Trust grooming is the patient version of data poisoning: an attacker submits genuinely clean data to your training pipeline for weeks or months, earns whatever trust your process grants, and then uses that earned position to deliver poison. The name matters because the strategy is old. Sleeper agents, long-con fraud, and reputation-laundering all work the same way: the asset being built is not access, it is your confidence.
What makes grooming interesting for ML pipelines is that the most common defenses are structurally blind to it. An allowlist, a vendor contract, a one-time security review, a procurement questionnaire: every one of these evaluates a source once and then remembers the verdict forever. Grooming is precisely the attack that passes the evaluation honestly and cashes in later.
Passes onboarding honestly. Every check is real and every answer is true.
Defender: Sees a model citizen.
Submits genuinely clean data. Volume steady, labels accurate.
Defender: Sees an exemplary source earning tiers.
Delivers a small, inspection-clean payload from a trusted position.
Defender: Sees nothing, unless trust can fall as fast as it was spent.
Why the usual defenses miss it
Consider what each standard control sees during the buildup phase. The allowlist sees an approved source. The contract sees a vendor in good standing. Content scanning sees clean samples, because the samples are clean; that is the whole point of the buildup. Statistical dataset checks see nothing either, and recent research explains why they will not save you at the flip: poisoning a model takes a near-constant number of samples, not a percentage of your corpus, and attack samples can look completely normal to inspection. A groomed source does not need to flood you. It needs one good day.
The structural problem is that all of these controls treat trust as a property you check, when grooming exploits the fact that trust is a property that changes. Any defense that evaluates a source at time T and acts on that evaluation at time T plus six months has a six-month blind spot, and the attacker chooses what happens inside it.
The defense: make patience worthless
You cannot prevent grooming, because during the buildup the attacker is, by every observable measure, a good source. Punishing clean data is not a policy. What you can do is destroy the economics: make the asset being built, accumulated trust, decay faster than it can be weaponized.
In Agentiks, every source’s trust score weighs recent behavior exponentially more than history, with a half-life of roughly three weeks. The moment behavior flips, behavioral detectors (statistical drift, label conflicts against independent sources, coordination patterns in embedding space) pull the score down fast, and months of clean history cannot hold it up, because that history has already mostly decayed. The groomed position collapses on the same timescale it took one bad week to reveal, and the attacker’s months of patience buy almost nothing.
One honest boundary: no behavioral system can promise to catch a single small, inspection-clean payload delivered quickly, inside the decay window. Decay’s job against the fast attacker is different: it caps the tier a young source can reach before the flip (new sources start in probation and earn standing on history they have not had time to accumulate), it denies the repeat business, and it stops accumulated reputation from vetoing whatever signal the flip does produce. The patient attack is defeated; the fast attack is contained to a low-trust tier where its data faces the heaviest scrutiny.
Decay alone is not enough, so the scorer carries guardrails tuned to the surrounding failure modes: a source cannot flap across tier boundaries on noise (hysteresis), one detector alone cannot destroy a source (corroboration before conviction), false alarms heal through refunds that are never total, so probing the boundary always costs, and when a ring of fake sources duplicates an honest source’s content to frame it, per-member victim scoring spares the source that got copied. The mechanics are on the platform page; the thresholds are deliberately not published, because a printed threshold is a gaming manual for exactly this adversary.
The question to ask your own pipeline
If a source that passed onboarding eighteen months ago started submitting poison this morning, what in your stack would notice, and when? If the honest answer is a human reviewing a dashboard next quarter, or nothing until a model regresses, then your trust model has the blind spot grooming was designed for. The fix is not a better onboarding review. It is making trust something a source keeps earning, on a clock the attacker cannot outwait.