Revisit training-data poisoning/backdoor experiment

1. 01

   Concepts & system design

   60 min· read · map the mechanismtimer

   R19 — HF Datasets

   R20 — Model Cards

   R45 — NIST AI 100-2 poisoning limits

   Read the assigned sections; map the mechanism, threat model and trade-offs.

2. 02

   Project implementation

   120 min· build · integrate · debugtimer

   Revisit your training-data poisoning experiment (M2) and RAG/vector poisoning controls (D5, D10). Tighten outlier/provenance checks and trigger-detection heuristics.

   Build, integrate, debug and improve the increment in the active project.

3. 03

   Security lab

   60 min· attack your own systemtimer

   Test a subtler poisoning/trigger variant; record exact detection sensitivity, false-positive rates, and the mathematical/practical limits of anomaly detection and retraining.

   Test the abuse case, failure path, authorization bypass or resource limit.

4. 04

   Verification & evidence

   30 min· test · record evidencetimer

   Updated poisoning evaluation report and hardened D5/D10 tests.

   Add or run regression tests; record the 9-point evidence record.

5. 05

   Deliberate practice & Socratic review

   30 min· explain aloud · update gapstimer

   Answer the 8 Socratic questions without notes: What? Why? How? What if? Why not? How can I prove it? Where can it break? What have I learned?

   Re-explain the hardest concept aloud, inspect one edge case, update the gap log.

6. total5 h

• R19Hugging Face Datasets Docs↗ huggingface.co

  Dataset loading, revision pinning, dataset cards, and data provenance tracking.

• R20Model Cards Paper↗ arxiv.org

  Model Cards for Model Reporting (Mitchell et al.): intended use, limitations, training data, and disaggregated evals.

• R45NIST AI 100-2 (Adversarial ML)↗ doi.org

  Adversarial Machine Learning: A Taxonomy and Terminology of Attacks and Mitigations (evasion, poisoning, privacy, abuse).

Read only the named sections needed for today's task. Reading sits inside the 60-minute concepts block; it is not extra time.

• docsNIST · PDF
  Adversarial Machine Learning: A Taxonomy and Terminology of Attacks and Mitigations (NIST AI 100-2e2023)

  The evasion/poisoning/privacy/abuse taxonomy with predictive-integrity and availability framing used as the day's classification scheme.

  R45checked 2026-11-11
• videoSamuel Albanie · 19 min
  Anthropic - AI sleeper agents?

  A paper walkthrough of backdoored models that persist through SFT, RL, and adversarial training, including why adversarial training can teach a model to hide its trigger — directly relevant to why behavioural filters alone fail.

  R45checked 2026-11-11
• videoAutomation Testing with Joe Colantonio · 26 min
  Data Poisoning and Adversarial AI with Dr. Arash Rahnama

  Covers where poisoning enters the pipeline, defensive controls, robustness, and detection tooling in sequence, ending on practical advice for building detection into the data path.

  R45checked 2026-11-11
• articleRed Hat Developer · 12 min read
  Backdoors in LLMs: Why model scanning isn't enough

  Explains why a clean scan says nothing about weights that were never malicious code, then covers activation probes as a runtime backdoor signal with their generalisation caveats.

  R45R20checked 2026-11-11
• docsarXiv (Mitchell et al.) · 10-page paper
  Model Cards for Model Reporting

  The original model-card structure — intended use, limitations, training data, and disaggregated evaluation — which is the provenance record you cite when a poisoned or mis-scoped dataset is the root cause.

  R20checked 2026-11-11

A lab is complete only when it produces evidence. Installing PyRIT, Garak, Presidio or TransformerLens is not completion. Saved on this device only.