[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AEBQ753P7VTSA216NSCAPC":3,"skill-same:01M6AEBQ753P7VTSA216NSCAPC":107},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":28,"publishedAt":49,"linkOnly":50,"markdownContent":51,"markdownBody":52,"frontMatter":53,"refName":62,"commitSha":63,"skillDirectory":64,"forksCount":65,"repositoryHtmlUrl":66,"repositoryHomepageUrl":67,"ownerHtmlUrl":68,"ownerBlogUrl":69,"ownerDescription":70,"updatedAt":71,"install":72,"resources":85},"01M6AEBQ753P7VTSA216NSCAPC","detecting-data-and-model-poisoning",null,"Identify poisoned training data and backdoored ML models across the pipeline using IBM's Adversarial Robustness Toolbox (activation clustering, spectral signatures, trigger reconstruction), Cleanlab for label-quality issues, and supply-chain checks like weight-hash verification and safetensors enforcement. Use before training or deploying on third-party\u002Fuser-contributed data or downloaded checkpoints, during ML supply-chain reviews, or when investigating model misbehavior tied to specific inputs (suspected backdoor trigger).","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",35884,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-data-and-model-poisoning\u002FSKILL.md",[18,23],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":26,"taxonomyTypeDesc":27},"01JBSEEDCAT000000000000033","数据分析师","PROFESSION","适用职业",[29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48],"detecting data and model poisoning","data","pipeline","model-integrity","spectral-signatures","activation-clustering","adversarial-robustness-toolbox","ml-supply-chain","model-backdoor","ibm","clustering","security","data-poisoning","ai-security","supply-chain","verification","issues","training","ml","cybersecurity","2026-11-10 10:12:30",false,"---\nname: detecting-data-and-model-poisoning\ndescription: Identify poisoned training data and backdoored ML models across the pipeline using IBM's Adversarial Robustness Toolbox (activation clustering, spectral signatures, trigger reconstruction), Cleanlab for label-quality issues, and supply-chain checks like weight-hash verification and safetensors enforcement. Use before training or deploying on third-party\u002Fuser-contributed data or downloaded checkpoints, during ML supply-chain reviews, or when investigating model misbehavior tied to specific inputs (suspected backdoor trigger).\ndomain: cybersecurity\nsubdomain: ai-security\ntags:\n- ai-security\n- data-poisoning\n- model-backdoor\n- ml-supply-chain\n- adversarial-robustness-toolbox\n- activation-clustering\n- spectral-signatures\n- model-integrity\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_ai_rmf:\n- MEASURE-2.7\natlas_techniques:\n- AML.T0020\n- AML.T0018\n---\n# Detecting Data and Model Poisoning\n\n> **Authorized-use-only notice:** This skill includes routines that craft poisoned samples and backdoor triggers for *defensive validation*. Generate and use poisoned data and backdoored models only in isolated test environments you control. Never deploy a backdoored model or distribute poisoned datasets.\n\n## Overview\n\nData poisoning and model backdooring attack the *integrity* of an ML system at training time rather than at inference. In **data poisoning** (MITRE ATLAS **AML.T0020 Poison Training Data**), an adversary injects manipulated samples into the training, fine-tuning, or RAG corpus so the resulting model misbehaves — degraded accuracy, targeted misclassification, or an attacker-chosen bias. In **model backdooring** (MITRE ATLAS **AML.T0018 Backdoor ML Model**), the model behaves normally on clean inputs but produces an attacker-chosen output whenever a hidden *trigger* (a pixel patch, a rare token, a phrase) is present. Both are amplified by **ML supply-chain compromise (AML.T0010)**: poisoned public datasets, trojaned pre-trained weights downloaded from a hub, or a malicious model serialization. This is OWASP **LLM04:2025 Data and Model Poisoning**.