Study mitigation options

1. 01

   Concepts & system design

   60 min· read · map the mechanismtimer

   R19 — Dataset provenance

   R20 — Model Cards

   R45 — NIST AI 100-2 mitigation limits

   Read the assigned sections; map the mechanism, threat model and trade-offs.

2. 02

   Project implementation

   120 min· build · integrate · debugtimer

   Test poisoning mitigations: dataset provenance checks, deduplication, outlier filtering, clean-checkpoint retraining, and targeted trigger evaluation. Add dataset lineage fields to P2's provenance registry.

   Build, integrate, debug and improve the increment in the active project.

3. 03

   Security lab

   60 min· attack your own systemtimer

   Evaluate how much poisoned data slips past outlier filtering and document why filtering alone cannot prove a trained checkpoint is backdoor-free.

   Test the abuse case, failure path, authorization bypass or resource limit.

4. 04

   Verification & evidence

   30 min· test · record evidencetimer

   Mitigation comparison report and updated dataset lineage schema.

   Add or run regression tests; record the 9-point evidence record.

5. 05

   Deliberate practice & Socratic review

   30 min· explain aloud · update gapstimer

   Answer the 8 Socratic questions without notes: What? Why? How? What if? Why not? How can I prove it? Where can it break? What have I learned?

   Re-explain the hardest concept aloud, inspect one edge case, update the gap log.

6. total5 h

• R19Hugging Face Datasets Docs↗ huggingface.co

  Dataset loading, revision pinning, dataset cards, and data provenance tracking.

• R20Model Cards Paper↗ arxiv.org

  Model Cards for Model Reporting (Mitchell et al.): intended use, limitations, training data, and disaggregated evals.

• R45NIST AI 100-2 (Adversarial ML)↗ doi.org

  Adversarial Machine Learning: A Taxonomy and Terminology of Attacks and Mitigations (evasion, poisoning, privacy, abuse).

Read only the named sections needed for today's task. Reading sits inside the 60-minute concepts block; it is not extra time.

• docsNIST · technical report
  Adversarial Machine Learning: A Taxonomy and Terminology of Attacks and Mitigations

  Its mitigation section separates data filtering and provenance controls from reactive trigger detection, and is explicit about the limits of each, which is what your mitigation matrix should mirror.

  R45checked 2026-11-11
• articlesafeguard.sh · long-form guide
  AI Data Poisoning Defense (2026 Guide)

  Covers deduplication, outlier filtering, provenance attestation and clean-checkpoint retraining as layered defences, the concrete options you test one at a time.

  R45checked 2026-11-11
• videoSecureTechIn · 10 min
  AI Security Lesson 69: AI Backdoor Detection Explained for Teams

  Explains trigger-set evaluation and activation-rate measurement, the targeted check that tells you whether a mitigation actually removed the backdoor rather than hiding it.

  R45R05checked 2026-11-11
• videoSplainers HQ · 9 min
  Why Better AI Training Data Isn't Just More Data | Data | CS336 | L14 Explainer

  Summarises the Stanford CS336 data-curation lecture on deduplication, quality filtering and data mixing, the upstream controls that reduce poisoning surface before training.

  R19checked 2026-11-11
• repoGitHub · library + CLI
  ChenghaoMou/text-dedup: All-in-one text de-duplication

  Implements MinHash/LSH near-duplicate removal you can run over your toy corpus to measure how much duplicate injection a dedup pass removes before retraining.

  R19checked 2026-11-11

A lab is complete only when it produces evidence. Installing PyRIT, Garak, Presidio or TransformerLens is not completion. Saved on this device only.