An LLM application takes in text through three routes: training or fine tuning data, a retrieval corpus, and prompts. Training data risks are slow and hard to undo, retrieval risks arrive per question, and prompt risks come from templates and user text. Each needs different controls.
The three inputs
Training and fine tuning data shapes the model's weights. Once learned, it is baked in.
Retrieval corpus is the set of documents your application searches and pastes into the prompt at question time. The model's weights do not change.
Prompts are the instructions and templates your code builds for each call, including user text.
OWASP's data and model poisoning entry says poisoning can target pre-training, fine tuning and embedding data. That covers the first two routes and the vector side of the second.
Comparison
| Question | Training or fine tuning data | Retrieval corpus | Prompt |
|---|---|---|---|
| When does it take effect | After training | At each question | At each call |
| How fast can you fix a bad item | Slow, may need retraining | Fast, remove the document | Fast, change the text |
| Typical attack | Poisoned or backdoored examples | Planted document with instructions | Injected text in a slot |
| Visible in logs | Rarely | Yes, if you log retrieved items | Yes, if you log the final prompt |
| Main control | Provenance, hashes, review before training | Source vetting, access control, filtering | Separation of data and instructions, least privilege |
| Rollback | Previous model version | Previous index snapshot | Previous template version |
Why the difference matters
Teams often apply one control to all three. A prompt filter does nothing for a poisoned fine tuning set. A dataset hash does nothing for a malicious email pasted into a prompt at run time.
Match the control to the point of entry.
- Training data. Track origin and transformations, hash the files, vet suppliers and review samples before a run. OWASP notes that backdoors can leave behavior normal until a trigger appears, so testing alone is not enough.
- Retrieval corpus. Know who can add documents, restrict ingestion sources, and keep snapshots of the index so you can roll back. Log which documents reached each answer.
- Prompts. Version and review templates, mark where untrusted text enters, and limit what the model can do with it.
Where they overlap
The routes meet at the prompt. A retrieved document becomes part of a prompt, so a poisoned corpus is an indirect injection path. A fine tuned model can respond differently to the same prompt. When something goes wrong, you will want to know which input was involved, so log the model version, the index snapshot and the template version for each call.
A quick triage question
When the app misbehaves, ask three things in order. Did the prompt text change? Did the retrieved documents change? Did the model version change? The first two are quick to check and quick to fix. The third may be where a longer investigation starts.
For the retrieval side in more depth, see does RAG stop prompt injection, myth versus fact.
Quick check
Which input is easiest to roll back?
Prompts and retrieval documents, if you keep versions and snapshots. Training data effects usually need a different model version.
Should all three be in my AI inventory?
Yes. Record the model, its datasets, the corpus sources and the prompt templates, with owners.
Sources
Last reviewed: 19 October 2026.