\n\nDetection spans the pipeline. On the *data* side: provenance and integrity checks, statistical outlier and label-flip detection, and de-duplication of suspiciously near-identical samples. On the *model* side: activation-clustering and spectral-signature analysis (which exploit the fact that poisoned samples activate the network differently than clean ones) and trigger reconstruction. On the *supply-chain* side: verifying weights hashes\u002Fsignatures and refusing unsafe serialization formats (pickle-based `.bin`\u002F`.pt`) in favor of safetensors. This skill implements all three using IBM's **Adversarial Robustness Toolbox (ART)**, **Cleanlab** for label-quality issues, and integrity tooling.\n\n## When to Use\n\n- Before training\u002Ffine-tuning on third-party or user-contributed data.\n- Before deploying a model built on a downloaded pre-trained checkpoint.\n- During an ML supply-chain security review.\n- When investigating anomalous model behavior tied to specific inputs (possible backdoor trigger).\n- As a CI\u002FCD gate that scans datasets and model artifacts before they enter the pipeline.\n\n## Prerequisites\n\n- Python 3.10+ and a virtual environment.\n- Install the tooling:\n\n```bash\npython -m venv .venv && source .venv\u002Fbin\u002Factivate\n\n# IBM Adversarial Robustness Toolbox — poisoning detection defenses\npip install adversarial-robustness-toolbox\n\n# Cleanlab — label\u002Fdata quality issue detection\npip install cleanlab\n\n# Modeling + safe serialization + hashing\npip install numpy scikit-learn safetensors\n\n# (Choose one framework backend ART can wrap)\npip install tensorflow   # or: pip install torch\n```\n\n## Objectives\n\n- Verify dataset and model-weight provenance and integrity (hashes\u002Fsignatures, safe formats).\n- Detect label-quality issues and outliers in training data with Cleanlab.\n- Detect poisoned samples in a trained model using ART activation clustering.\n- Confirm findings with ART spectral-signature analysis.\n- Probe a suspect model for backdoor triggers and quantify trigger-induced misclassification.\n- Produce a poisoning-assessment report mapped to ATLAS AML.T0020 \u002F AML.T0018.\n\n## MITRE ATT&CK Mapping\n\n| ID | Official Name | Relevance |\n|----|---------------|-----------|\n| AML.T0020 | Poison Training Data | Injection of manipulated samples into the training corpus |\n| AML.T0018 | Backdoor ML Model | Trigger-activated hidden behavior in the trained model |\n| AML.T0010 | ML Supply Chain Compromise | Poisoned public datasets \u002F trojaned downloaded weights |\n| AML.T0024 | Exfiltration via ML Inference API | Some poisoning aims to leak data via the model's responses |\n\n## Workflow\n\n### 1. Verify data and model provenance\u002Fintegrity\nRefuse artifacts whose hash\u002Fsignature you cannot verify, and prefer safetensors over pickle-based formats (pickle can execute code on load).\n\n```bash\n# Verify a downloaded checkpoint against a published SHA-256\nsha256sum model.safetensors\n# compare to the hub-published digest\n\n# Flag unsafe pickle-based weights in a directory\nfind .\u002Fmodels -type f \\( -name \"*.bin\" -o -name \"*.pt\" -o -name \"*.pkl\" -o -name \"*.ckpt\" \\)\n```\n\n```python\n# safe_load.py — load weights without executing pickle\nfrom safetensors.numpy import load_file\nweights = load_file(\"model.safetensors\")   # no arbitrary code execution\n```\n\n### 2. Detect label\u002Fdata-quality issues with Cleanlab\nCleanlab finds mislabeled, outlier, and near-duplicate samples — common signatures of label-flip poisoning.\n\n```python\n# cleanlab_scan.py\nimport numpy as np\nfrom cleanlab.filter import find_label_issues\n\n# pred_probs: out-of-sample predicted probabilities (n_samples x n_classes)\n# labels: given integer labels (n_samples,)\ndef scan(labels: np.ndarray, pred_probs: np.ndarray):\n    issues = find_label_issues(\n        labels=labels, pred_probs=pred_probs,\n        return_indices_ranked_by=\"self_confidence\",\n    )\n    print(f\"[*] {len(issues)} suspected label issues (potential poisoning)\")\n    return issues\n```\n\n### 3. Detect poisoned samples via ART activation clustering\nActivationDefence clusters per-class activations; a class whose activations split into two distinct clusters indicates injected (poisoned) samples.