A vendor deck claims a poison-resistant training pipeline. What do you require before crediting the claim?

## What the slide is claiming, and what it can support *Poison-resistant data pipeline* is a categorical claim - a class of attack does not work here. The evidence offered for it is almost always a removal rate: poison records were injected, the screens dropped most of them. Those two things do not connect. Removal rate is a property of the injected set, and the injected set was chosen by whoever wrote the slide. The reviewer's job is to convert the categorical claim into the quantitative one it could honestly support, and then decide whether that quantity matters for the deployment in front of them. ## The three questions that do the work **1. What did the survivors do?** A screen that removes 98.6% of an injected set has left 1.4% in the training data. Whether that matters depends entirely on how many records the effect required. If the goal was a narrow conditional behaviour needing a roughly fixed record count, the survivors may be sufficient on their own, and the removal rate is then a large number attached to a failed defence. The measurable quantity is the retrained model's behaviour on whatever the poison targeted, with the screens running. Nobody puts that on a slide because it is a harder experiment and a less flattering number. **2. What did the threshold cost?** Every removal rate has a threshold behind it, and every threshold deletes real records from the tail before it reaches poison written to look ordinary. Ask for recall on the rarest real classes, measured on an evaluation set the training corpus could not influence, before and after the screens. If the deck reports unchanged aggregate accuracy, that is consistent with having deleted most of the tail, because the tail is a small share of any sample drawn from the same distribution. **3. Who can write, and how much?** This is the question that decides the others. The genuine effect of sanitization is a multiplier: an attacker constrained to stay inside the distribution needs materially more written records for the same result. A multiplier defends you only when the required count exceeds what a writer can actually produce. For a corpus assembled from a source anyone can emit into, the ceiling is high and the multiplier buys time rather than safety. For a corpus fed by a small, attributed set of contributors with metered volume, the same multiplier can genuinely put the attack out of reach. The screen is identical in both cases; its worth is not. ## The decision that is actually yours Having priced the claim, a lead has to allocate. The options are not *better screens* versus *nothing*. - **Fund threshold and scoring work.** Cheap, visible, and subject to diminishing returns, because a second screen usually re-cuts the same tail the first one did. Its ceiling is the multiplier, and it costs real-data coverage on the way up. - **Fund write-side control.** Ration who can contribute to the corpus, attribute records to a source, cap per-source volume per window, retain provenance so a later removal can be traced. This attacks the quantity the multiplier is measured against, and it is the only lever that turns a price into a bound. - **Fund independent measurement.** Keep a held-out evaluation set the corpus cannot influence, weighted toward the rare classes the model exists to catch, so that both the poison effect and the screen's own cost become observable at all. Without this, neither of the first two options can be assessed. - **Accept the residual and say so.** Sometimes the honest answer is that this corpus is fed from a source you do not control, the multiplier is what you get, and the residual risk is accepted with a named owner and a monitoring plan. That is a defensible position. *Poison-resistant* is not. ## What you tell the vendor, and what you tell your own leadership To the vendor: restate the claim. *Our screens remove poison lying outside the observed distribution; against poison constrained to sit inside it we measure a multiplier of roughly N on the record count required, at a cost of M points of recall on the rarest classes.* Every term there is checkable, and a vendor who cannot produce any of them has measured removal rate and nothing else. To your own leadership: the sentence *the pipeline filters poisoned data* should not appear in a risk register, because it describes a control that does not exist. What exists is a cost imposed on an attacker whose size you can estimate, and a decision about whether the people who can write into this corpus can pay it. Write the register entry that way and the follow-on work chooses itself. ## The failure mode this question is testing The weak answer credits the claim because the removal rate was high, or rejects it because vendors exaggerate. Both skip the reasoning. The strong answer names the quantity that was measured, names the quantities that were not, and ends on an allocation decision - which is what makes it a lead's question rather than an analyst's.