Environmental Poisoning: Processes & Impacts

• Environmental poisoning is the process whereby harmful agents are introduced and transported through environmental media, leading to bioaccumulation and health risks.
• Detection and exposure reconstruction employ advanced remote sensing, spectroscopy, and Bayesian methods to track ultra-trace contaminants and assess risk.
• Computational paradigms exploit environmental poisoning to subtly alter autonomous systems and machine-learning processes, highlighting interdisciplinary challenges.

Environmental poisoning denotes processes in which harmful agents are introduced, concentrated, transported, or operationalized through environmental media and environmental context rather than by direct intervention at the affected organism or system. In environmental health, the term encompasses toxic heavy metals suspended as airborne aerosols, arsenic-contaminated groundwater, persistent and bioaccumulative compounds such as PFAS, particulate and nanoscale contaminants, and multi-pollutant mixtures whose effects depend on transport, exposure pathway, bioaccumulation, and dose-response structure (Wang et al., 10 Jun 2025, Yin et al., 2021, Jividen et al., 2024, 0801.3280). In a distinct but related computational-security usage, environmental poisoning refers to attacks in which the physical or digital surroundings become the poisoning vector for autonomous systems, web agents, or speech recognizers, without requiring direct modification of labels, model weights, or memory stores (Patel et al., 2020, Zou et al., 3 Apr 2026, Bartolini et al., 2024).

1. Environmental media, sources, and exposure pathways

Environmental poisoning is mediated by heterogeneous media. Heavy metal aerosols such as Pb, Cd, Hg, and Co can remain suspended, spread over long distances, be inhaled, and be deposited in the body; the same work notes that even sustained exposure to about $1\ \mathrm{pg/m^3}$ of airborne Pb over years may raise children’s blood lead to concerning levels (Wang et al., 10 Jun 2025). Arsenic-contaminated groundwater presents a different route, especially for private-well users consuming untreated water above the arsenic maximum contaminant level of $0.01\ \mathrm{mg/L}$ (Yin et al., 2021). PFAS are framed as persistent environmental pollutants whose highly stable carbon–fluorine backbone makes them resistant to degradation, while widespread use in food packaging, cookware, and firefighting foams has created global contamination; the cited study reports that $>98\%$ of the U.S. population had detectable PFAS concentrations (Jividen et al., 2024).

Particulate and nanoscale contamination extends this logic. Nanoparticles arise from natural sources such as dust storms, volcanic eruptions, forest fires, photochemical reactions, erosion, and ocean spray, but industrialization and combustion-based transportation have profoundly increased anthropogenic nanoparticulate pollution (0801.3280). Carbon nanomaterials enter the environment during production, processing, use, and disposal, with ingestion, inhalation, injection, and skin absorption identified as the main human exposure pathways (Adhikari et al., 2021). A plausible implication is that environmental poisoning is best understood not as a single toxic event but as a class of transport-dependent exposure processes whose media differ in persistence, mobility, detectability, and biological access.

The distinction between ambient contamination and actual exposure is methodologically consequential. One study on PM$_{10}$ states that ambient pollution concentrations are not the same thing as individual exposure, because exposure depends on time-activity patterns across microenvironments such as home, street, and car (0710.5805). Another shows that residence-based assessment omits exposures acquired through commuting, work, shopping, and other daily activities, thereby underestimating true hazard burden (Liu et al., 2023). These results place pathway reconstruction at the center of environmental poisoning research.

2. Detection, monitoring, and exposure reconstruction

Remote sensing is a central technical challenge when the contaminant is hazardous at ultra-trace concentrations yet difficult to sample safely. For heavy metal aerosols, conventional methods including LIBS, AAS, XRF, SERS, colorimetry, ELISA, and electrochemical methods are described as accurate but generally lacking remote sensing capability (Wang et al., 10 Jun 2025). The cited solution is Filament-Induced Fluorescence Spectroscopy (FIFS), in which femtosecond laser pulses self-focus in air to form a long filament with intensity “clamped” at roughly $5\times10^{13}\,\mathrm{W/cm^2}$, enabling remote excitation of aerosol particles and production of characteristic atomic fluorescence (Wang et al., 10 Jun 2025).