\n\n```python\n# activation_defence.py\nimport numpy as np\nfrom art.estimators.classification import KerasClassifier\nfrom art.defences.detector.poison import ActivationDefence\n\ndef detect(model, x_train, y_train):\n    classifier = KerasClassifier(model=model)          # wrap your trained model\n    defence = ActivationDefence(classifier, x_train, y_train)\n    report, is_clean_lst = defence.detect_poison(\n        nb_clusters=2, nb_dims=10, reduce=\"PCA\"\n    )\n    # is_clean_lst[i] == 0 marks a suspected poisoned sample\n    poisoned_idx = np.where(np.array(is_clean_lst) == 0)[0]\n    print(f\"[*] activation clustering flagged {len(poisoned_idx)} samples\")\n    return poisoned_idx, report\n```\n\n### 4. Confirm with ART spectral signatures\nSpectral signatures use the covariance spectrum of feature representations to surface poisoned samples — a strong second signal.\n\n```python\n# spectral.py\nimport numpy as np\nfrom art.estimators.classification import KerasClassifier\nfrom art.defences.detector.poison import SpectralSignatureDefense\n\ndef detect(model, x_train, y_train, nb_classes):\n    classifier = KerasClassifier(model=model)\n    defence = SpectralSignatureDefense(\n        classifier, x_train, y_train,\n        expected_pp_poison=0.05, batch_size=128, eps_multiplier=1.5,\n    )\n    report, is_clean_lst = defence.detect_poison()\n    poisoned_idx = np.where(np.array(is_clean_lst) == 0)[0]\n    print(f\"[*] spectral signatures flagged {len(poisoned_idx)} samples\")\n    return poisoned_idx, report\n```\n\n### 5. Probe the model for backdoor triggers\nTest whether a candidate trigger flips predictions to an attacker target class far above the clean baseline.\n\n```python\n# trigger_probe.py\nimport numpy as np\n\ndef test_trigger(model, x_clean, target_class, apply_trigger):\n    \"\"\"apply_trigger(x) stamps a candidate trigger (e.g. a corner pixel patch).\"\"\"\n    clean_preds = model.predict(x_clean).argmax(axis=1)\n    x_trig = np.stack([apply_trigger(x.copy()) for x in x_clean])\n    trig_preds = model.predict(x_trig).argmax(axis=1)\n    asr = float(np.mean(trig_preds == target_class))   # attack success rate\n    base = float(np.mean(clean_preds == target_class))\n    print(f\"[*] target-class rate clean={base:.3f} triggered={asr:.3f}\")\n    return {\"baseline\": base, \"trigger_success_rate\": asr,\n            \"backdoor_suspected\": asr - base > 0.5}\n```\n\n### 6. Quarantine, retrain, and report\nRemove flagged samples (intersection of Cleanlab + ART signals is highest-confidence), retrain on the cleaned set, and re-test for the trigger. Document: artifact provenance, samples flagged by each method, trigger ASR before\u002Fafter, and ATLAS mapping. Recommend dataset provenance controls, signed weights (safetensors + sigstore\u002Fcosign), and ongoing pipeline scanning.\n\n## Tools and Resources\n\n| Tool | Purpose | Source |\n|------|---------|--------|\n| Adversarial Robustness Toolbox | Activation clustering & spectral-signature poisoning defenses | https:\u002F\u002Fgithub.com\u002FTrusted-AI\u002Fadversarial-robustness-toolbox |\n| Cleanlab | Label\u002Fdata-quality issue detection | https:\u002F\u002Fgithub.com\u002Fcleanlab\u002Fcleanlab |\n| safetensors | Safe (non-pickle) weight serialization | https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Fsafetensors |\n| OWASP LLM04:2025 | Data and Model Poisoning reference | https:\u002F\u002Fgenai.owasp.org\u002Fllmrisk\u002Fllm042025-data-and-model-poisoning\u002F |\n| MITRE ATLAS | AI threat technique taxonomy | https:\u002F\u002Fatlas.mitre.org\u002F |\n\n## Detection Method Reference\n\n| Layer | Method | Tool | Signal |\n|-------|--------|------|--------|\n| Supply chain | Hash\u002Fsignature + safe format | sha256\u002Fsafetensors | Tampered or unsafe artifact |\n| Data | Label issues \u002F outliers | Cleanlab | Mislabeled \u002F injected samples |\n| Model | Activation clustering | ART ActivationDefence | Per-class activation split |\n| Model | Spectral signatures | ART SpectralSignatureDefense | Outlier covariance spectrum |\n| Model | Trigger probing | custom | High trigger attack-success-rate |\n\n## Validation Criteria\n\n- [ ] Dataset and weight provenance\u002Fintegrity verified (hashes, safe format)\n- [ ] Unsafe pickle-based artifacts identified and avoided\n- [ ] Cleanlab label-issue scan run and suspicious samples listed\n- [ ] ART activation clustering executed with flagged sample indices\n- [ ] ART spectral-signature analysis run as confirmation\n- [ ] Backdoor trigger probe quantifies attack-success-rate vs. baseline\n- [ ] Highest-confidence poisoned samples quarantined (multi-method overlap)\n- [ ] Model retrained on cleaned data and re-tested for the trigger\n- [ ] Findings mapped to MITRE ATLAS AML.T0020 \u002F AML.T0018 and OWASP LLM04:2025\n- [ ] Report delivered with remediation (provenance, signed weights, pipeline scanning)\n","# Detecting Data and Model Poisoning\n\n> **Authorized-use-only notice:** This skill includes routines that craft poisoned samples and backdoor triggers for *defensive validation*. Generate and use poisoned data and backdoored models only in isolated test environments you control. Never deploy a backdoored model or distribute poisoned datasets.\n\n## Overview\n\nData poisoning and model backdooring attack the *integrity* of an ML system at training time rather than at inference. In **data poisoning** (MITRE ATLAS **AML.T0020 Poison Training Data**), an adversary injects manipulated samples into the training, fine-tuning, or RAG corpus so the resulting model misbehaves — degraded accuracy, targeted misclassification, or an attacker-chosen bias. In **model backdooring** (MITRE ATLAS **AML.T0018 Backdoor ML Model**), the model behaves normally on clean inputs but produces an attacker-chosen output whenever a hidden *trigger* (a pixel patch, a rare token, a phrase) is present. Both are amplified by **ML supply-chain compromise (AML.T0010)**: poisoned public datasets, trojaned pre-trained weights downloaded from a hub, or a malicious model serialization. This is OWASP **LLM04:2025 Data and Model Poisoning**.\n\nDetection spans the pipeline. On the *data* side: provenance and integrity checks, statistical outlier and label-flip detection, and de-duplication of suspiciously near-identical samples. On the *model* side: activation-clustering and spectral-signature analysis (which exploit the fact that poisoned samples activate the network differently than clean ones) and trigger reconstruction. On the *supply-chain* side: verifying weights hashes\u002Fsignatures and refusing unsafe serialization formats (pickle-based `.bin`\u002F`.pt`) in favor of safetensors. This skill implements all three using IBM's **Adversarial Robustness Toolbox (ART)**, **Cleanlab** for label-quality issues, and integrity tooling.\n\n## When to Use\n\n- Before training\u002Ffine-tuning on third-party or user-contributed data.\n- Before deploying a model built on a downloaded pre-trained checkpoint.\n- During an ML supply-chain security review.\n- When investigating anomalous model behavior tied to specific inputs (possible backdoor trigger).\n- As a CI\u002FCD gate that scans datasets and model artifacts before they enter the pipeline.\n\n## Prerequisites\n\n- Python 3.10+ and a virtual environment.\n- Install the tooling:\n\n```bash\npython -m venv .venv && source .venv\u002Fbin\u002Factivate\n\n# IBM Adversarial Robustness Toolbox — poisoning detection defenses\npip install adversarial-robustness-toolbox\n\n# Cleanlab — label\u002Fdata quality issue detection\npip install cleanlab\n\n# Modeling + safe serialization + hashing\npip install numpy scikit-learn safetensors\n\n# (Choose one framework backend ART can wrap)\npip install tensorflow   # or: pip install torch\n```\n\n## Objectives\n\n- Verify dataset and model-weight provenance and integrity (hashes\u002Fsignatures, safe formats).