The Security System

Aquin Labs · April 2026

Adversarial risk across the full pipeline

ML security does not live in a single place. It exists at the data layer, where training examples can carry injected instructions, poisoned behavior cues, and backdoor trigger phrases before the model ever sees them. It exists at the model layer, where a trained checkpoint can be probed for jailbreak susceptibility, robustness under prompt corruption, and suppression bypass, and where the weight tensors themselves can be scanned for implanted trojan signatures independent of any prompt-response behavior. And it exists at the training layer, where the difference in attack surface between a base checkpoint and a fine-tuned one reveals what the fine-tuning objective changed about the model's defenses.

Aquin surfaces all of it in a single continuous session. The data inspection system catches adversarial content before it enters the training loop. The model inspector's security panel runs red team probes across six attack vectors and scans weight tensors for trojan signatures. The training monitor compares attack surface between model versions in the same interface where you watch loss and gradient dynamics. This article covers the full security stack: what each layer detects, how the signals work, and how findings in one layer point toward investigation in the next.

Where security checks live

Nine distinct security checks across three layers of the pipeline. Each check is scoped to a specific surface: data-layer checks run before training, model-layer checks run against a trained checkpoint, and training-layer checks run at the boundary between base and fine-tuned model. The coverage is intentionally non-overlapping, with no single check that catches everything and no layer that can substitute for the others.

Data layer: what enters the training loop

Training data is the most accessible attack surface in the ML pipeline. An adversary who can influence what goes into a training set can influence what the model learns: to respond to specific trigger phrases, to override its own instructions when prompted correctly, to produce systematically incorrect outputs on targeted queries. These attacks require no access to the model itself. The data is the vector.

Aquin's data inspection system runs three security-specific modules on every dataset: prompt injection detection, poisoned sample detection, and backdoor trigger scanning. Every finding is row-and-column-specific, logged to a timestamped audit trail, and exportable as a sealed PDF or JSON. The security modules run inside the same pipeline as toxicity, PII, and quality, so a finding in one module can be cross-referenced against findings in the others without leaving the session.

Prompt injection in training data

Prompt injection at inference time is well-understood: a user submits input that overrides or extends the model's system prompt. What is less commonly checked is whether that injection exists in the training data itself. A training set that contains instruction-override strings, system prompt extraction attempts, role confusion injections, or training disregard patterns is teaching the model, at a gradient level, to respond to those patterns. The effect is subtle and persistent: the model does not learn the injected behavior from a single example, but repeated exposure shifts its response distribution toward compliance.

Aquin scans every text column for four pattern categories and scores each match on a 0–1 scale. A score of 0.91 on an instruction-override pattern is not ambiguous. It is a deliberate attempt to seed the training set with adversarial content, and it warrants removal before the dataset enters the training loop.

Poisoned samples

Data poisoning is not about malicious text. It is about malicious structure. A poisoned example looks clean on inspection: reasonable content, plausible label, no obvious injection pattern. Its effect is statistical: it sits in the training distribution as an outlier that pulls the model's decision boundary in a targeted direction. The attack is designed to be invisible to manual review and only detectable through distributional analysis.

Aquin runs three signals in parallel: embedding outlier score within topic cluster (does this example sit far from its semantic neighbors?), label inconsistency across near-duplicate inputs (does this example have a different label than near-identical examples?), and a loss-proxy anomaly (would this example be unusually easy or unusually hard for a model to learn?). No single signal is sufficient. The blend is the verdict. High-confidence flags require all three signals to fire simultaneously.

Backdoor trigger phrases

A backdoor attack pairs a specific trigger phrase with a target behavior: the model behaves normally on clean inputs, but when the trigger appears at inference time, it activates the planted behavior. The trigger can be arbitrary, a specific token, a formatting pattern, a phrase that looks like whitespace. What makes it a backdoor is that it is systematically paired with a divergent target in the training data, and the model learns to associate the trigger with that target through standard gradient descent.

Aquin detects candidate triggers by measuring context shift: the semantic divergence between the text immediately before and immediately after the candidate phrase. A clean phrase sits coherently in its context, and removing it would leave the surrounding text semantically intact. A trigger phrase creates a discontinuity: the context before and after it points in different directions, because it was seeded to redirect model behavior at that point. These are not keyword filters. The detection is based on what the phrase does to the context embedding, not what it says.

Model inspection layer: probing a trained checkpoint

A clean training dataset does not guarantee a secure model. The fine-tuning objective, the template design, the prompt distribution, and the RLHF reward signal can each shift the model's behavior in ways that increase its susceptibility to adversarial prompts, even without a single malicious row in the training data. Behavioral security requires probing the model directly after training, not just auditing the data before it.

