Data Sanitization

Leverages the singular value decomposition (SVD) of feature representations to identify poisoned samples. Backdoor triggers create strong, statistically anomalous correlations in the top singular vectors of the covariance matrix. By projecting the representations of all training examples onto these vectors and flagging extreme outliers, this method effectively separates poisoned data from clean data without requiring any prior knowledge of the trigger pattern. It is particularly effective against clean-label attacks where the poisoned image looks normal to a human reviewer.

A defense that analyzes the internal neural representations of a trained model to isolate poisoned data. The process involves:

• Feeding all training data through the network and extracting the activations of the final hidden layer for each class.
• Applying dimensionality reduction (e.g., PCA) and clustering (e.g., K-Means) to these activations.
• Identifying a poison cluster that is small, tight, and distinct from the main clean cluster. Samples in the anomalous cluster are removed, and the model is retrained on the sanitized set.

A foundational sanitization technique that caps the L2-norm of individual per-example gradients during training. By enforcing a hard upper bound on the magnitude of the update any single data point can contribute, gradient clipping directly limits the poisoning budget of an adversary. Even if a malicious sample is crafted to produce a high-impact gradient, its influence is truncated to a fixed threshold. This is a core component of Differential Privacy SGD (DP-SGD) and provides a simple, computationally cheap baseline for robust training.

An automated, inline filtering system integrated directly into the MLOps pipeline. Before any sample reaches the training process, it passes through a series of validation checks:

• Schema validation: Ensures correct data types and shapes.
• Distributional shift detection: Compares statistical moments of the incoming batch against a trusted reference distribution.
• Outlier detection: Applies isolation forests or autoencoders to flag anomalous feature vectors.
• Label consistency checks: Verifies that the label is plausible given the feature distribution. Samples failing any check are quarantined for human review or automatically discarded.

A Byzantine-resilient aggregation rule designed for distributed and federated learning sanitization. Instead of averaging all client updates, Krum selects a single update that is mathematically closest to a majority of its neighbors in gradient space. The algorithm computes pairwise distances between all submitted updates and selects the one with the minimal sum of distances to its n - b - 2 closest peers, where b is the estimated number of Byzantine adversaries. This effectively ignores malicious updates that deviate significantly from the consensus, even if they form a colluding minority.

A supply-chain sanitization approach that cryptographically verifies the lineage and integrity of every data point. By enforcing a strict chain of custody using artifact signing and immutable metadata logs, the system can automatically reject any sample that lacks a verifiable, trusted origin. Key components include:

• Digital signatures on data batches from approved sources.
• Hash-based integrity checks to detect tampering in transit.
• Provenance graphs that trace each sample back to its raw sensor or human labeler. This prevents an attacker from injecting poisoned data by compromising an unsecured staging area.