Data Sanitization

Assigns a numerical score to each data point based on its deviation from the expected distribution. High scores flag potential poisoned samples for removal or manual review.

• Uses statistical distance metrics like Mahalanobis distance or z-score
• Leverages density-based methods such as Local Outlier Factor (LOF)
• Applies isolation forests to efficiently isolate anomalies in high-dimensional data
• Thresholds are tuned per dataset to balance false positives against missed attacks

Identifies poisoned data by analyzing the singular value decomposition of feature representations. Corrupted samples often exhibit a latent separability from clean data in the right singular vector space.

• Computes the covariance matrix of hidden layer activations
• Extracts the top singular vector to reveal the direction of maximum variance
• Outlier scores on this vector reliably separate poisoned from clean samples
• Effective against clean-label backdoor attacks where visual inspection fails

An automated gatekeeping mechanism that rejects training data violating predefined structural rules, type constraints, or expected value ranges before ingestion.

• Enforces data type consistency (e.g., integer fields cannot contain strings)
• Validates range constraints (e.g., pixel values must be 0-255)
• Checks required field presence and null-value thresholds
• Rejects malformed records that could exploit parsing vulnerabilities in downstream pipelines

A robust statistical tool that quantifies the impact of removing or modifying a specific training point on a model's learned parameters. Used to identify the most harmful poisoned samples post-hoc.

• Calculates the gradient of the loss with respect to upweighting each training point
• Approximates parameter change without expensive leave-one-out retraining
• Identifies high-negative-influence points that degrade model performance
• Enables precise surgical removal of poisoned data from contaminated datasets

A defensive technique that caps the magnitude of individual gradients during training to prevent maliciously large updates from dominating the learning process.

• Applies L2 norm thresholding to scale down oversized gradient vectors
• Prevents gradient explosion caused by adversarially crafted training samples
• Acts as a real-time sanitizer during stochastic gradient descent
• Parameter max_grad_norm typically set between 1.0 and 10.0 depending on model architecture

The documented chronology of a dataset's origin, transformations, and chain of custody. Maintains cryptographic verification of training set integrity throughout the pipeline.

• Tracks data versioning with immutable snapshots for forensic rollback
• Uses cryptographic hashing to detect unauthorized modifications
• Maintains immutable audit logs of all ingestion and transformation events
• Enables pinpoint identification of the contamination source when poisoning is detected

A detection technique that assigns a numerical score to each data point based on its deviation from the expected distribution. Samples with scores exceeding a predefined threshold are flagged as potential poison and quarantined before training.

• Uses statistical distance (Mahalanobis, L2 norm) or density estimation
• Can operate on raw features or latent representations from a pre-trained model
• Critical for identifying clean-label attacks that appear correctly labeled

A defense method that identifies poisoned data by analyzing the singular value decomposition of feature representations. Corrupted samples often exhibit a latent separability from clean data in the top singular vectors.

• Computes the right singular vectors of the feature covariance matrix
• Projects all samples onto the top vector to compute outlier scores
• Highly effective against backdoor attacks with subtle triggers

A class of algorithms designed to combine model updates from multiple sources while remaining resilient to a minority of malicious contributions. Essential in federated learning where poisoned clients may submit corrupted gradients.

• Krum Aggregation: Selects the single gradient closest to its neighbors
• Trimmed Mean: Discards extreme values per coordinate before averaging
• Median-based rules: Replace averaging with coordinate-wise median

A robust statistical tool that quantifies the impact of removing or modifying a specific training point on a model's learned parameters. By computing leave-one-out influence, defenders can rank and remove the most harmful poisoned samples.

• Approximates the change in loss without full retraining
• Identifies high-leverage points that disproportionately skew the decision boundary
• Computationally intensive but highly precise for forensic analysis

The documented chronology of a dataset's origin, transformations, and chain of custody. Lineage tracking records every transformation across the pipeline, enabling forensic pinpointing of contamination sources.

• Combines cryptographic hashing for tamper detection
• Uses immutable audit logs for blast radius analysis
• Enables rollback to a verified clean state via data versioning

The property of a distributed learning system that guarantees convergence to a correct model even when an arbitrary subset of worker nodes behaves adversarially. Byzantine fault tolerance in ML extends classical distributed systems theory to gradient-based optimization.

• Assumes up to f out of n nodes may be malicious
• Gradient clipping caps malicious update magnitudes
• Forms the theoretical foundation for secure federated sanitization