Under the reported experimental conditions, optimization of the balance between filament length and detection distance yielded an optimal detection distance of $10\ \mathrm{m}$. At that range, the system achieved a minimum detectable Pb concentration of $0.47\ \mathrm{pg/m^3}$, an extrapolated limit of detection of $0.3\ \mathrm{pg/m^3}$, and $RSD < 7\%$ across $0.47\ \mathrm{pg/m^3}$ to $0.01\ \mathrm{mg/L}$0. The same configuration detected Cd, Hg, and Co with detection limits of $0.01\ \mathrm{mg/L}$1, $0.01\ \mathrm{mg/L}$2, and $0.01\ \mathrm{mg/L}$3, respectively. The study uses the IUPAC-style definition

$0.01\ \mathrm{mg/L}$4

with $0.01\ \mathrm{mg/L}$5 values of $0.01\ \mathrm{mg/L}$6 for Pb, $0.01\ \mathrm{mg/L}$7 for Cd, $0.01\ \mathrm{mg/L}$8 for Hg, and $0.01\ \mathrm{mg/L}$9 for Co (Wang et al., 10 Jun 2025).

Lead detection in water is treated through a different sensor architecture. A crown ether-functionalized silicon photonics platform is engineered for Pb$>98\%$0 detection with a dynamic detection range of $>98\%$1–$>98\%$2, high selectivity against ions including Na$>98\%$3, K$>98\%$4, Mg$>98\%$5, Li$>98\%$6, Zn$>98\%$7, Ca$>98\%$8, Fe$>98\%$9, Cu$_{10}$0, Al$_{10}$1, Sn$_{10}$2, and Cd$_{10}$3, and a measurable response at $_{10}$4 Pb$_{10}$5 (Ranno et al., 2023). The sensing principle is a post-flush resonance shift $_{10}$6 caused by surface-bound Pb$_{10}$7, implemented on a slot-waveguide Mach–Zehnder interferometer with reported extinction ratio exceeding $_{10}$8 at $_{10}$9 and free spectral range of $5\times10^{13}\,\mathrm{W/cm^2}$0 (Ranno et al., 2023).

Exposure reconstruction can be as important as direct sensing. The PM$5\times10^{13}\,\mathrm{W/cm^2}$1 study uses the pCNEM exposure simulator to generate daily personal exposures from ambient pollution and temperature inputs, then approximates those simulated exposures with a parametric distribution and embeds them in a hierarchical Bayesian mortality model (0710.5805). For a log-normal exposure model, the paper writes

$5\times10^{13}\,\mathrm{W/cm^2}$2

In the London application, the relative risk estimates were $5\times10^{13}\,\mathrm{W/cm^2}$3 $5\times10^{13}\,\mathrm{W/cm^2}$4 for ambient concentrations, $5\times10^{13}\,\mathrm{W/cm^2}$5 $5\times10^{13}\,\mathrm{W/cm^2}$6 for personal exposures under the log-normal model, and $5\times10^{13}\,\mathrm{W/cm^2}$7 $5\times10^{13}\,\mathrm{W/cm^2}$8 under the normal model, while personal exposures were lower than ambient concentrations by about a factor of $5\times10^{13}\,\mathrm{W/cm^2}$9 (0710.5805). This directly rejects the common simplification that ambient concentration and biologically experienced dose are interchangeable.

