# US 12,762,225 B2 · Training data poisoning detection > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,762,225 B2 - Document ID: US12762225B2 - Status: Granted - Kind: B2 - Application number: 18/816,039 - Filed: 2024-08-27 - Published: 2026-03-05 - Granted: 2026-10-13 - Earliest claimed: 2024-08-27 - Assignees: Hewlett Packard Enterprise Development LP - Applicants: Hewlett Packard Enterprise Development LP - Inventors: Omer Uretzky; Gil Barash; Amir Idar - Web page: https://patentgrep.com/patent/US12762225B2 ## CPC - G06F 21/55: Detecting local intrusion or implementing counter-measures - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract In some examples, a system receives a plurality of training samples of a training data set for a machine learning model, where each training sample of the plurality of training samples comprises a plurality of features. The system determines quantities of changes made to respective features of the plurality of features, computes a score representing an integrity of the training data set based on the quantities, and detects poisoning of the training data set based on the score. ## Claims ### Claim 1 A non-transitory machine-readable storage medium comprising instructions that upon execution cause a system to: receive a plurality of training samples of a training data set for a machine learning model, wherein each training sample of the plurality of training samples comprises a plurality of features, the plurality of training samples is included in replicated training data provided by a data replication manager that replicates data writes to a storage system, and the data writes are replicated to a persistent memory; determine quantities of changes made to respective features of the plurality of features; compute a score representing an integrity of the training data set based on the quantities; detect poisoning of the training data set based on the score; identify a time point at which the poisoning of the training data set is detected; and produce, from the replicated training data, an uncorrupted version of the training data set based on the identified time point. ### Claim 2 (depends on 1) The non-transitory machine-readable storage medium of claim 1, wherein the producing of the uncorrupted version of the training data set comprises: selecting a checkpoint from a plurality of checkpoints in the replicated training data, the plurality of checkpoints comprising different versions of the training data set at respective different time points. ### Claim 3 (depends on 1) The non-transitory machine-readable storage medium of claim 1, wherein the instructions upon execution cause the system to: determine quantities of outliers in values of the respective features, wherein the score is further based on the quantities of outliers. ### Claim 4 (depends on 3) The non-transitory machine-readable storage medium of claim 3, wherein an outlier comprises a value of a feature that is outside a specified distribution of values of the feature. ### Claim 5 (depends on 3) The non-transitory machine-readable storage medium of claim 3, wherein the computing of the score comprises: calculating a first aggregate value based on a first aggregation of the quantities of changes made to the respective features, and calculating a second aggregate value based on a second aggregation of the quantities of outliers. ### Claim 6 (depends on 5) The non-transitory machine-readable storage medium of claim 5, wherein the first aggregation of the quantities of changes made to the respective features comprises scaling the quantities of changes made to the respective features to produce scaled values, and aggregating the scaled values. ### Claim 7 (depends on 6) The non-transitory machine-readable storage medium of claim 6, wherein the scaling of the quantities of changes made to the respective features comprises dividing the quantities of changes made to the respective features by a total quantity of the plurality of training samples. ### Claim 8 (depends on 6) The non-transitory machine-readable storage medium of claim 6, wherein the scaling of the quantities of changes made to the respective features comprises assigning factors to the respective features, and combining the factors with the quantities of changes made to the respective features, wherein a first factor of the factors is based on which range of a plurality of ranges of values a first quantity of changes made to a first feature is associated with. ### Claim 9 (depends on 8) The non-transitory machine-readable storage medium of claim 8, wherein the instructions upon execution cause the system to: calculate a change ratio for the first feature based on dividing the first quantity of changes by a total quantity of the plurality of training samples, wherein the first factor is based on which range of the plurality of ranges of values the change ratio for the first feature falls into. ### Claim 10 (depends on 8) The non-transitory machine-readable storage medium of claim 8, wherein the instructions upon execution cause the system to: assign a higher value to the first factor than a value of a second factor for a second feature based on the first quantity of changes made to the first feature being less than a second quantity of changes made to the second feature. ### Claim 11 (depends on 1) The non-transitory machine-readable storage medium of claim 1, wherein the instructions upon execution cause the system to: identify a first feature of the plurality of features for which a quantity of changes made to the first feature exceeds a threshold, wherein the quantity of changes made to the first feature is excluded from use in computing the score based on identifying that the quantity of changes made to the first feature exceeds the threshold. ### Claim 12 A system comprising: a processor; and a non-transitory storage medium storing instructions executable on the processor to: receive an input collection of training samples for a training data set, the training data set used for training a machine learning model, wherein each training sample of the input collection of training samples comprises a plurality of features, and the training samples are included in replicated training data provided by a data replication manager that replicates data writes targeting a storage system to a persistent memory; determine quantities of outliers in values of respective features of the plurality of features; compute a score representing an integrity of the training data set based on the quantities; detect poisoning of the training data set based on the score; identify a time point at which the poisoning of the training data set is detected; and produce, from the replicated training data, an uncorrupted version of the training data set based on the identified time point. ### Claim 13 (depends on 12) The system of claim 12, wherein the instructions are executable on the processor to: determine quantities of changes made to respective features of the plurality of features, wherein the score is further based on the quantities of changes. ### Claim 14 (depends on 12) The system of claim 12, wherein the computing of the score comprises: calculating a first aggregate value based on a first aggregation of the quantities of changes made to the respective features, and calculating a second aggregate value based on a second aggregation of the quantities of outliers. ### Claim 15 (depends on 14) The system of claim 14, wherein the computing of the score comprises: weighting the first aggregate value using a first coefficient, and weighting the second aggregate value using a second coefficient. ### Claim 16 (depends on 12) The system of claim 12, wherein the detecting of the poisoning of the training data set comprises comparing the score to a specified threshold. ### Claim 17 A method comprising: receiving an input collection of training samples for a training data set, the training data set used for training a machine learning model, wherein each training sample of the input collection of training samples comprises a plurality of features, and the training samples are included in replicated training data provided by a data replication manager that replicates data writes targeting a storage system to a persistent memory; determining, by a system comprising a hardware processor, quantities of changes made to respective features of the plurality of features; determining, by the system, quantities of outliers in values of the respective features; computing, by the system, a score representing an integrity of the training data set based on the quantities of changes and the quantities of outliers; detecting, by the system, poisoning of the training data set based on the score; identifying, by the system, a time point at which the poisoning of the training data set is detected; and producing, by the system from the replicated training data, an uncorrupted version of the training data set based on the identified time point. ### Claim 18 (depends on 17) The method of claim 17, further comprising: identifying a first feature of the plurality of features for which a quantity of changes made to the first feature exceeds a threshold, wherein the quantity of changes made to the first feature is excluded from use in computing the score based on identifying that the quantity of changes made to the first feature exceeds the threshold.