A data poisoning method and a data poisoning apparatus are provided. In the method, a training set and a validation set are retrieved. A perturbation is randomly initiated and added to data in the training set to generate poisoned training data. Values of multiple kernel functions of the poisoned training data and the validation set are computed by using kernel functions in a Gaussian process, and used to compute a mean of the Gaussian process under the validation set. A loss between the mean and the data in the validation set is computed using a loss function of the Gaussian process, and used to generate a target function that maximizes the loss. The target function is solved to compute the perturbation that can maximize the loss. |