Data Poisoning Against Government Datasets

A line department invited comments on a draft notification. Someone submitted a well-formatted PDF that looked like a 'consolidated FAQ' and included a line that certain categories were already exempt. The PDF was swept into the RAG folder because it was 'stakeholder input'. Six weeks later the assistant cited the exemption as if it had been notified. It had not. The Gazette was innocent. The drawer was not.

Data poisoning is the act of getting a system to learn or retrieve a thing you chose. Against government estates it rarely looks like a research paper's pixel-patch. It looks like a helpful annexure, a cloned circular, a Wikipedia-like page, or a burst of similar comments that tilt a classifier.

This explainer is for CISOs and programme owners on 17 August 2026. Not legal advice. NIST's adversarial-ML language and OWASP's retrieval-abuse notes are useful. They are not a Gazette. We will not claim a CERT-In 'poisoning' type. If poison produces a leak or a compromise, map the effect to the 2022 annexure.

Prcept will not ingest unreviewed public comments into a policy index. If your SI treats the consult mailbox as a corpus, stop the cron.

Three places poison sits

Retrieval. The cheapest win. Plant a document the retriever will rank. Indirect prompt injection is the cousin: instructions inside the plant. The RAG article is the lock; this page is the motive.

Fine-tunes and evals. A few labelled examples can move a classifier that decides 'urgent' or 'eligible-looking'. If those labels came from a public mailbox, you let the public vote on the decision boundary.

Pre-training, almost never your problem. You did not pre-train the base. You still have a supply-chain problem if you took a community fine-tune that someone else poisoned. That is the weights article.

Government-shaped plants

Cloned circulars with one number changed. Similarity search loves them because they look like the real family of documents.

Consultation comments in official tone. Your own ingest job will treat tone as authority.

Translations. A plant in a language your reviewers do not read will pass a Hindi-only desk.

Scanned images. OCR will faithfully promote a sticker on a page if nobody looks.

Web scrapes of 'explainers' that were written to be retrieved by you.

Sources that should never auto-enter a policy collection.

Source	Why it is hostile	What it may enter instead
Public consultation mailbox	Anyone can write	A labelled comments store, not policy RAG
Citizen uploads	Injection + poison + PII	Per-application space, short TTL
Open web scrape	You do not own the page tomorrow	Nothing, or a reviewed snapshot with a date
Vendor starter corpus	You do not know the plants	Only after the receiving dock

What actually reduces it

Allowlist of publishers and of internal series numbers. If it does not have a file number you issued, it is not policy.

Human review for anything that will ground a citizen-facing or officer-facing rule. Sampling is not enough on small, high-value collections.

Canaries. Hide phrases that should never appear in answers. Alert if they do. Cheap and underrated.

Diversity checks on fine-tune labels. A burst of identical 'approve' comments from one network is a vote, not a truth.

Least privilege on tools, so a successful plant cannot mint or write. Poison plus a fat verb is the compound incident.

• No auto-ingest from mailboxes or the open web into policy.
• No community fine-tune that saw unknown data.
• No single reviewer on a language they cannot read.
• Roll back a collection by digest when a plant is found.

After you find a plant

Remove object, chunks, vectors, and backups on a clock. Treat the plant as hostile software, not as a bad FAQ.

Find every answer it grounded. That is why retrieval logs exist. Correct speech that went to citizens if it stated a false rule.

Decide whether the effect is a cyber incident under the existing annexure. A plant that only embarrassed you may be a quality event. A plant that changed a register or leaked is not. No invented type codes.

Objections you will hear — and what to do with them

These are the lines that stall the file. Answer them in the room, then put the answer in the note. A spoken answer without paper will be forgotten by the next officer.

We cannot review everything.

Then you cannot retrieve everything for policy. Review the tiny set that grounds rules. Leave the rest out of the policy index.

Poisoning is a research curiosity.

On the open internet, maybe. On a desk that auto-ingests public PDFs, it is a process. You built the process.

Digital signatures on PDFs will save us.

They help when you verify them. Most ingest jobs do not. A signed plant is still a plant if you chose to trust the signer.

We will ask the model whether a document looks official.

The model is the thing being steered. Do not hire it as its own guard.

