Implementation guide
OWASP AISVS v1.01
Training Data Integrity & Traceability · Training Data Quality and Security Assurance
Defend against clean-label poisoning
Verify that defenses against clean-label poisoning attacks are implemented.
OWASP AISVS v1.01, requirement 1.3.5
In plain English
Defend against poisoning where the planted records look correctly labelled, so label review will not catch them. The attacker makes small changes to the content that teach the model a hidden trigger or a wrong association. This is a Level 3 control for models that train on data outsiders can influence.
What good looks like
- The pipeline uses at least one defence designed for clean-label poisoning, and the choice is written down.
- Data from less trusted sources is kept separate and gets extra review or a lower weight.
- The defence has been tested against a simulated attack on your own data and model.
- Results are rechecked when the model architecture or data sources change.
How teams usually do it
- Detection based on how examples look inside the model, such as activation clustering or spectral signatures. The Adversarial Robustness Toolbox has implementations of both.
- Training methods that cap the influence of any small group of examples: differentially private training (DP-SGD), strong data augmentation or training on an ensemble of data partitions.
- Limiting how much of any training batch may come from untrusted sources.
Suggested evidence
- The chosen defence and the reasoning for it.
- Results from a simulated clean-label attack, with and without the defence.
- The rule that separates trusted from untrusted sources.
Common mistakes
- Assuming human label review covers this attack. The labels are correct, which is the point of it.
- Mixing data from unknown sources with trusted data and losing track of which is which.
- Testing against one published attack and treating the result as general.
Not sure which requirements apply to your system? Take the assessment, or browse every guide in this chapter.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.