct forensic evidence of that attack class.

Prompt injection via crafted prompts overriding fraud detection logic fails as a classification here because prompt injection hijacks inference with malicious instructions without changing learned weights, while the evidence is training corruption that persistently alters the model's parameters for fraud detection. Model evasion via adversarial inputs bypassing fraud detection checks fails because evasion crafts inputs to slip past an already-trained detector at serving time without altering training, while the finding is about corrupted training data that builds systematic blind spots into the model itself. Training data leakage via model outputs exposing sensitive license data fails because leakage is about the model exposing memorized sensitive data in its outputs, not about an attacker inserting malicious examples into the training pipeline to corrupt future behavior.

Exam caveat: Prompt injection via crafted prompts overriding fraud detection logic, model evasion via adversarial inputs bypassing fraud detection checks, and training data leakage via model outputs exposing sensitive license data all name the wrong mechanism and stage; here the stem's malicious samples point to poisoning that corrupts learned behavior, not to those other attack classes. Distinguish poisoning that changes the model through training-time corruption from prompt injection that hijacks live instructions, evasion that bypasses the deployed detector, and leakage that extracts memorized data from outputs, even when distractors describe crafted prompts, adversarial inputs, or exposing outputs for the same fraud model. Provenance and integrity controls on fine-tune sets are the usual compensating theme on related questions.

Operational check: Quarantine the tainted fine-tune set; restore from signed trusted datasets; retrain and revalidate the license-fraud model; review pipeline write access; and add integrity checks/manifests so malicious sample insertion is detected before the next training run.