LLM04:2025, Data and Model Poisoning is the OWASP Top 10 for LLM Applications entry covering manipulated training data: an integrity attack where samples are planted or altered so the resulting model misbehaves. OWASP scopes it across pre-training, fine-tuning, and embedding, and lists ten prevention strategies. The list is good, and like most top-10 guidance it stops one level above the ground: it says track provenance and detect anomalies, not what component does that, where in the pipeline it sits, or what evidence it should leave behind.
This post is the missing level. It groups OWASP’s mitigations by the pipeline stage where each one actually lives, so you can walk your own architecture and check off what exists, what is missing, and what has no owner.
Stage 1: the source layer
OWASP’s first two strategies, tracking data origins and rigorously vetting vendors, are source-layer controls. The engineering translation: every sample enters attributed to an authenticated source, provenance is recorded at ingestion (it cannot be reconstructed later), and vendor vetting becomes continuous rather than a one-time procurement checkbox, because a source that was clean at contract time can degrade or turn. We wrote the long version of that argument in Trust the source, not the snapshot.
Concrete controls: authenticated source identity, per-source provenance records, a continuously updated per-source trust score, and routing that treats unknown sources as untrusted by default.
Stage 2: the intake layer
Strategies three and five, sandboxing against unverified sources, anomaly detection, and infrastructure controls that stop the model from touching unintended data, live at intake: the boundary where data crosses into your pipeline. The translation is a gate that every sample passes through before it can reach training, issuing an explicit verdict (pass, quarantine, or reject), with anomaly detection running against a clean reference rather than against the incoming stream itself, since a poisoned stream is exactly what you cannot trust to define normal.
Concrete controls: a single enforced ingestion path, per-sample content checks in embedding space (a representation where similar content sits close together, which makes coordinated near-duplicates and drift visible as shape), a quarantine queue, and fail-closed behavior when a check cannot run.
Stage 3: the training-set layer
Strategies four, six, and seven, task-specific datasets, data version control, and vector-database isolation of user-supplied content, govern the assembled corpus. The translation: dataset composition is pinned and versioned (OWASP names DVC as the tool class), a machine-readable bill of materials (an ML-BOM, which OWASP CycloneDX standardizes) records what went into each training run, and user-supplied content stays in retrieval systems where it can be corrected without retraining.
Concrete controls: versioned dataset manifests, a generated ML-BOM per training run, and a hard boundary between curated training corpora and user-generated content.
Stage 4: the model layer
Strategies eight and nine, red-team campaigns and monitoring training loss for anomalies, are model-layer verification: catching what upstream controls missed. Honest framing from the detection literature: by the time poison is visible here, it has already been trained in, and backdoors are built to pass standard evaluation. This layer is your net, not your gate.
Concrete controls: adversarial evaluation against known attack families, loss-curve anomaly monitoring with thresholds, and behavioral regression suites run before promotion.
Stage 5: the evidence layer
OWASP’s provenance strategy carries an implication that is easy to miss: origin tracking is only useful if the record cannot be quietly rewritten, because the first thing a competent attacker edits is the log. The translation is an append-only, hash-chained audit trail with signed checkpoints and offline verification, exporting attestations in the formats supply-chain tooling reads. We covered the full construction in A tamper-evident audit trail, without a blockchain.
One scoping note for completeness: OWASP’s tenth strategy, retrieval-augmented generation and grounding at inference time, is an output-side mitigation. It reduces the blast radius of a poisoned model; it does not keep poison out of one. Both matter, and they are different projects with different owners.
Where Agentiks sits
Agentiks implements stages one, two, and five as a self-hosted layer in your own cluster: continuous source trust scoring, per-sample verdicts at intake, and the tamper-evident evidence trail with standard-format attestations. It supports the provenance, vetting, anomaly-detection, and record-keeping strategies on OWASP’s list; dataset versioning and model-layer red-teaming remain your side of the map. No single tool covers all five stages, and any vendor claiming otherwise is reading the list too quickly.