A design review asks whether a tenfold bigger training crawl lowered poisoning risk. What do you say?

## The situation You have inherited a pretraining corpus assembled from a public crawl. It grew by an order of magnitude between the last training run and the next. Somebody has written, in good faith, that this reduced data-poisoning risk. You are asked in a review whether that is true. The judgment is yours to own, and it has three parts: what you concede, what you correct, and what you ask for. ## Part one: concede the half that is true An attacker whose goal is a globally worse model has a requirement expressed as a **share** of the training signal. A tenfold corpus raises what they must write roughly tenfold, and at some size the attack stops being affordable to anyone without industrial resources. That is real risk reduction and refusing to acknowledge it makes the rest of your argument sound like reflexive negativity. Record it - specifically, against that goal. ## Part two: correct the half that is false An attacker whose goal is one behaviour on inputs they choose has a requirement that behaves as an approximately **absolute document count**, because the planted content competes with the other evidence about that same rare context rather than with the corpus at large. Corpus growth adds documents about other things. Growing model capacity alongside the corpus, which is what happened, makes rare patterns easier to fit rather than harder. So one question - "did growth make us safer?" - has two answers pointing in opposite directions, and any risk statement that reports a single verdict is wrong for one of them. This is the substance of the review contribution. ## Part three: name the finding nobody wrote down The important thing in a review of this kind is usually not the growth number at all. It is what the pipeline cannot tell you: - If **per-document origin was not retained**, then no question asked after the fact is answerable. Not "where did this come from", not "what else came from the same place", not "was this present in the previous run". - If the corpus is **re-crawled per training run rather than pinned**, then two runs cannot be diffed, and a corpus changing under you is invisible by construction. Those two gaps are worth more than any filter tuning, because they are the difference between a suspicion you can investigate and one you can only argue about. State plainly that today the honest answer to "was our training data poisoned?" is "we have no way to find out" - and that this is a decision the organisation made by omission, not a technical impossibility. ## What you ask to fund, and what you refuse to promise Fund, in order: 1. **Retained provenance per document**, carried through every pipeline stage. 2. **A pinned snapshot per training run**, stored so it is re-fetchable and diffable. 3. **Tighter admission for the slices anyone can write into**, which is where near-free write access lives. This is a scoping decision, and it is cheaper than any control applied afterwards. 4. **Behavioural evaluation on the contexts whose corruption would be expensive**, since you can test a model on what matters and you cannot read a billion documents. Refuse to promise: that the corpus is clean, that filtering established it, or that any amount of growth will. Refuse to let dataset size stand in a risk register as a mitigation, because it mitigates one goal and reads as if it mitigates the threat. ## The costs you should surface rather than hide Every item on that list has a price, and a principal-level answer says who pays it. Provenance and pinning cost storage and pipeline complexity, and they slow the crawl-to-run loop. Tightening admission removes real content along with the risk, and the loss lands on sparse topics rather than on the average. Behavioural evaluation costs the time of people who must decide *which* behaviours matter, which is a product question and not an engineering one. None of these is free, and presenting them as free is how they get cut in the next planning round. ## The line to actually say "Growth raised the cost of degrading the model roughly in proportion and did not change the cost of planting one behaviour. The risk register should carry those separately, and it should stop listing corpus size as a mitigation. What I want funded is retained per-document origin and a pinned snapshot, because right now, if someone reports that our model behaves oddly on some rare input, we cannot investigate it at all."