3. Spatial heterogeneity, mobility, and rational sampling

Environmental poisoning is spatially clustered rather than spatially uniform. A mobility-based hazard framework defines total dwell time for residents of tract $10\ \mathrm{m}$0 as

$10\ \mathrm{m}$1

dwell time in hazards as

$10\ \mathrm{m}$2

and the mobility-based Exposure Index as

$10\ \mathrm{m}$3

with separate indices for air pollution, toxic sites, and heat (Liu et al., 2023). Using large-scale mobile-phone data across 239 U.S. counties, that study reports that ignoring mobility can lead to about a $10\ \mathrm{m}$4 underestimation of hazard exposure risk, that MEI distributions are bimodal, and that mean MEI values in direct exposure regions versus latent exposure regions were $10\ \mathrm{m}$5 versus $10\ \mathrm{m}$6 for air pollution, $10\ \mathrm{m}$7 versus $10\ \mathrm{m}$8 for toxic sites, and $10\ \mathrm{m}$9 versus $0.47\ \mathrm{pg/m^3}$0 for heat (Liu et al., 2023).

The same study introduces “environmental hazard traps,” created by the interaction of spatial clustering and human mobility distance-decay. For people in direct exposure regions, traveling-induced exposure was $0.47\ \mathrm{pg/m^3}$1, $0.47\ \mathrm{pg/m^3}$2, and $0.47\ \mathrm{pg/m^3}$3 greater than in latent exposure regions for the three hazards, respectively (Liu et al., 2023). Latent exposure is also numerically substantial: at the $0.47\ \mathrm{pg/m^3}$4 threshold of daily activity time in high-hazard areas, the reported counts are $0.47\ \mathrm{pg/m^3}$5 million for air pollution, $0.47\ \mathrm{pg/m^3}$6 million for heat, and $0.47\ \mathrm{pg/m^3}$7 million for toxic sites (Liu et al., 2023). The burden is unequally distributed. In tracts facing all three hazards, latent exposure areas had below-poverty and minority shares of $0.47\ \mathrm{pg/m^3}$8 and $0.47\ \mathrm{pg/m^3}$9, compared with average tract values of $0.3\ \mathrm{pg/m^3}$0 and $0.3\ \mathrm{pg/m^3}$1 (Liu et al., 2023).

Spatial heterogeneity also structures rational monitoring. For arsenic in private wells, the exceedance indicator is defined as $0.3\ \mathrm{pg/m^3}$2 if well $0.3\ \mathrm{pg/m^3}$3 exceeds $0.3\ \mathrm{pg/m^3}$4 and $0.3\ \mathrm{pg/m^3}$5 otherwise, with

$0.3\ \mathrm{pg/m^3}$6

To detect abrupt spatial changes in contamination risk, the study minimizes

$0.3\ \mathrm{pg/m^3}$7

using graph fused lasso, proximal gradient, ADMM, and BIC-based tuning (Yin et al., 2021). The resulting Iowa risk map contains three clusters with estimated contamination probabilities $0.3\ \mathrm{pg/m^3}$8, $0.3\ \mathrm{pg/m^3}$9, and $RSD < 7\%$0, and cluster-specific Jeffreys sample sizes at $RSD < 7\%$1 confidence of $RSD < 7\%$2, $RSD < 7\%$3, and $RSD < 7\%$4 (Yin et al., 2021). A plausible implication is that environmental poisoning surveillance should be adaptive to boundaries and hotspots rather than based on statewide averages or smoothly varying surfaces.

4. Mechanisms, susceptibility, and long-term effects

The biological consequences of environmental poisoning range from molecular rewiring to lifelong impairment. A natural-experiment study of the London smog of 5–9 December 1952 models long-run outcomes with a reverse difference-in-differences specification and finds that exposure in utero reduces fluid intelligence by about $RSD < 7\%$5 standard deviations, childhood exposure reduces it by about $RSD < 7\%$6 standard deviations, and prenatal exposure raises the probability of ever being hospitalized for respiratory disease by about $RSD < 7\%$7 percentage points relative to a baseline prevalence of about $RSD < 7\%$8 (Hinke et al., 2022). The evidence suggests first- and second-trimester exposure are the most harmful for cognition, while infancy at age $RSD < 7\%$9 appears more damaging than exposure at age $0.47\ \mathrm{pg/m^3}$0 (Hinke et al., 2022).

