---
title: "Limit what any one source can put into · Agent Wranglers"
url: https://agentwranglers.se/playbook/machine-learning/training-data/poisoning-checks
id: MLO-43
level: Recommended
applies: ai-features
updated: 2026-10-27
build: a2a6bdfed830
tokens: 1063
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Limit what any one source can put into training data

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Training data](https://agentwranglers.se/playbook/machine-learning/training-data.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-27.

- ID: MLO-43
- Level: Recommended
- Chapter: [Training data](https://agentwranglers.se/playbook/machine-learning/training-data.md)
- Rule: Cap the share of each training snapshot that one account, labeller or outside source supplies, such as 1%. Stop the run when a source passes its cap or its labels disagree with a reference model far more than others do.
- Check: A test adds rows from one account above the cap to a snapshot, and the pipeline stops and names the account. A second test flips the labels of one source, and the pipeline flags that source.
- Applies when: The project uses AI models.
- How: Poisoning hides a few crafted rows in the data, so the model learns a backdoor or a wrong label for one case. It works best when an attacker controls many rows, such as through user feedback, scraped pages or an outside dataset. Record the source of every row, as [record where every dataset came from](https://agentwranglers.se/playbook/machine-learning/training-data/dataset-provenance.md) asks. Count rows per source and per account. Score every row with the current model and flag sources whose labels disagree with it at more than twice the overall rate. A person reviews flagged sources before the run continues. Feedback that reaches training goes through [approve user feedback before it trains or teaches the model](https://agentwranglers.se/playbook/ai-features/logs-privacy-and-feedback/approve-feedback-before-training.md). Outside models and datasets follow [use models and data from trusted sources](https://agentwranglers.se/playbook/application-security/supply-chain/trusted-model-sources.md).

## Examples

**Using these examples:** they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

### Python example

```python
MAX_SOURCE_SHARE = 0.01

def sources_over_cap(snapshot: pd.DataFrame) -> list[str]:
    shares = snapshot["source_id"].value_counts(normalize=True)
    return shares[shares > MAX_SOURCE_SHARE].index.tolist()
```

### TypeScript example

```ts
const MAX_SOURCE_SHARE = 0.01;

export function sourcesOverCap(rows: { sourceId: string }[]): string[] {
  const counts = Map.groupBy(rows, row => row.sourceId);
  return [...counts].filter(([, group]) => group.length / rows.length > MAX_SOURCE_SHARE).map(([sourceId]) => sourceId);
}
```

## Sources

- [NIST AI 100-2 E2025, Adversarial Machine Learning](https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.100-2e2025.pdf)
- [OWASP LLM05:2026 Data and Model Poisoning](https://github.com/GenAI-Security-Project/GenAI-LLM-Top10/blob/main/2026/final/LLM05_DataModelPoisoning.md)

## Related rules

- MLO-4 [Record where every dataset came from and why you may use it](https://agentwranglers.se/playbook/machine-learning/training-data/dataset-provenance.md) in Machine learning
- AIF-69 [Approve user feedback before it trains or teaches the model](https://agentwranglers.se/playbook/ai-features/logs-privacy-and-feedback/approve-feedback-before-training.md) in AI features
- APS-77 [Use models and data from trusted sources](https://agentwranglers.se/playbook/application-security/supply-chain/trusted-model-sources.md) in Application security

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/machine-learning/training-data/poisoning-checks">Agent Wranglers machine learning playbook</a>`. In code you write, add a comment next to it with the same link.

- Previous: [Check every new snapshot against the last one before training](https://agentwranglers.se/playbook/machine-learning/training-data/validate-training-snapshot.md)
- [Training data](https://agentwranglers.se/playbook/machine-learning/training-data.md)