Poisoning resistance begins at ingestion, not alignment

I think poisoning resistance begins at ingestion, not alignment. Once hostile or corrupted material has been normalized, chunked, embedded, mixed, and promoted into a trusted corpus, later safety tuning is being asked to distinguish provenance that the data platform already erased. Alignment may shape how a model responds to suspicious instructions. It cannot reconstruct which document entered through which connector, which transformations touched it, or which derived artifacts now carry its influence. That is a data lineage problem, and it must be solved before training or retrieval.

The ingestion boundary is where untrusted bytes become trusted evidence. In a retrieval system, a poisoned page can survive extraction, acquire clean metadata, and be split into chunks whose embeddings make the attack look semantically relevant. In a training pipeline, a backdoor trigger can be statistically rare enough to pass aggregate quality checks while remaining causally important. The same pipeline stages that make data useful—normalization, deduplication, filtering, enrichment, and aggregation—also make malicious origin harder to see. A mature design therefore treats every transformation as security-relevant, not as neutral preparation.

I want raw inputs preserved immutably with source identity, collection time, licence and consent context, connector version, content hash, and trust tier. Derived records should carry lineage back to those inputs rather than merely a final dataset label. New sources enter quarantine, not the production index. Their distributions, duplication patterns, language mix, entity density, anomalous tokens, and retrieval behaviour are compared with the accepted baseline. Quality filters help, but their thresholds are policy choices: language identification can exclude dialects, toxicity classifiers can narrow legitimate coverage, and simple heuristics can remove unusual but valuable material while a carefully shaped attack passes.

The release mechanism matters as much as detection. I would build a candidate index or dataset, evaluate it in shadow, and promote it by an atomic pointer change only after checks pass. That makes rollback a first-class operation. If an investigation later identifies a compromised source, lineage should answer which chunks, embeddings, examples, checkpoints, and downstream products depend on it. Without that graph, “remove the bad data” means rebuilding everything and hoping the contamination boundary was guessed correctly. Poisoning resistance is not only keeping attacks out; it is limiting and reversing their influence when prevention fails.

This also changes ownership. Security teams define threat models and adversarial tests, but data-platform teams own the controls that make those policies executable: source allowlists, signed manifests, content-addressed storage, schema validation, row-level trust labels, staged promotion, retention, and deletion propagation. Model teams then consume governed snapshots instead of assembling opaque mixtures in notebooks. The handoff becomes a contract with evidence rather than a file path.

I concede one narrow boundary: no ingestion pipeline can reliably detect every semantically subtle poisoning attack, especially one distributed across many individually plausible records. The answer is not to abandon ingestion controls. It is to combine them with behavioural evaluation, canary sources, restricted tool authority, and post-deployment monitoring. Defence in depth is necessary precisely because classification at the boundary is imperfect.

Alignment remains useful, but it sits downstream of the decisive architectural choice—whether the system can explain what it learned or retrieved, isolate new evidence, and undo a bad promotion. If provenance is missing and ingestion is irreversible, poisoning has already won the operational argument. The secure unit is not the model checkpoint or vector index. It is the governed path from untrusted source to reversible, inspectable influence.