A two-week anti-poison pass

Assume the mailbox is hostile. Prove the policy index only contains what you issued.

1. Day 1–3: list every auto-ingest. Kill mailbox and web scrapes into policy.
2. Day 4–6: tag each policy document with the file number you issued. Quarantine the rest.
3. Day 7–8: plant a canary yourself. Confirm it cannot ground an answer, or that you catch it.
4. Day 9–10: freeze any weekly fine-tune on public labels.
5. Day 11–12: write the rollback and citizen-correction steps.
6. Day 13–14: CISO signs. Put 'no consults in policy RAG' in the standing order.

How this shows up in the file

Subject: Anti-poisoning — policy collections for agent [name].

Policy RAG accepts only documents with [file-number series] issued by this department. Public comments, citizen uploads and web scrapes do not auto-enter. Fine-tunes on public labels: frozen / reviewed by [post]. Canary phrases: [owned by SOC]. On plant discovery: remove all stores, review grounded answers, map effects to CERT-In annexure without invented codes. Not legal advice.

A helpful PDF is not a circular.

Canaries without theatre

A canary is a phrase that should never appear in a policy answer. Hide three. Alert if one surfaces. Do not publish them. Do not let the model vendor 'helpfully' add them to a public eval set. Canaries are cheap. They are not a substitute for a file-number allowlist.

When a canary fires, treat it as a plant hunt: which document, which ingest ticket, which collection digest. Roll back that digest. Review answers it grounded. If a register moved or personal data leaked, you are on the CERT-In map using existing types. If only a joke policy appeared, correct the speech and tighten ingest.

Weekly fine-tunes on mailbox labels are a vote. Freeze them. Review deltas. A burst of identical 'invalid' tags is not truth. It is a campaign. Your classifier does not get to launder it into a decision boundary.

This article is informational field guidance for Indian public institutions, not legal, procurement, security-accreditation or engineering advice. Confirm against the current Gazette, GFR, GeM term, CVC instruction, CERT-In direction, DPDP text, departmental manual and your counsel before you file it.

How to fail this before citizens do

“Data Poisoning Against Government Datasets” is a path problem. A P4 Security/CISO should be able to name the tool, the identity, the secret and the egress that would make “data poisoning attack AI” real. If the only control is a network diagram from last year, you have a story, not a threat model.

If the public can write what you later retrieve or train on, the public can write your policy. Treat consults, uploads and scrapes as hostile until reviewed. Air-gap is not automatically secure. Prompt injection is not a conference joke when the agent can write a ticket. CERT-In still wants specified logs in India and incidents on a six-hour clock. Write those clocks into the runbook.

1. Red-team the write tools, not only the chat UI.
2. Kill undeclared outbound paths on staging.
3. Redact personal data from logs you will actually keep.
4. Scope a pentest that includes RAG and connectors.
5. Cap metered spend so a loop cannot empty a budget.

Close this loop before the next CAB

Put “Data Poisoning Against Government Datasets” on the next change-advisory or bid-opening agenda as a single line item with an owner. If it cannot earn a line item, it will not earn a control. The owner should be a P4 Security/CISO, not “the vendor.”

Revisit the item when the model, the GeM term, the region, or the SI changes. “data poisoning attack AI” is not a one-time workshop. It is a watch item. Date the last check. Unsigned watch items are souvenirs.

What the next file must contain

“Data Poisoning Against Government Datasets” earns a line in the noting only if a P4 Security/CISO can attach proof of “data poisoning attack AI.” A heading is not proof. A vendor slide is not proof. A workshop photograph is not proof.

Write three dated sentences: what was decided, who owns it after the next posting order, and when it will be re-checked. If you cannot write the three sentences, you are not ready to buy, to sell, or to go live.

Leave unsourced percentages out of the note. DPDP is not a blanket localisation statute. The November 2025 AI governance text is guidance, not an Act. CERT-In’s 28 April 2022 directions still set specified incident and log clocks. A PAC, when lawful, lives in GFR Rule 166.

• Name the designation that owns “data poisoning attack AI.”
• Attach one artefact a stranger can open next year.
• Record the instrument you are actually using.
• Revisit when the model, the SI, the notice or the posting changes.