Approve user feedback before it trains or teaches the model

How to do it

Anyone with an account can send feedback. An attacker can rate bad answers up or send crafted corrections until the next tune learns them, without touching your servers. OWASP lists this under data and model poisoning. Keep incoming feedback in a holding table. A person approves each item before it is copied into a training set or an example. Cap what one account adds, such as 1% of a set, and set aside bursts of feedback from new accounts. Record which items went into each fine-tune. A bad batch can then be removed and the model rebuilt, as Rebuild fine-tuned models from stored data shows. Consent comes first, as Train only on data people agreed to share says.

Examples

JavaScript example

const MAX_SHARE_PER_ACCOUNT = 0.01;

export function trainingRows(feedback, setSize) {
  const perAccount = new Map();
  const limit = Math.floor(setSize * MAX_SHARE_PER_ACCOUNT);
  return feedback.filter(item => {
    if (!item.approvedBy) return false;
    const count = (perAccount.get(item.accountId) ?? 0) + 1;
    perAccount.set(item.accountId, count);
    return count <= limit;
  });
}

Python example

from collections import Counter

MAX_SHARE_PER_ACCOUNT = 0.01

def training_rows(feedback: list[Feedback], set_size: int) -> list[Feedback]:
    limit = int(set_size * MAX_SHARE_PER_ACCOUNT)
    per_account: Counter[str] = Counter()
    rows = []
    for item in feedback:
        if item.approved_by is None:
            continue
        per_account[item.account_id] += 1
        if per_account[item.account_id] <= limit:
            rows.append(item)
    return rows

How to check

A test adds 200 thumbs-up ratings from one test account to a bad answer. The next training set holds none of them without approval, and at most 1% of its rows come from that account. Every row in each training set has an approver and an approval date.

Sources

• OWASP LLM05:2026 Data and Model Poisoning

Related rules

• AIF-76 Version the eval set and keep a held-out part in AI features
• AIF-62 Rebuild fine-tuned models from stored data and compare before switching in AI features
• AIF-50 Train only on data people agreed to share in AI features
• MLO-43 Limit what any one source can put into training data in Machine learning