What makes a write path into a training corpus an access class rather than "insider risk"?

## Why the framing matters Threat models are statements about access. Every other vantage in adversarial ML is written that way: an adversary with weights and gradients, an adversary with a full probability vector, an adversary with a bare top-1 label, an adversary with a query budget they must pay for. Each one names what can be touched and what cannot, and every attack claim is only meaningful relative to one of them. Write access upstream of training deserves exactly the same treatment, and it usually does not get it. It gets filed under "insider risk", which is a different kind of statement entirely: a category of person, handled by a personnel process — background checks, joiners-and-leavers, awareness training. Those are worth having and they answer a different question. They cannot tell you what somebody holding a write on the label queue could achieve, or whether anybody would notice. ## What an access class has to say Four parts, and none of them mention a person's motive. **Who holds write.** Not "the team", but the enumerable set of principals with write on this specific path: the named accounts, the shared account an outsourced queue authenticates as, the service identity an ingestion job runs under, anyone who can open a change against the notebook that assembles the training table. If the answer is a shared credential, then the writer set is "whoever holds that credential", and that is the honest statement. **What they cannot do.** The limit is the other half, and leaving it out turns the class into a vague fear. Here the limit is usually stark and worth stating plainly: no query access, no weights, no ability to see the model's replies at all. That limit is what makes it a distinct class rather than a weaker version of something else. **What reads the write, and when.** A write only has reach if a training run consumes it. Which run, on what schedule, and does the write reach it directly, or through an assembly step that filters or aggregates first? A path whose writes are never read by any training run is not an access class into the model at all, and saying so is a real result. **What stands in between, and for how long.** Does anything compare one training table to the previous one before a retrain consumes it? Does a change to the assembly job take a second pair of eyes? How long can a write sit before anybody would look at it? This is the part that decides whether the class is merely present or effectively unbounded. ## Why "insider" is the wrong word specifically The most likely writers on these paths are frequently not insiders in any employment sense. A community or partner feed your pipeline ingests accepts contributions from a population you do not employ and cannot enumerate. An outsourced triage or annotation queue is clicked through by people who work for someone else, often authenticated as one shared identity. An ingestion job runs under a service account that is nobody, so a credential for it is access with no person attached at all. And a genuine employee's stolen credential produces exactly the same write as the employee would. Every one of those is the same access class with the same reach. Grouping them by employment status splits a single technical vantage across four unrelated processes and loses the thing they have in common: they can all write one artefact that a later training run reads. ## What it buys you to state it properly Once written as a vantage and a limit, the class behaves like any other line in a threat model. You can enumerate it, so you know how many principals hold it. You can test it, by asking whether a change you make to an upstream path actually reaches a training table and whether anyone sees it on the way. You can shrink it, by narrowing the writer set, adding attribution, or putting something between the write and the retrain. And you can be honest about it afterwards, because the claim it supports is a scope — these principals could have written, over this window, with this much review — rather than an assurance that nothing happened. ## The interview signal An interviewer asking this is checking whether you can carry the discipline of stated access assumptions past the endpoint. Candidates who have only ever reasoned about queries answer with personnel controls, because that is where "someone with access to our data" lives in their mental model. The stronger answer treats the write path exactly as it would treat white-box access: name the vantage, name the limit, and then ask what that adversary can achieve.