ATK-022 Data integrity
Supply Chain — Compromised Dataset
Applies to: LLM, Traditional ML, Computer Vision · Last reviewed 2026-05-01
Prerequisites
- Target organization uses third-party datasets for training, fine-tuning, or evaluation.
- Datasets are ingested without provenance verification or content scanning.
Test approach
Defensive assessment: the tester reviews dataset provenance and verification controls. Where authorized, the tester ingests a known-test-poisoned dataset in a non-production training pipeline and observes whether downstream evaluation detects the poison.
Expected evidence
- Dataset provenance records (per AI-CTRL-002).
- Verification configuration evidence.
- Simulated-poisoning detection results.
Detection signals
- Dataset entries from unverified publishers.
- Evaluation metric divergence on canary subsets post-training.
- Dataset additions outside change-controlled paths.
Defensive recommendations
- Verify dataset provenance and apply content scanning before ingestion.
- Hold out canary subsets that detect targeted poisoning at evaluation.
- Reference AI-CTRL-002 (Data Provenance) and AI-CTRL-017 (Evaluation Gates).
Framework mappings
- OWASP LLM Top 10: LLM03:2025
- MITRE ATLAS: AML.T0020
- NIST AI RMF: MAP-2.3, MEASURE-2.10
Related AI Controls Catalog entries
These controls provide the audit test procedures that validate defences against this attack pattern.