Executive SummaryIsraeli citizens are scheduled to go to the polls on October 27, 2026, and mid-term elections will take place in the United States a week later. This report addresses a specific type of threat to artificial intelligence systems – data poisoning – and its potential implications for the election cycle. Data poisoning is the deliberate introduction of false or manipulative information into the environment from which artificial intelligence systems learn or retrieve answers. Poisoning can occur during a model’s training phase, in datasets used to adapt a model for specific tasks, or at the retrieval tier—namely, the sources a model consults in real time to answer a user’s question. Unlike conventional cyberattacks, the attacker does not need to breach a system: publishing content on the open web and making it available for indexing and retrieval is sufficient.[1] The primary case of retrieval-tier poisoning examined in this report is the Russian-linked Pravda network. Throughout 2024 and 2025, the network operated across more than 300 domains in dozens of languages, publishing millions of articles a year. Many of its sites attract virtually no human audience, and their structure is better suited for indexing, retrieval, and citation by artificial intelligence systems than for ordinary news consumption. For example, ahead of Australia’s May 2025 federal election, a dedicated site was established for the Australian target audience. An audit conducted by NewsGuard for the Australian Broadcasting Corporation found ten leading models repeating false election claims in 16.6 percent of tested responses, with some directly citing the site. There is also public evidence of Russian intent to influence AI systems themselves as part of influence operations. John Mark Dougan, an American deserter affiliated with Russian influence operations (and currently under European Union sanctions), stated in Moscow in January 2025 that disseminating Russian narratives through his network of domains could effectively change artificial intelligence worldwide. It should be emphasized, however, that no empirical evidence has yet established that data poisoning has actually changed how voters vote. This should not be interpreted as proof of a lack of impact: even in conventional influence operations, establishing a causal link between content exposure and voter behavior is difficult. The more practical question is whether the artificial intelligence systems used by Israeli citizens are already exposed to data-poisoning influence operations and, if so, to what extent. To date, no systematic, longitudinal audit has examined the answers leading AI models provide to questions concerning Israeli elections in Hebrew and Arabic. Such an audit is a fundamental prerequisite for evaluating the extent of exposure over time. Nevertheless, it is reasonable to assume that such operations are already underway in Israel ahead of the elections. Israel has already been targeted by Russian and Iranian influence operations, and Russian activity has demonstrated the capability to operate in Hebrew and target Israeli audiences, including by impersonating local media outlets. Networks of fake profiles linked to Iranian influence activity have also been documented, building credibility over time and changing their messaging at politically sensitive moments. During the conflict between Israel and Iran in June 2025, extensive use of AI-generated content was also documented. All this holds true even though there is currently no public forensic evidence showing that Iranian actors have targeted AI training data or retrieval systems in the context of Israeli elections. Addressing the threat of data poisoning requires advance preparation prior to elections, as well as sustained efforts afterward. Retrieval-tier infrastructure develops and accumulates over time, and content that has already been indexed does not necessarily disappear even if the original website has been removed. Therefore, measures are needed both to reduce exposure to manipulative information and to build a systematic capacity for detecting it. First, a mechanism should be developed for monitoring and periodically auditing leading models in Hebrew and Arabic, to test whether they repeat false narratives known in the Israeli context, and whether they cite domains affiliated with hostile influence networks. These audits will help assess the extent of exposure to data poisoning, identify changes over time, and establish a situational picture to assist in formulating a response. Second, the presence of official and reliable information in the retrieval environment should be strengthened by publishing clear, structured, and machine-readable information on official and verified domains. Artificial intelligence systems should be treated as consumers of information alongside the human public, while ensuring that reliable public information on democratic processes and sensitive public issues is made accessible to them. In parallel, public awareness regarding the limitations of using artificial intelligence systems should be increased. Their answers to political questions are not necessarily a neutral synthesis of reliable sources, and they may also draw on information deliberately injected into the retrieval environment. The purpose of public outreach is not to undermine trust in these systems, but rather to encourage critical use, source verification, and cross-checking of information. In the long term, an institutional, legal, and technological infrastructure is needed to address this phenomenon. Among other things, institutional responsibility for monitoring data poisoning and coordinating the response must be defined, the suitability of the legal framework for dealing with deliberate manipulation of open information sources must be examined, and transparency requirements for model developers regarding the sources underlying their answers must be considered. These measures are intended to establish a sustained capability to detect data poisoning and mitigate its effects, enabling the threat to be addressed both routinely and during periods of heightened public and political sensitivity. _________________ [1] For further details, see: Shay Hershkovitz, Introduction to Data Poisoning: Fundamentals, Threat Models, and National Security Risks, Memorandum 259, Institute for National Security Studies (INSS), 2026. https://tinyurl.com/5n9xbpsm . |
