Catch a poisoned training set and pin the artefacts

Steps

1. Write lab/make-train.py. It writes 1,000 rows in five batches of 200 to lab/train.csv, seeds three faults, and records the seeded rows in lab/.truth.json, the answer key the Verify block reads.

import csv, json, random

random.seed(18)
LABELS = ["billing", "technical", "account"]
OPENERS = ["Hi", "Hello", "Please help", "Quick question", "Urgent"]
OBJECTS = ["my invoice", "the mobile app", "my profile", "the card payment",
           "the login page", "my subscription"]
PROBLEMS = ["is wrong", "will not load", "is locked", "failed today",
            "looks different", "needs changing"]
COMBOS = [(o, p) for o in range(6) for p in range(6)]


def label_of(o, p):
    # The label is a fixed rule of object and problem, so no single word predicts it.
    return LABELS[(o + p) % 3]


def text_of(opener, o, p):
    return opener + ": " + OBJECTS[o] + " " + PROBLEMS[p]


rows = []
for n in range(1, 1001):
    batch = (n - 1) // 200 + 1
    if batch < 5:
        o, p = random.choice(COMBOS)
    else:
        # the late batch: class balance drifts towards billing
        want = random.choices(LABELS, weights=[65, 20, 15])[0]
        o, p = random.choice([c for c in COMBOS if label_of(*c) == want])
    rows.append({"row_id": n, "batch": batch,
                 "text": text_of(random.choice(OPENERS), o, p), "label": label_of(o, p)})

# Fault 1: near-duplicate rows carrying a trigger token, always labelled billing
bases = [c for c in COMBOS if label_of(*c) != "billing"][:3]
flipped = list(range(431, 471))
spots = [i for i in range(201, 801) if i not in flipped]
trigger = sorted(random.sample(spots, 30))
for row_id in trigger:
    o, p = random.choice(bases)
    rows[row_id - 1]["text"] = text_of(random.choice(OPENERS), o, p) + " zq-trigger"
    rows[row_id - 1]["label"] = "billing"

# Fault 2: a block of rows copied from other rows with their labels flipped
counts = {}
for r in rows:
    if r["row_id"] not in flipped and r["row_id"] not in trigger:
        counts[r["text"]] = counts.get(r["text"], 0) + 1
donors = random.sample(sorted(t for t, n in counts.items() if n >= 2), 40)
for row_id, text in zip(flipped, donors):
    good = next(r["label"] for r in rows if r["text"] == text and r["row_id"] not in flipped)
    rows[row_id - 1]["text"] = text
    rows[row_id - 1]["label"] = LABELS[(LABELS.index(good) + 1) % 3]

with open("lab/train.csv", "w", newline="") as f:
    w = csv.DictWriter(f, fieldnames=["row_id", "batch", "text", "label"])
    w.writeheader()
    w.writerows(rows)
with open("lab/.truth.json", "w") as f:
    json.dump({"flipped": flipped, "trigger": trigger, "drift_batch": 5}, f)
print(len(rows), "rows written to lab/train.csv")

Run it, and do not open lab/.truth.json: a check written after reading the answer key proves nothing about the next dataset. 2. Find the weights file. With llama.cpp it is the .gguf file you downloaded; with Ollama, ollama show --modelfile <model> prints a FROM line with the path of the weights blob, whose file name already holds its SHA-256 digest. Set MODEL_FILE to that path. 3. Write the manifest with sha256sum lab/train.csv "$MODEL_FILE" > lab/manifest.sha256 and check it with sha256sum -c lab/manifest.sha256. For an Ollama blob, compare the digest in the file name with the one in the manifest. If the weights file is readable only by the runner's account, run both commands with sudo, here and in Verify. 4. Write lab/provenance.json with five keys: name (the model as your runner names it), source (the publisher and the page you obtained it from), sha256 (the digest from your manifest), licence (the licence's actual name, from the model card) and retrieved (the date you pulled it, as YYYY-MM-DD). This is the lineage record the lesson asks for: when a base model is later found to be compromised, this file says whether you inherited it. 5. Write lab/data-checks.py, which takes the CSV path as its argument and prints one JSON object with five keys. conflict_rows: normalise each text (lower case, whitespace collapsed), group identical texts, and in every group holding more than one label list the row_ids whose label is not the group's most common. pure_tokens: split texts into lower-case words with surrounding punctuation stripped; for every token in at least ten rows, compute its purity, the share of its rows carrying its most common label, and report each token with purity of 0.9 or more with that purity. trigger_rows: the row_ids containing any pure token. batch_shares: each batch's share of each label. drifted_batches: the batch numbers, as integers, where any label's share differs from batch 1's by more than 0.15. The script must not read .truth.json. 6. Run python lab/data-checks.py lab/train.csv > lab/data-checks-out.json and read the result. The generator gives every ordinary word a mix of labels, which is why purity can single out a trigger here. Real data is messier -- class words are legitimately pure -- and there the purity check runs against a trusted reference set, so a token that is pure only in the new data stands out. 7. Write lab/poisoning-findings.csv with header check,rows_flagged,evidence,control and three rows: label-conflict with the number of conflict rows, token-purity with the number of trigger rows, and batch-drift with the number of rows in the drifted batches. In evidence say where the rows sit and what they share; in control name the lesson's control, such as label-consistency validation at ingestion with an independent relabel of a sample, trigger tests in every evaluation, or per-batch validation against a frozen baseline. Use semicolons, not commas, inside fields.