Data Quality Score

Measures the ratio of present values to total expected values in a dataset. Null values, missing fields, or truncated records directly lower this score.

• Calculation: (Number of non-null values) / (Total number of values)
• Impact: Incomplete records create blind spots that can be exploited to hide poisoned samples.
• Example: A sensor dataset missing 15% of its timestamps has a completeness score of 0.85, potentially masking a backdoor trigger injected during those gaps.

Evaluates whether data violates defined relational rules, format constraints, or logical integrity checks. Inconsistent data often signals data drift or adversarial manipulation.

• Checks: Cross-field validation, referential integrity, and format adherence.
• Red Flag: A sudden spike in inconsistent records can indicate a label flipping attack in progress.
• Example: A customer age field containing negative values or a transaction log where the sum of line items does not equal the total amount.

Quantifies the degree to which data reflects the true, real-world entity it represents. This is the hardest dimension to measure automatically and often requires a verified ground truth source.

• Validation: Cross-referencing against authoritative external sources or human-verified samples.
• Poisoning Link: Low accuracy scores are a primary symptom of clean-label attacks, where images look correct to a human but are perturbed to deceive the model.
• Example: A satellite image labeled 'urban' that actually contains a rural landscape, verified against a trusted geographic information system (GIS).

Measures the latency between data generation and its availability for consumption. Stale data can cause a form of concept drift where the model learns from an outdated reality.

• Metric: The time delta between event occurrence and record ingestion.
• Security Angle: Delayed data streams can be a sign of a man-in-the-middle attack or a compromised ingestion pipeline.
• Example: A fraud detection model training on transaction data that is 72 hours old, missing the rapid patterns of a live trigger injection attack.

Assesses the level of duplicate or redundant information within a dataset. Duplication can artificially skew the model's learned distribution, amplifying the weight of a single poisoned sample.

• Detection: Fuzzy matching and exact hash comparison across records.
• Risk: An attacker can inject a single malicious sample and then flood the pipeline with duplicates to ensure it dominates the training batch.
• Example: A customer feedback dataset where the same negative review appears 1,000 times, overwhelming the robust aggregation mechanism.

Confirms that data conforms to a predefined schema, including data types, allowed ranges, and required formats. This is the first line of defense in a data sanitization pipeline.

• Enforcement: Strict schema validation rejects any record that violates structural rules before ingestion.
• Defense: Catches blatant poisoning attempts that use malformed data to crash parsers or exploit buffer overflows.
• Example: A feature expecting a float between 0.0 and 1.0 that receives a string or a value of 1000 is automatically rejected, maintaining training set integrity.

The defensive process of filtering, transforming, or removing suspicious training samples to neutralize poisoning threats. Sanitization relies on anomaly scoring and spectral signatures to separate corrupted data from clean data before it reaches the training pipeline. A high Data Quality Score often triggers automated sanitization workflows when thresholds are breached.

A detection technique that assigns a numerical score to each data point based on its deviation from the expected distribution. Key characteristics include:

• Unsupervised detection using isolation forests or autoencoders
• Per-feature contribution analysis to explain why a sample is flagged
• Threshold calibration to balance false positives against missed attacks Low anomaly scores directly correlate with high Data Quality Scores.

The documented chronology of a dataset's origin, transformations, and chain of custody. Provenance metadata enables lineage tracking back to the source, verifying that no unauthorized modification occurred. Cryptographic data versioning and immutable audit logs provide the forensic foundation for trusting a Data Quality Score's assessment of integrity.

A statistical divergence between training data and production data that can mask or mimic poisoning attacks. Drift detection monitors for these shifts continuously. A sudden drop in Data Quality Score often signals either a genuine poisoning event or an operational distributional shift—distinguishing between the two requires concept drift analysis and influence functions.

An automated gatekeeping mechanism that rejects training data violating predefined structural rules, type constraints, or expected value ranges. Schema validation acts as the first line of defense, catching label flipping attempts and malformed injections before they impact the Data Quality Score. Combined with cryptographic hashing, it ensures basic training set integrity.

A robust statistical tool that quantifies the impact of removing or modifying a specific training point on model parameters. When a Data Quality Score flags degradation, influence functions help identify the most harmful poisoned samples by calculating:

• Leave-one-out retraining approximations without full retraining
• Gradient-based attribution of model error to individual points
• Upweighting analysis to measure a sample's disproportionate effect