TL;DR: Evasion happens at prediction time: the attacker crafts inputs that a fixed, unchanged model gets wrong (an adversarial image, malware modified to slip past a classifier, an optimised jailbreak suffix). Poisoning happens at training time: the attacker manipulates training or fine-tuning data so the model itself learns the wrong thing (mislabelled samples, a planted backdoor trigger, poisoned web content). Evasion defences focus on robustness and input handling; poisoning defences focus on data provenance, curation and lineage. Both are integrity attacks, on the input and on the model respectively.
How to approach it
Give crisp definitions anchored on when the attacker acts, one realistic example each, then contrast them along attacker requirements, persistence and defences. NIST's adversarial ML taxonomy (NIST AI 100-2) uses the same split, which is worth citing.
A strong answer
Evasion
Fixed, unchanged model
deployed
Crafted input at prediction
image, malware, suffix
Model gets it wrong
Outcome, unsafe: One wrong prediction
Repeatable per input
Poisoning
Manipulated training data
labels or content
Model learns it
persists in weights
Every future prediction affected
Outcome, unsafe: Corrupted model
Hard to undo
| Evasion | Poisoning | |
|---|---|---|
| When the attacker acts | Inference time | Training or fine-tuning time |
| What changes | The input | The training data, therefore the model |
| Attacker needs | Ability to submit inputs; optionally model access or a substitute | Ability to influence training data sources |
| Persistence | Per input; must be crafted each time | Baked into the model for every user until retrained |
| Example | Spam or malware modified until a classifier labels it benign | Poisoned web documents scraped into a training set that teach a trigger phrase |
| Primary defences | Adversarial training, certified robustness, query limits, multiple signals | Provenance, snapshots with hashes, curation, anomaly detection, evaluation, lineage |
Examples in detail.
- Evasion: an attacker repeatedly modifies a phishing email's wording and formatting, testing against a filter (or a substitute model), until it is classified as legitimate. The filter was never changed.
- Poisoning: an attacker buys an expired domain referenced in a scraped dataset's URL list, serves crafted content there, and the next dataset download includes it. Carlini and colleagues (2023) showed this is practical at web scale.
Where LLM attacks fit. Jailbreaks and prompt injection that bypass classifiers resemble evasion (crafted inputs against a fixed model). Planting instructions in documents a RAG system retrieves is not training, but it shares poisoning's shape: the attacker controls content the system trusts. Backdoors are a poisoning outcome.
Why the distinction matters. It tells you where to spend: an evasion problem is not fixed by cleaning data, and a poisoning problem is not fixed by input filtering.
What interviewers probe next
- "Which is easier for an attacker?" Evasion usually needs only query access; poisoning needs influence over data, which is easier than it sounds for web-scraped or user-feedback training.
- "Is a backdoor evasion or poisoning?" Poisoning implants it; using the trigger at inference resembles evasion.
- "What about privacy attacks?" Membership inference and extraction are a third category, about confidentiality rather than integrity.
What if?
What if · interview follow-ups
Hold your answer as the constraints change
A spam filter is retrained weekly on emails users mark as spam or not spam, and spammers are actively trying to get their campaigns delivered.
Start here
How would a spammer evade the current model?
What can the spammer change without touching the model?
At prediction time, with the model unchanged: reword messages, use synonyms and misspellings, put text in images, add benign padding or change formatting until the score drops below the threshold. They probe by sending test campaigns and watching what lands. This is evasion: the input changes, the model does not.
Carry it forwardEvasion changes inputs to a fixed model.
Weak answerConfusing evasion with retraining the model.
Constraint changes
How could the spammer poison the filter instead?
Who supplies the labels for retraining?
By influencing the weekly training data: using many accounts to mark their own campaigns as 'not spam', or marking legitimate competitors as spam. The model then learns the wrong boundary. This is poisoning: the model itself is changed through its training data.
Carry it forwardPoisoning changes what the model learns.
Weak answerTrusting user feedback labels as ground truth.
Constraint changes
Which defences address evasion?
Which features cost the spammer most to change?
Features that are costly to change (sender reputation, infrastructure age, authentication results, sending behaviour), handling of obfuscation such as normalising text and extracting text from images, monitoring for probing campaigns, and fast retraining on fresh examples. Input-only content features are the easiest to evade.
Carry it forwardRely on features attackers cannot cheaply change.
Weak answerAdding more word-level features.
Constraint changes
Which defences address poisoning?
How do you limit any one group's influence on labels?
Data provenance and curation: weight labels by reporter reputation, cap influence per account, look for coordinated labelling from new or linked accounts, hold out suspicious labels for review, track lineage of each training batch, and gate new models on evaluation against a trusted set.
Carry it forwardPoisoning defences control who shapes training data.
Weak answerAssuming more data dilutes poisoning.
Constraint changes
What if retraining makes the model worse for one sender category?
Was the change concentrated or broad?
Compare the new model to the last one on a trusted evaluation set and on segments, look at which recent labels drove the change, and roll back if needed. A sudden, concentrated change in the attacker's favour after retraining points to poisoning; a gradual broad drop points to drift.
Carry it forwardGate retrained models and compare segments.
Weak answerDeploying every weekly model automatically.
Now defend it
How would you protect the filter against both?
Against evasion: costly-to-change features, text normalisation and image text extraction, probing detection and fast retraining. Against poisoning: reputation-weighted and capped feedback, coordinated-label detection, lineage per training batch, and evaluation gates against a trusted set with rollback. Both are integrity attacks, on the input and on the model.
How it's scored
Weak: Confuses the two or defines them without timing.
Hire: Separates by training versus inference, with one example each and matching defences.
Strong Hire: Compares attacker requirements and persistence, places LLM attacks in the framework, and explains how the distinction directs investment.
Common mistakes
- Calling any malicious input "poisoning".
- Proposing data cleaning for an evasion problem.
- Forgetting fine-tuning and feedback data as poisoning surfaces.