Attacking a model directly is hard; attacking what it learns from or reads is often much easier. Data poisoning targets the training set or, more commonly in deployed systems, the knowledge base a retrieval-augmented system draws from: an attacker inserts or alters a document so that the system, in good faith, starts citing it as fact.
The result looks like a normal hallucination from the outside, a wrong answer delivered with full confidence, but the root cause is different and the fix is different too. A model tuning problem gets fixed by retraining or better prompting. A poisoned source gets fixed by finding and removing the corrupted document, and by tightening who can write to the knowledge base in the first place.
This is why access control on a RAG system’s knowledge base is a security requirement, not just a data-hygiene one. Every system that can write to the store the AI retrieves from is a potential entry point for manipulating what the AI tells your customers or employees.