Training Data Provenance & Supply Chain Policy

Addresses the previously unaddressed gap in supply-chain risk: data poisoning, provenance, and copyrighted-material liability in pre-training and fine-tuning datasets.

All datasets used for pre-training, fine-tuning, and evaluation of WEBSPACEAI models.

• Data Poisoning — deliberate insertion of malicious or misleading data into a training corpus intended to manipulate model behavior.
• Dataset Provenance Record — a maintained log of a dataset's source, licensing status, and collection method.

All training datasets require a Dataset Provenance Record documenting source, collection method, and licensing basis before use. Datasets are scanned for known data-poisoning signatures and anomalous outlier patterns before inclusion in training runs. Web-scraped data is filtered against a maintained exclusion list of sites that have opted out of AI training crawling (e.g., via robots.txt AI-training directives) and against known copyrighted-work fingerprints where feasible. Third-party and vendor-supplied datasets undergo a vendor security and provenance assessment (see Security Policy, Doc. 11) before integration.

Research Data team owns provenance recordkeeping and poisoning-detection tooling; Legal reviews licensing basis for significant datasets; Security assesses vendor-supplied data sources.

No dataset is used in training without a completed Dataset Provenance Record; poisoning-detection scans are logged and auditable.

Datasets lacking provenance records or failing poisoning scans are excluded from training pending review.

research@webspaceai.in

Time-limited exceptions for research-only, non-production training runs require AI Safety Research Lead approval.

Quarterly.

research@webspaceai.in