At the systems-biology level, contaminant action is organized on the human interactome. A network study covering persistent organic pollutants, dioxins, PAHs, pesticides, PFCs, metals, and PPCPs reports fat-tailed chemical-target degree distributions, identifies hub targets such as AR, ERs, AHR, CYP1A1/CYP1A2, PXR, PPAR$0.47\ \mathrm{pg/m^3}$1/PPAR$0.47\ \mathrm{pg/m^3}$2, CYP3A4/CYP2B6, TNF, CXCL8, CASP3, and PARP1, and shows that contaminant targets had median node degree $0.47\ \mathrm{pg/m^3}$3–$0.47\ \mathrm{pg/m^3}$4 larger than that of all proteins (Iida et al., 2018). Using shortest-path distance and the log$0.47\ \mathrm{pg/m^3}$5 ratio $0.47\ \mathrm{pg/m^3}$6, the paper concludes that contaminant targets are significantly closer to disease proteins than random controls, with cancer and digestive system disease directly influenced by all contaminant categories (Iida et al., 2018).

Arsenic provides a multi-omics example of coupled toxicological disruption. A coupled matrix factorization framework based on PARAFAC2-AOADMM decomposes RRBS, RNA-seq, and metabolomics data as

$0.47\ \mathrm{pg/m^3}$7

with a shared factor matrix $0.47\ \mathrm{pg/m^3}$8, modality-specific factors $0.47\ \mathrm{pg/m^3}$9, diagonal strength matrices $0.01\ \mathrm{mg/L}$00, $0.01\ \mathrm{mg/L}$01 sparsity, disabled non-negativity, and a three-component model selected for reconstruction accuracy and interpretability (Suthahar et al., 22 Oct 2025). The strongest signal came from RRBS, indicating that DNA methylation changes are central to arsenic toxicity; highlighted genes and metabolites include Dnmt3b, Gapdh, Hspa8, Txnip, Atp6-ps, S-adenosyl-L-methionine, and 5-oxoproline (Suthahar et al., 22 Oct 2025). The reported interpretation is a coupled toxicity model in which SAM depletion, glutathione stress, chromatin-state-specific methylation changes, and transcriptomic remodeling vary between ESCs and EpiLCs.

PFAS hepatotoxicity is framed through L-FABP binding. A semi-supervised GraphSAGE-style GCN represents PFAS as graph nodes, uses fingerprint-based cosine similarity with $0.01\ \mathrm{mg/L}$02 for graph construction, and uses 705 reduced Mordred descriptors as node features after removing highly correlated features from an initial set of 1753 (Jividen et al., 2024). Trained on 829 labeled PFAS and extended to 2284 additional OECD PFAS, the best GCN achieved $0.01\ \mathrm{mg/L}$03, compared with $0.01\ \mathrm{mg/L}$04 for DNN, $0.01\ \mathrm{mg/L}$05 for RF, $0.01\ \mathrm{mg/L}$06 for SVR, $0.01\ \mathrm{mg/L}$07 for DT, and $0.01\ \mathrm{mg/L}$08 for Ridge (Jividen et al., 2024). The mechanistic interpretation is that hydrophobic CF chains drive initial contact with L-FABP, after which functional group heads interact with residues including SER39, ARG122, SER124, LYS31, and SER56, with larger PFAS showing more reliable contact and potentially higher liver bioaccumulation concern (Jividen et al., 2024).

Nanoparticle toxicology introduces barrier penetration, oxidative stress, and organ distribution. One review states that the key to understanding the toxicity of nanoparticles is that their minute size, smaller than cells and cellular organelles, allows them to penetrate these structures and disrupt normal function, and relates exposure to asthma, bronchitis, lung cancer, neurodegenerative diseases, Crohn’s disease, colon cancer, arteriosclerosis, blood clots, arrhythmia, heart diseases, and cardiac death (0801.3280). A chapter on carbon nanomaterials identifies ROS generation, inflammation, mitochondrial membrane damage, autophagy, pyroptosis, apoptosis, necrosis, genotoxicity, embryotoxicity, and organ persistence as major mechanisms across fullerene, CNTs, and graphene derivatives (Adhikari et al., 2021). These studies jointly suggest that environmental poisoning at the nanoscale is controlled by size, shape, surface chemistry, aggregation state, and tissue translocation rather than by bulk composition alone.

