After a poisoning incident, a water utility must harden training inputs. Which compensating control best addresses data integrity?

After a poisoning incident, a water utility hardens training-input integrity by requiring signed dataset manifests and integrity checks before each training run. Signed manifests attest provenance—what dataset version, who produced it, and cryptographic hashes of contents—so unauthorized swaps or silent inserts are detectable before they enter model fitting. Integrity checks (hash verify, signature validate, optional quarantine on mismatch) close the gap that let poisoned batches train previously. For utility AI that may touch operations analytics or safety-adjacent classifiers, verifying inputs every run is a compensating control that restores trust in the training pipeline. Requiring signed model weight manifests and integrity checks before each training run fails because it verifies the model weights, not the dataset before fitting—poisoned batches can still enter training, so weight checks cannot prevent tampered inputs from entering model fitting in the first place. Requiring signed dataset snapshots with seals for rollback before each training run fails because snapshots only give you a rollback point after poisoning has already occurred; even with seals, they do not verify provenance or detect tampered data from entering model fitting in the first place. Requiring signed dataset encryption keys and cipher checks before each training run fails because encryption and cipher validation only prove confidentiality and correct decryption, not provenance or integrity—poisoned plaintext will still decrypt correctly and train, so key checks cannot detect tampered inputs entering model fitting in the first place. Exam caveat: Signed manifests and integrity checks must run before every training run, not as signed model weight manifests and integrity checks before each training run that never inspect training inputs, and not as signed dataset snapshots with seals used only for rollback. Distinguish dataset signing from model weight signing before training; both are useful, but this stem targets training inputs. Also keep signing keys in HSM/KMS with dual control so attackers cannot sign poisoned sets. Operational check: Enforce signed manifests and hash verification as a hard gate before every water-utility training run, not as signed dataset snapshots with seals for rollback before each training run; reject anonymous unreviewed uploads; signed dataset encryption keys and cipher checks do not substitute for checksum verification on nightly refreshes; stop unmanifested public-scrape training; and alert on signature or hash failures as security events.