\n- Detect label-quality issues and outliers in training data with Cleanlab.\n- Detect poisoned samples in a trained model using ART activation clustering.\n- Confirm findings with ART spectral-signature analysis.\n- Probe a suspect model for backdoor triggers and quantify trigger-induced misclassification.\n- Produce a poisoning-assessment report mapped to ATLAS AML.T0020 \u002F AML.T0018.\n\n## MITRE ATT&CK Mapping\n\n| ID | Official Name | Relevance |\n|----|---------------|-----------|\n| AML.T0020 | Poison Training Data | Injection of manipulated samples into the training corpus |\n| AML.T0018 | Backdoor ML Model | Trigger-activated hidden behavior in the trained model |\n| AML.T0010 | ML Supply Chain Compromise | Poisoned public datasets \u002F trojaned downloaded weights |\n| AML.T0024 | Exfiltration via ML Inference API | Some poisoning aims to leak data via the model's responses |\n\n## Workflow\n\n### 1. Verify data and model provenance\u002Fintegrity\nRefuse artifacts whose hash\u002Fsignature you cannot verify, and prefer safetensors over pickle-based formats (pickle can execute code on load).\n\n```bash\n# Verify a downloaded checkpoint against a published SHA-256\nsha256sum model.safetensors\n# compare to the hub-published digest\n\n# Flag unsafe pickle-based weights in a directory\nfind .\u002Fmodels -type f \\( -name \"*.bin\" -o -name \"*.pt\" -o -name \"*.pkl\" -o -name \"*.ckpt\" \\)\n```\n\n```python\n# safe_load.py — load weights without executing pickle\nfrom safetensors.numpy import load_file\nweights = load_file(\"model.safetensors\")   # no arbitrary code execution\n```\n\n### 2. Detect label\u002Fdata-quality issues with Cleanlab\nCleanlab finds mislabeled, outlier, and near-duplicate samples — common signatures of label-flip poisoning.\n\n```python\n# cleanlab_scan.py\nimport numpy as np\nfrom cleanlab.filter import find_label_issues\n\n# pred_probs: out-of-sample predicted probabilities (n_samples x n_classes)\n# labels: given integer labels (n_samples,)\ndef scan(labels: np.ndarray, pred_probs: np.ndarray):\n    issues = find_label_issues(\n        labels=labels, pred_probs=pred_probs,\n        return_indices_ranked_by=\"self_confidence\",\n    )\n    print(f\"[*] {len(issues)} suspected label issues (potential poisoning)\")\n    return issues\n```\n\n### 3. Detect poisoned samples via ART activation clustering\nActivationDefence clusters per-class activations; a class whose activations split into two distinct clusters indicates injected (poisoned) samples.\n\n```python\n# activation_defence.py\nimport numpy as np\nfrom art.estimators.classification import KerasClassifier\nfrom art.defences.detector.poison import ActivationDefence\n\ndef detect(model, x_train, y_train):\n    classifier = KerasClassifier(model=model)          # wrap your trained model\n    defence = ActivationDefence(classifier, x_train, y_train)\n    report, is_clean_lst = defence.detect_poison(\n        nb_clusters=2, nb_dims=10, reduce=\"PCA\"\n    )\n    # is_clean_lst[i] == 0 marks a suspected poisoned sample\n    poisoned_idx = np.where(np.array(is_clean_lst) == 0)[0]\n    print(f\"[*] activation clustering flagged {len(poisoned_idx)} samples\")\n    return poisoned_idx, report\n```\n\n### 4. Confirm with ART spectral signatures\nSpectral signatures use the covariance spectrum of feature representations to surface poisoned samples — a strong second signal.\n\n```python\n# spectral.py\nimport numpy as np\nfrom art.estimators.classification import KerasClassifier\nfrom art.defences.detector.poison import SpectralSignatureDefense\n\ndef detect(model, x_train, y_train, nb_classes):\n    classifier = KerasClassifier(model=model)\n    defence = SpectralSignatureDefense(\n        classifier, x_train, y_train,\n        expected_pp_poison=0.05, batch_size=128, eps_multiplier=1.5,\n    )\n    report, is_clean_lst = defence.detect_poison()\n    poisoned_idx = np.where(np.array(is_clean_lst) == 0)[0]\n    print(f\"[*] spectral signatures flagged {len(poisoned_idx)} samples\")\n    return poisoned_idx, report\n```\n\n### 5. Probe the model for backdoor triggers\nTest whether a candidate trigger flips predictions to an attacker target class far above the clean baseline.