Data Poisoning & Backdoors

That you have no evidence either way, and behavioural evaluation cannot produce any. The defensible claim covers accuracy on sampled inputs and who had write access to training. The rest is residual risk to bound, not test away.

Ask for the coverage fields, not the verdict: which trigger family and size cap were searched, which classes and at what per-class budget, whose clean inputs were used, and the tool's detection rate on planted controls.

Host telemetry catches the loader risk and is blind to the weights risk. Code running when a file is read leaves process and network evidence at a known moment; a backdoored network leaves none and shows only on inputs the publisher chose.

It rules out a publisher who simply made the model worse. It says nothing about a response conditioned on inputs your evaluation set never contained, because preserving headline accuracy is a design requirement of that kind of behaviour, not an accident.

A measured reduction for one disclosed key under one adaptation recipe, on the inputs tested - not removal. It bounds no other key, and eleven percent against an adversary who chooses the input and retries is not small.

Only a degradation campaign large enough to move that particular number, on the slices reported. It rules out nothing about an aimed insertion, whose defining property is that aggregate accuracy stays exactly where it was.

It reduces the bulk, noisy variant - a flood of near-identical or obviously junk documents - which is the goal corpus size already made expensive. It does close to nothing against a small number of distinct, individually plausible documents.

The defender's alert threshold and report granularity bound the strength of each write, and because the adversary cannot read either one, they must leave themselves a wide margin. That converts the attack into scale and dwell time rather than stopping it.

A zero-rejection sampled review bounds the reviewed items only: each was individually plausible to one reviewer. It says nothing about the unreviewed remainder, and against a small targeted attack the review most likely drew no poisoned item at all.

Not from the screen's own output - dropped and kept records are both mixtures. Inspect what was dropped, and measure what the tighter cut cost on the rare real behaviour the model exists to catch.

You cannot settle it from the round: no contribution can be opened. Use what exists — update-size statistics, cohort composition, per-slice accuracy, probes on the released model. Intermittency is expected under client sampling, not evidence of a flake.

Ask what the 20% is a fraction of, what client partition it was measured on, and how widely honest updates already spread in this federation. A tolerance derived on statistically identical clients says little about silos with genuinely different books.

A naturally occurring key is deniable in the corpus but fires without the attacker. At deployment volumes even a small base rate produces many unexplained decisions, which is how operations teams find backdoors before any scan does.

By when the attacker had access. A backdoor is a conditional learned during training, needing write access to the data or checkpoint and none at inference. A universal perturbation is fitted afterwards, against weights that already exist.

As long as those rows stay in the data each retrain uses, and as long as newly arriving similar rows do not outweigh them. An accumulating table keeps the effect; a rolling window expires it.

Only that no segment the report breaks out moved more than that segment's sample noise allows it to resolve. Damage confined below the reporting granularity, or inside a small noisy segment, reads green exactly as health does.

Flakiness is the expected signature of clean-label poisoning, not evidence against it. The effect depends on the exact fit one training run reaches, so treat the per-retrain success rate as the finding and ask what a retry costs the submitter.

Two effects run opposite ways. A fixed number of malicious silos becomes a smaller share, which helps. But honest updates spread further apart, enlarging the region an adversary hides in, and that spread is what the guarantee rests on.

Less against a supplier who read it, but not nothing. A public method still prices out careless and copied artefacts; its negative decays exactly where you are targeted, so treat it as an entry bar, never an acceptance criterion.

Split one rule into two questions. Write the format requirement as what it covers - code execution when the file is read - add a separately owned question about what the weights do, and name who accepts the residual you cannot test away.

Treat it as a trust decision, not a verification gap. Custody checks cannot answer a behavioural question, so decide by consequence: what a wrong output costs here, what you can constrain downstream, and what recourse you hold.

Commit to what you tested and what it covers, never to removal. Absence of a conditional keyed to a feature you do not hold is not demonstrable, so the decision to own is what the model's output may reach.

Answer per goal, not overall: growth genuinely raised the cost of degrading the model and did nothing about planting one behaviour. Then say the real finding - with no retained origin and no pinned snapshot, the question cannot be investigated at all.

Give the real share, say it fell because intake grew rather than because review got worse, and state what it bounds: those items got a per-item human verdict. It is not a claim that the corpus is unpoisoned.

Require the claim be restated as a price: how many extra records an attacker constrained to look ordinary needs, what the threshold cost on rare real data, and who can write into the corpus.

Both price write access rather than inspecting it, and each bills a different group. A tighter ceiling taxes the honest clients with the largest updates; costlier enrolment taxes adoption. Rounds between evaluations is usually the cheapest factor.