A public-health FAQ model’s training tickets show a cluster of manipulated labels that always steer toward 'approve.' What training-time attack pattern should the AI red team flag?

A cluster of manipulated training labels that always steer a public-health FAQ model toward 'approve' is a targeted data-poisoning pattern that skews civic model labels toward a specific harmful decision. Unlike random noise, the attacker concentrates on one outcome—automatic approval—so the model learns a biased decision boundary for cases the adversary cares about. In municipal public-health settings, that can mean wrongly approving guidance or triage dispositions that affect residents. The AI red team should flag anomalous label clusters, weak provenance on those tickets, and outcome skew as evidence of targeted poisoning rather than ordinary annotation error alone.

Untargeted data poisoning that adds random label noise would degrade overall FAQ accuracy across many outcomes, not create a tight cluster that always steers toward 'approve.' Inference-time prompt evasion uses crafted inputs against a deployed model, so it cannot explain manipulated labels in training tickets. Privacy-focused membership inference tries to recover whether specific citizen records were used to train the model, which does not account for outcome-skewed labels. These distractors describe different attack stages or goals and miss the training-time attack concept.

Exam caveat: targeted poisoning aims at a specific decision; broad poisoning degrades overall quality. Exam items often test that distinction. Also, finding a suspicious cluster warrants investigation—it is not automatic proof of an external attacker; insider error, vendor pipeline bugs, or compromised annotation accounts can produce the same pattern. Document chain of custody for the affected tickets before remediation training.

Operational check: pull the 'approve'-heavy ticket cohort, compare annotator IDs and time windows, verify source systems, and measure lift in approve rates on held-out clean data after excluding the cluster. If approve bias collapses when the cluster is removed, treat it as a poison indicator and tighten dual review on high-impact labels. Re-train only from verified tickets and monitor post-deploy approve rates for civic FAQ decisions.