\n\n```python\n# trigger_probe.py\nimport numpy as np\n\ndef test_trigger(model, x_clean, target_class, apply_trigger):\n    \"\"\"apply_trigger(x) stamps a candidate trigger (e.g. a corner pixel patch).\"\"\"\n    clean_preds = model.predict(x_clean).argmax(axis=1)\n    x_trig = np.stack([apply_trigger(x.copy()) for x in x_clean])\n    trig_preds = model.predict(x_trig).argmax(axis=1)\n    asr = float(np.mean(trig_preds == target_class))   # attack success rate\n    base = float(np.mean(clean_preds == target_class))\n    print(f\"[*] target-class rate clean={base:.3f} triggered={asr:.3f}\")\n    return {\"baseline\": base, \"trigger_success_rate\": asr,\n            \"backdoor_suspected\": asr - base > 0.5}\n```\n\n### 6. Quarantine, retrain, and report\nRemove flagged samples (intersection of Cleanlab + ART signals is highest-confidence), retrain on the cleaned set, and re-test for the trigger. Document: artifact provenance, samples flagged by each method, trigger ASR before\u002Fafter, and ATLAS mapping. Recommend dataset provenance controls, signed weights (safetensors + sigstore\u002Fcosign), and ongoing pipeline scanning.\n\n## Tools and Resources\n\n| Tool | Purpose | Source |\n|------|---------|--------|\n| Adversarial Robustness Toolbox | Activation clustering & spectral-signature poisoning defenses | https:\u002F\u002Fgithub.com\u002FTrusted-AI\u002Fadversarial-robustness-toolbox |\n| Cleanlab | Label\u002Fdata-quality issue detection | https:\u002F\u002Fgithub.com\u002Fcleanlab\u002Fcleanlab |\n| safetensors | Safe (non-pickle) weight serialization | https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Fsafetensors |\n| OWASP LLM04:2025 | Data and Model Poisoning reference | https:\u002F\u002Fgenai.owasp.org\u002Fllmrisk\u002Fllm042025-data-and-model-poisoning\u002F |\n| MITRE ATLAS | AI threat technique taxonomy | https:\u002F\u002Fatlas.mitre.org\u002F |\n\n## Detection Method Reference\n\n| Layer | Method | Tool | Signal |\n|-------|--------|------|--------|\n| Supply chain | Hash\u002Fsignature + safe format | sha256\u002Fsafetensors | Tampered or unsafe artifact |\n| Data | Label issues \u002F outliers | Cleanlab | Mislabeled \u002F injected samples |\n| Model | Activation clustering | ART ActivationDefence | Per-class activation split |\n| Model | Spectral signatures | ART SpectralSignatureDefense | Outlier covariance spectrum |\n| Model | Trigger probing | custom | High trigger attack-success-rate |\n\n## Validation Criteria\n\n- [ ] Dataset and weight provenance\u002Fintegrity verified (hashes, safe format)\n- [ ] Unsafe pickle-based artifacts identified and avoided\n- [ ] Cleanlab label-issue scan run and suspicious samples listed\n- [ ] ART activation clustering executed with flagged sample indices\n- [ ] ART spectral-signature analysis run as confirmation\n- [ ] Backdoor trigger probe quantifies attack-success-rate vs. baseline\n- [ ] Highest-confidence poisoned samples quarantined (multi-method overlap)\n- [ ] Model retrained on cleaned data and re-tested for the trigger\n- [ ] Findings mapped to MITRE ATLAS AML.T0020 \u002F AML.T0018 and OWASP LLM04:2025\n- [ ] Report delivered with remediation (provenance, signed weights, pipeline scanning)\n",{"name":5,"tags":54,"author":55,"domain":48,"license":15,"version":56,"subdomain":42,"description":7,"nist_ai_rmf":57,"atlas_techniques":59},[42,41,37,36,35,34,33,32],"mahipal","1.0",[58],"MEASURE-2.7",[60,61],"AML.T0020","AML.T0018","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fdetecting-data-and-model-poisoning",4379,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":73,"prompt":83,"zipAvailable":84},[74,77,80],{"tool":75,"command":76},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill detecting-data-and-model-poisoning",{"tool":78,"command":79},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill