Baseline poisoning happens when malicious activity enters the training data and changes what the detector believes is normal. The result is a weakened or blind control, because future attack behaviour no longer stands out against the corrupted baseline.
Expanded Definition
Baseline poisoning is a form of model or detector compromise in which an attacker deliberately influences the data used to establish normal behavior, so the resulting baseline no longer reflects the real environment. In cybersecurity, this most often affects anomaly detection, user and entity behavior analytics, and automated alerting systems that rely on historical patterns to flag deviation. Once the baseline is corrupted, malicious activity can blend into what the system now treats as expected activity.
This concept is closely related to data poisoning, but the defining feature is the corruption of the reference state that the control uses for comparison. That distinction matters because some systems retrain continuously, while others refresh baselines on a schedule or during a tuning event. Definitions vary across vendors on whether the term should cover only intentional adversarial input or also accidental drift caused by poor data hygiene. NHI Management Group treats baseline poisoning as a security problem whenever the baseline materially weakens detection or response. For a broader governance frame, NIST Cybersecurity Framework 2.0 remains the clearest anchor for detection, monitoring, and resilience outcomes.
The most common misapplication is calling ordinary seasonality or configuration drift “baseline poisoning” when the control has simply not been recalibrated after a legitimate operational change.
Examples and Use Cases
Implementing detection baselines rigorously often introduces tuning overhead and data-governance friction, requiring organisations to weigh sensitivity against the risk of normalizing hostile behavior.
- A threat actor slowly generates low-volume login failures from a compromised subnet so authentication monitoring learns that pattern as routine rather than suspicious.
- An attacker poisons endpoint telemetry by staging benign-looking process activity, causing the EDR model to treat a later malicious loader as normal background noise.
- A cloud security team refreshes an anomaly model after a migration, but the training window includes attacker-controlled API calls, weakening alerts across the new environment.
- In identity analytics, repeated abuse of service accounts can reshape what behavior is seen as expected, especially where the system lacks strong segregation between identity-bound access signals and general telemetry.
- Security operations teams may see baseline poisoning after a cleanup event if compromised assets remain in the training set and continue to influence future detections.
Because the problem depends on contaminated training history, it often emerges in environments that rely on automatic retraining, weak data lineage, or insufficient review of what is allowed into the learning set.
Why It Matters for Security Teams
Baseline poisoning matters because it undermines trust in the very control meant to expose hidden activity. When the baseline shifts toward attacker-chosen behavior, detection quality degrades quietly, and incident responders may see fewer alerts precisely when adversary activity is becoming more established. That creates false confidence, delayed containment, and deeper lateral movement. For teams operating identity-rich environments, the risk is especially acute where user, service account, and non-human identity telemetry feed a shared analytics pipeline: poisoned baselines can hide credential misuse, automated abuse, and abnormal privilege use.
Security teams should treat baseline integrity as a governed asset, with clear rules for training data approval, exclusion of known-compromised records, and periodic validation against independently verified behavior. The NIST Cybersecurity Framework 2.0 supports this posture by emphasizing continuous monitoring and response outcomes rather than blind reliance on model output. Where relevant, identity telemetry should be separated from polluted historical windows so that compromised behavior cannot reset the security definition of normal. Organisations typically encounter the operational impact only after a real intrusion persists unnoticed, at which point baseline poisoning becomes impossible to ignore.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10 and OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST CSF 2.0, NIST AI RMF and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | DE.AE | Anomalies and events are the core outcome degraded by poisoned baselines. |
| NIST AI RMF | AI RMF addresses data and system risks that can corrupt learned behavior. | |
| OWASP Agentic AI Top 10 | Agentic systems can inherit poisoned behavioral baselines through telemetry and tool traces. | |
| OWASP Non-Human Identity Top 10 | NHI telemetry and service-account behavior can be used to build baselines attackers may poison. | |
| NIST SP 800-53 Rev 5 | SI-4 | System monitoring controls rely on trustworthy baselines to detect malicious deviation. |
Preserve monitoring integrity by validating training inputs and reviewing detection tuning changes.