5. Mixtures, dynamical responses, and system-level inference

Because humans are routinely exposed to mixtures, environmental poisoning cannot be reduced to independent single-pollutant effects. A Bayesian semiparametric regression for environmental mixtures models

$0.01\ \mathrm{mg/L}$09

with spline-based main effects and interaction bases, and uses multivariate spike-and-slab priors on inclusion indicators $0.01\ \mathrm{mg/L}$10 to identify nonlinear main effects and pollutant interactions (Antonelli et al., 2017). In a Bangladesh cohort of 375 children with prenatal As, Mn, and Pb exposures, the method found that all three metals had very high posterior inclusion probabilities, strong evidence for a nonlinear Mn–As interaction, moderate evidence for a Pb–As interaction, and posterior probability $0.01\ \mathrm{mg/L}$11 for a three-way Pb–Mn–As interaction (Antonelli et al., 2017). In NHANES POP data, the same framework found essentially no evidence for most pollutants or higher-order interactions, except for Furan1 with posterior inclusion probability near $0.01\ \mathrm{mg/L}$12 (Antonelli et al., 2017).

HiGLASSO addresses a related problem by imposing strong heredity on nonlinear pairwise interactions through the reparameterization

$0.01\ \mathrm{mg/L}$13

combined with adaptive weighted group penalties (Boss et al., 2020). Applied to the LIFECODES birth cohort with 21 urinary toxicant biomarkers and urinary 8-isoprostane as the outcome, HiGLASSO selected the interactions MBzP $0.01\ \mathrm{mg/L}$14 MCPP and BPS $0.01\ \mathrm{mg/L}$15 2,5-DCP, and also selected MePB, whose exploratory plots suggested a nonlinear marginal relationship missed by linear models (Boss et al., 2020). The methodological point is not merely predictive performance but hierarchy-respecting interpretability in mixture toxicology.

Principal Component Pursuit for Pattern Identification in Environmental Mixtures treats an exposure matrix as

$0.01\ \mathrm{mg/L}$16

or, in the paper’s constrained form, as a low-rank matrix $0.01\ \mathrm{mg/L}$17 plus a sparse matrix $0.01\ \mathrm{mg/L}$18, with a custom penalty for values below the limit of detection (Gibson et al., 2021). Across 1,800 simulations, PCP-LOD recovered the true rank in all simulations, whereas PCA recovered the true number of patterns in $0.01\ \mathrm{mg/L}$19 of simulations under the $0.01\ \mathrm{mg/L}$20 variance-explained rule; in NHANES 2001–2002 POP data, PCP-LOD identified a rank-three low-rank structure and separated $0.01\ \mathrm{mg/L}$21 of values as unique events (Gibson et al., 2021). One inferred pattern represented comprehensive exposure to all POPs, while the others grouped chemicals based on known structure and toxicity (Gibson et al., 2021). This suggests that environmental poisoning datasets often contain both recurrent exposure architectures and rare anomalous events that should not be forced into the same latent structure.

System dynamics add another layer. A three-variable rain–pollution–population model writes

$0.01\ \mathrm{mg/L}$22

so that rainfall removes pollutants through the scavenging term $0.01\ \mathrm{mg/L}$23 (Sharma et al., 2017). Numerical results show that increasing $0.01\ \mathrm{mg/L}$24 or $0.01\ \mathrm{mg/L}$25 increases population size $0.01\ \mathrm{mg/L}$26, increasing $0.01\ \mathrm{mg/L}$27 decreases $0.01\ \mathrm{mg/L}$28, and increasing $0.01\ \mathrm{mg/L}$29 decreases pollutant concentration $0.01\ \mathrm{mg/L}$30 (Sharma et al., 2017). A separate toxin-mediated consumer–resource–disease model shows that increasing environmental toxin can both raise transmission through $0.01\ \mathrm{mg/L}$31 and suppress host persistence through reduced reproduction and increased mortality, yielding endemic coexistence, bistability, homoclinic collapse, and abrupt extinction via saddle-node bifurcation (Chattopadhyay et al., 2022). Together, these models show that environmental poisoning can alter not only organismal dose but also dynamical regime structure.