detecting-data-and-model-poisoning",{"tool":81,"command":82},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill detecting-data-and-model-poisoning","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-data-and-model-poisoning\u002FSKILL.md",true,[86,91,97,101],{"path":87,"resourceType":87,"resourceTypeDesc":88,"sizeBytes":89,"sourceHtmlUrl":90},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-data-and-model-poisoning\u002FLICENSE",{"path":92,"resourceType":93,"resourceTypeDesc":94,"sizeBytes":95,"sourceHtmlUrl":96},"references\u002Fapi-reference.md","REFERENCE","参考文档",2228,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-data-and-model-poisoning\u002Freferences\u002Fapi-reference.md",{"path":98,"resourceType":93,"resourceTypeDesc":94,"sizeBytes":99,"sourceHtmlUrl":100},"references\u002Fstandards.md",1674,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-data-and-model-poisoning\u002Freferences\u002Fstandards.md",{"path":102,"resourceType":103,"resourceTypeDesc":104,"sizeBytes":105,"sourceHtmlUrl":106},"scripts\u002Fagent.py","SCRIPT","脚本",5033,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-data-and-model-poisoning\u002Fscripts\u002Fagent.py",[108,132,155,183,208,235],{"skillNo":109,"name":110,"nameZh":6,"description":111,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":112,"categories":113,"keywords":115,"publishedAt":49},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[114],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[116,117,118,119,40,48,120,121,122,123,124,125,43,31,126,127,128,129,130,131],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","incident response","identity","pr","code","artifacts","ci","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":133,"name":134,"nameZh":6,"description":135,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":136,"categories":137,"keywords":139,"publishedAt":49},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[138],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[140,128,141,142,40,143,48,122,44,144,145,146,147,148,149,150,151,152,153,154],"boot","TPM","validating tpm measured boot attestation","policy","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":156,"name":157,"nameZh":6,"description":158,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":159,"categories":160,"keywords":165,"publishedAt":49},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[161,164],{"categoryNo":162,"categoryName":163,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[149,166,167,168,169,48,170,171,44,172,173,174,175,176,177,178,179,180,181,182],"backup","recovery","validating backup integrity for recovery","testing","infrastructure","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1078","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":184,"name":185,"nameZh":6,"description":186,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":187,"categories":188,"keywords":190,"publishedAt":49},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[189],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[191,192,193,48,194,195,196,197,198,199,200,30,201,202,203,204,146,205,206,207],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":209,"name":210,"nameZh":6,"description":211,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":212,"categories":213,"keywords":215,"publishedAt":49},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[214],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[216,217,218,48,219,220,221,222,223,224,225,226,227,228,229,230,231,232,233,234],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":236,"name":237,"nameZh":6,"description":238,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":239,"categories":240,"keywords":242,"publishedAt":49},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[241],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[40,243,48,244,245,246,247,248,249,250,251,178,252,179,253,254,255,256,257,258],"triaging security incident","siem","file","ioc","soc","NIST-800-61","NIST","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]