The Security System

Aquin Labs · April 2026

Adversarial risk across the full pipeline

prompt injection · data poisoning · backdoor trigger · jailbreak · weight trojan · attack surface

ML security does not live in a single place. It exists at the data layer, where training examples can carry injected instructions, poisoned behavior cues, and backdoor trigger phrases before the model ever sees them. It exists at the model layer, where a trained checkpoint can be probed for jailbreak susceptibility, robustness under prompt corruption, and suppression bypass, and where the weight tensors themselves can be scanned for implanted weight trojan signatures independent of any prompt-response behavior. And it exists at the training layer, where the difference in attack surface between a base checkpoint and a fine-tuned one reveals what the fine-tuning objective changed about the model's defenses.

Aquin surfaces all of it in a single continuous session. The data inspection system catches adversarial content before it enters the training loop. The model inspector's security panel runs red teaming probes across six attack vectors and scans weight tensors for trojan signatures. The training monitor compares attack surface between model versions in the same interface where you watch loss and gradient dynamics.

Where security checks live

Nine distinct security checks across three layers of the pipeline. Each check is scoped to a specific surface: data-layer checks run before training, model-layer checks run against a trained checkpoint, and training-layer checks run at the boundary between base and fine-tuned model. The coverage is intentionally non-overlapping.

Data layer

What enters the training loop · prompt injection · data poisoning · backdoor trigger

Training data is the most accessible attack surface in the ML pipeline. An adversary who can influence what goes into a training set can influence what the model learns: to respond to specific trigger phrases, to override its own instructions when prompted correctly, to produce systematically incorrect outputs on targeted queries. These attacks require no access to the model itself. The data is the vector.

Aquin's data inspection system runs three security-specific modules on every dataset: prompt injection detection, poisoned sample detection, and backdoor trigger scanning. Every finding is row-and-column-specific, logged to a timestamped audit trail, and exportable as a sealed PDF or JSON.

Prompt injection in training data

Prompt injection at inference time is well-understood. What is less commonly checked is whether that injection exists in the training data itself. A training set that contains instruction-override strings, system prompt extraction attempts, role confusion injections, or training disregard patterns is teaching the model, at a gradient level, to respond to those patterns.

Aquin scans every text column for four pattern categories and scores each match on a 0–1 scale. A score of 0.91 on an instruction-override pattern is not ambiguous. It is a deliberate attempt to seed the training set with adversarial content, and it warrants removal before the dataset enters the training loop.

Poisoned samples

Data poisoning is not about malicious text. It is about malicious structure. A poisoned example looks clean on inspection: reasonable content, plausible label, no obvious injection pattern. Its effect is statistical — it sits in the training distribution as an outlier that pulls the model's decision boundary in a targeted direction.

Aquin runs three signals in parallel: embedding outlier score within topic cluster, label inconsistency across near-duplicate inputs, and a loss-proxy anomaly. No single signal is sufficient. The blend is the verdict. High-confidence flags require all three signals to fire simultaneously.

Backdoor trigger phrases

A backdoor trigger attack pairs a specific trigger phrase with a target behavior: the model behaves normally on clean inputs, but when the trigger appears at inference time, it activates the planted behavior. The trigger can be arbitrary — a specific token, a formatting pattern, a phrase that looks like whitespace.

Aquin detects candidate triggers by measuring context shift: the semantic divergence between the text immediately before and after the candidate phrase. These are not keyword filters. The detection is based on what the phrase does to the context embedding, not what it says.

Model inspection layer

Probing a trained checkpoint · red teaming · weight trojan detection

A clean training dataset does not guarantee a secure model. The fine-tuning objective, the template design, the prompt distribution, and the RLHF reward signal can each shift the model's behavior in ways that increase its susceptibility to adversarial prompts, even without a single malicious row in the training data. Behavioral security requires probing the model directly after training.

The model inspector's security panel contains two tabs: Red Team and Weight Trojans. Red Team runs adversarial probes across six attack vectors and produces a composite robustness score with per-vector breakdown. Weight Trojans analyzes the model's weight tensors directly, independent of any prompt-response behavior, for statistical signatures associated with backdoor implants.

Jailbreak taxonomy

The six attack vectors map onto a taxonomy of known jailbreak families. Different attack families have different mitigations, different data-side sources, and different mechanistic signatures in the model's internal representations. A model that is robust to prompt injection but brittle to role confusion has a different training data problem than one that fails on multi-turn extraction.

Red team probing

The red teaming panel runs automated adversarial probes across all six attack vectors and produces a structured report. Each vector is scored 0–1 by robustness, classified as pass (≥65%), warn (35–65%), or fail (35%), and annotated with a finding that identifies the specific failure mode. The report is exportable as JSON.

Weight trojan detection

Behavioral red teaming only catches backdoors that are reliably triggered by adversarial prompts. Weight trojan detection takes a different approach: it analyzes the model's weight matrices directly for statistical signatures characteristic of implanted backdoor patterns.

Three signals: kurtosis measures whether the weight distribution has heavier tails than a clean model of the same architecture. Outlier density measures the fraction of weights more than four standard deviations from the layer mean. singular value ratio measures whether the weight matrix has a dominant low-rank component — backdoor implants often operate as rank-one updates that leave a signature in the singular value decomposition.

A tensor that triggers all three signals simultaneously is flagged high risk. The report names the specific tensors, their layer positions, and the exact values that crossed the detection thresholds — giving a precise entry point for mechanistic inspection in the attribution system.

LLM-as-judge output scoring

Red teaming and weight analysis address whether a model can be broken. A separate question is whether the model's outputs meet the quality bar required for a specific deployment. Correctness is not binary, helpfulness is not universal, and a response that is safe in one context is evasive in another.

The judge panel runs inside the model inspector. Five rubrics are loaded by default — correctness, helpfulness, safety, tone, format — each with a weight that reflects its relative importance to the deployment context. Every rubric is editable. New rubrics can be added for use-case-specific criteria. The scoring pass returns a per-rubric score from 0 to 10, a one-sentence rationale, and a verbatim span from the response that most illustrates the rating.

Training monitor layer

Attack surface across model versions

Fine-tuning does not only change what a model knows. It also changes how it behaves under adversarial pressure. A fine-tune intended to add factual knowledge can, as a side effect, decrease the model's robustness to role confusion attacks if the training data contained examples that rewarded persona compliance.

The training monitor's model diff panel includes an attack surface comparison that runs after training completes. The same six red team vectors are evaluated on the base and fine-tuned checkpoint, and the per-vector deltas are displayed alongside the standard behavioral scores. For every training run, you have a direct answer to: did this fine-tune make the model more or less resistant to each attack family?

Attack surface diff

Security as a connected investigation

The value of a layered security system is not the individual checks. It is the chain of inference they enable. A backdoor trigger detected in training data at row 178 with a context shift score of 0.88 becomes an actionable mechanistic question once training is complete: did the trigger phrase shift any SAE features at the layers where the weight trojan scan flagged anomalies?

Security in ML is not a checklist. It is an investigation that starts before training and continues after deployment, where every finding is a pointer to the next question. Aquin keeps that investigation in a single continuous session, so the chain from data to model to training dynamics remains intact.