6. Environmental poisoning as an adversarial computational paradigm

In machine learning and autonomous systems, environmental poisoning denotes contamination of the observation environment so that learning or memory is corrupted without direct tampering with labels or model parameters. In autonomous driving, a “bait and switch” attack assumes a traffic-light classifier pre-trained in town A and fine-tuned online in town B, with honest human labels and unmodified traffic lights; the attacker instead places billboards near selected traffic lights and synchronizes billboard content with light state during training (Patel et al., 2020). The model is fine-tuned by minimizing the ordinary supervised loss over a mixture of clean and poisoned observations, and the online update rule remains the standard gradient step

$0.01\ \mathrm{mg/L}$32

In CARLA, clean retraining raised town-B accuracy from $0.01\ \mathrm{mg/L}$33 to $0.01\ \mathrm{mg/L}$34, but poisoning reduced accuracy to $0.01\ \mathrm{mg/L}$35, $0.01\ \mathrm{mg/L}$36, $0.01\ \mathrm{mg/L}$37, $0.01\ \mathrm{mg/L}$38, and $0.01\ \mathrm{mg/L}$39 as 3, 5, 9, 18, and 37 traffic lights were poisoned (Patel et al., 2020). Partial fine-tuning remained vulnerable.

Web-agent poisoning extends the same logic to persistent memory. Environment-injected Trajectory-based Agent Memory Poisoning (eTAMP) assumes arbitrary text injection into webpages but no direct access to memory databases, model weights, system prompts, or future user tasks (Zou et al., 3 Apr 2026). The attack maximizes

$0.01\ \mathrm{mg/L}$40

subject to a stealth constraint requiring Task A to remain unaffected. On (Visual)WebArena, the strongest reported cross-session, cross-site attack success rates were up to $0.01\ \mathrm{mg/L}$41 on GPT-5-mini, $0.01\ \mathrm{mg/L}$42 on GPT-5.2, and $0.01\ \mathrm{mg/L}$43 on GPT-OSS-120B, with ASR increasing up to 8 times under “Frustration Exploitation” when environmental perturbations such as dropped clicks, scroll swap, and garbled typing were introduced (Zou et al., 3 Apr 2026). The misconception that stronger task performance implies stronger security is directly contradicted by the reported vulnerability of GPT-5.2.

Speech recognition admits a related fine-tuning-time backdoor. An attack on Whisper constructs poisoned samples by concatenating an environmental trigger waveform and an attacker-chosen target phrase to otherwise benign speech-transcription pairs, using triggers such as finger snap, car horn, forklift backup alarm, and hydraulic lift (Bartolini et al., 2024). With poisoning rates $0.01\ \mathrm{mg/L}$44, the paper reports that all triggers converge to about $0.01\ \mathrm{mg/L}$45 ASR under speech-concatenation conditions at $0.01\ \mathrm{mg/L}$46, while benign-word-error-rate changes were generally below $0.01\ \mathrm{mg/L}$47 (Bartolini et al., 2024). Silero VAD reduced ASR substantially but imposed a trade-off, with a no-VAD baseline WER of about $0.01\ \mathrm{mg/L}$48, worst-case VAD WER up to about $0.01\ \mathrm{mg/L}$49, and a cited compromise setting $0.01\ \mathrm{mg/L}$50 mitigating most attacks with about $0.01\ \mathrm{mg/L}$51 WER (Bartolini et al., 2024).

This computational usage does not replace the environmental-health meaning of the term. Rather, it establishes a formally analogous principle: the environment is not merely background context but an active channel through which poisoning can be induced, whether by toxic aerosols and contaminated groundwater or by attacker-controlled observations that reshape learned representations, retrieval contexts, and downstream decisions.