The model inspector's security panel contains two tabs: Red Team and Weight Trojans. Red Team runs adversarial probes across six attack vectors and produces a composite robustness score with per-vector breakdown. Weight Trojans analyzes the model's weight tensors directly, independent of any prompt-response behavior, for statistical signatures associated with backdoor implants.

Jailbreak taxonomy

The six attack vectors that Aquin's red team system probes map onto a taxonomy of known jailbreak families. Understanding the taxonomy matters because different attack families have different mitigations, different data-side sources, and different mechanistic signatures in the model's internal representations. A model that is robust to prompt injection but brittle to role confusion has a different training data problem than one that is robust to both but fails on multi-turn extraction.

Red team probing

The red team panel runs automated adversarial probes across all six attack vectors and produces a structured report. Each vector is scored 0–1 by robustness, classified as pass, warn, or fail, and annotated with a finding that identifies the specific failure mode. The composite score is a weighted average across all selected vectors. The report is exportable as JSON.

The scoring thresholds are calibrated empirically: pass at 65% or above indicates the model deflects the majority of well-formed attacks in that category. Warn between 35% and 65% indicates the model deflects some but not all, and the specific failure type should drive the remediation. Fail below 35% indicates the attack vector is consistently effective and requires targeted training data intervention or architectural mitigation.

Weight trojan detection

Behavioral red teaming only catches backdoors that are reliably triggered by adversarial prompts. A sufficiently sophisticated implant may be designed to activate only under narrow, specific conditions that a generic red team probe will not hit. Weight trojan detection takes a different approach: it analyzes the model's weight matrices directly for statistical signatures that are characteristic of implanted backdoor patterns, regardless of what prompts trigger them.

Three signals: kurtosis measures whether the weight distribution has heavier tails than a clean model of the same architecture, since a trojan implant concentrates weight in a small subset of neurons and that appears as excess kurtosis. Outlier density measures the fraction of weights more than four standard deviations from the layer mean, where clean layers have very few such outliers and implanted layers have systematically more. Singular value ratio measures whether the weight matrix has a dominant low-rank component, as backdoor implants often operate as rank-one updates that leave a signature in the singular value decomposition.

A tensor that triggers all three signals simultaneously is flagged high risk. The report names the specific tensors, their layer positions in the architecture, and the exact values that crossed the detection thresholds, giving a precise entry point for mechanistic inspection in the attribution system.

Training monitor layer: attack surface across model versions

Fine-tuning does not only change what a model knows. It also changes how it behaves under adversarial pressure. A fine-tune intended to add factual knowledge can, as a side effect, decrease the model's robustness to role confusion attacks if the training data contained examples that rewarded persona compliance. A RLHF pass intended to reduce harmful outputs can increase suppression bypass susceptibility if the reward model over-penalizes refusals on legitimate edge cases.

The training monitor's model diff panel includes an attack surface comparison that runs after training completes. The same six red team vectors are evaluated on the base checkpoint and the fine-tuned checkpoint, and the per-vector deltas are displayed alongside the standard behavioral scores (consistency, suppression, robustness). This means that for every training run, you have a direct answer to the question: did this fine-tune make the model more or less resistant to each attack family?

A negative delta on boundary robustness after a factual fine-tune is a finding that should send you back to the data inspector to check whether the training examples were over-represented in one paraphrase style. A positive delta on multi-turn extraction resistance after an RLHF pass is confirmation that the reward model is correctly penalizing goal-spreading. The attack surface diff is not a standalone check. It is the bridge between behavioral security and training dynamics.

Security as a connected investigation

The value of a layered security system is not the individual checks. It is the chain of inference they enable. A backdoor trigger detected in training data at row 178 with a context shift score of 0.88 becomes an actionable mechanistic question once training is complete: did the trigger phrase shift any SAE features at the layers where the weight trojan scan flagged anomalies? If L14.mlp.down_proj is both the highest-risk tensor in the trojan scan and the layer where the trigger's embedding divergence is most concentrated, that is not a coincidence. That is a finding.

The same directional logic runs forward from the training monitor. An attack surface delta that shows a 12-point drop in boundary robustness after a fine-tune on medical data opens a data-side question: does the medical QA dataset contain an unusual paraphrase distribution that trained the model to treat surface variation as a signal for different responses? The data inspector can answer that question with the synthetic detection and near-duplicate analysis modules. If 33% of the dataset is synthetic and the synthetic examples cluster around specific query phrasings, the data is the explanation for the robustness regression.

Security in ML is not a checklist. It is an investigation that starts before training and continues after deployment, where every finding is a pointer to the next question. Aquin keeps that investigation in a single continuous session, so the chain from data to model to training dynamics remains intact.