Prevention, not forensics
Poisoned samples never reach training.
The real-time gate on the left blocks bad data inline, in under a second, before a single corrupted sample enters the dataset. The aggregate layers on the right run retrospectively — not to clean up after an incident, but to catch slower threats the gate alone can't see, and retroactively pull them back out.
The platform
Six specialists.
One composable verdict.
Each layer contributes evidence to a single attested decision per sample — PASS, QUARANTINE, or REJECT — under a tier-aware, first-match-wins policy.
Explore the platformProvenance
Every sample is fingerprinted and attributed at the ingestion boundary. A tier-aware, first-match rule policy decides PASS, QUARANTINE, or REJECT before anything downstream runs.
Statistical
Population-level evidence — drift, per-class density, outlier clusters — feeds the same verdict shape. Catches shifts that are invisible at the sample level.
Adversarial
Robustness probes run only against samples the earlier layers flag as uncertain. Composes into the verdict rather than duplicating work.
Semantic
Compares what a sample says against what its label claims. Disagreement escalates to QUARANTINE; strong cross-modal inconsistency can REJECT.
Consensus
Peer-source disagreement weighed against trust tier — trusted, standard, untrusted, probation. Cohort evidence can override a lone PASS upstream.
Forensic
Every verdict is signed with a deterministic decision ID. The stack the others are attested to — investigable and replayable end-to-end.
The learning loop
Every verdict makes the next one sharper.
We maintain an in-house verdict model that retrains continuously on the signals every layer produces. New attack patterns get encoded into the stack within hours, not quarters.
See how it worksThe threat surface
Poisoning isn't one attack.
It's a family of them.
Wrong labels on clean samples
Flipped, mis-mapped, or backdoor-triggered labels shift the decision boundary. The sample looks valid; the class assignment is poisoned.
Poison without touching the label
Adversarially crafted inputs with correct-looking labels that still steer the model. The most insidious family — standard label audits miss them entirely.
Embedded triggers in training data
A hidden pattern that activates only in production, causing controlled misclassification. Models trained on triggered data test fine in dev.
Coordinated identity poisoning
One actor, many sources. Per-source rate limits do nothing when every source is the same attacker wearing different hats.