In the research sense, an attacker needs samples in the pretrain or fine-tune mix. Publishing a high-volume, footnote-heavy site so retrieval systems quote it is generative engine optimization (GEO), which can later become training data if a crawler ingests the domain, but is not by itself a demonstrated weight compromise. 2026 coverage of the Hanover Institute often used 'poisoning' for that retrieval-side tactic.