ML Model Integrity and Anti-Poisoning

Models that inform control are treated as security-critical artifacts: their training data, weights, and lineage are protected against poisoning and silent substitution.

Models are code that learned

Kronos uses learned models for state estimation, disruption/off-normal prediction, and control assistance. A model is only as trustworthy as the data it learned from and the pipeline that produced it. Two threats matter: data poisoning (an attacker corrupts training data so the model behaves badly on a chosen trigger) and model substitution (an attacker swaps a trusted model for a malicious one). Both are supply-chain problems and are handled like hardware supply-chain risks.

Anti-poisoning measures

• Content-addressed, access-controlled training datasets with recorded provenance.
• Data validation and outlier screening before training, so injected samples are flagged.
• Held-out physics-consistency tests: a model must respect conservation and known plasma behavior, not just fit points.
• Reproducible training so a model's weights can be regenerated and hash-matched from reviewed data and code.

Anti-substitution measures

# A model is admitted to control only if it matches signed provenance
def admit_model(model):
    if sha384(model.weights) != model.provenance.subject_hash: return DENY
    if not verify_sig(model.provenance, model_signing_root):    return DENY
    if not passes_physics_tests(model, held_out):               return DENY
    if not two_person_ok(model.promotion):                      return DENY
    return ADMIT   # then crosses the air-gap bridge to control

Bounded authority as a backstop

Even a poisoned model that slips through cannot exceed the physical envelope: actuator-level limits and the independent SIS bound what any model-driven command can do. A model informs control; it does not get unmediated authority over the actuators. This is the same defense-in-depth that limits a direct control-loop attack.

Design status: dataset provenance, reproducible training, physics tests, and gated promotion run in the twin/training environment. On-plant model deployment is part of FOAK operations; today models act only on simulated plasma.