A parks vision model’s augmentation pipeline could insert stealthy trigger patterns if that stage were compromised. What should an authorized review treat that stage as?

If a parks vision model's augmentation pipeline could insert stealthy trigger patterns when compromised, an authorized review should treat that stage as a poison insertion point in the civic data-augmentation and training pipeline. Augmentation and preprocessing run before fitting; a malicious or buggy transform can watermark triggers, corrupt labels, or systematically bias samples while leaving raw collection looking clean. Reviews must inventory transforms, pin code versions, verify checksums of augmented shards, restrict who can change augmentation configs, and include augmentation in poison threat models. A downstream inference monitor for park scene prediction latency and drift tracking watches serving-time behavior, but it does not close the training-time gap where a compromised augmentation stage could embed triggers. A model evaluation harness for measuring trail image accuracy during validation cycles checks performance after training; it does not secure the augmentation transforms that could have already inserted stealthy triggers. A civic data catalog entry describing approved augmentation libraries and version history records provenance, but by itself it does not prevent a compromised augmentation stage from inserting poison during training. Distractors fail by relocating the finding to inference monitoring, validation measurement, or catalog documentation instead of the augmentation stage where poison could be inserted. Exam caveat: augmentation is legitimate ML practice; the issue is treating it as out-of-scope for security. Triggers may be visual patterns invisible to casual QA. Distinguish online serving-time attacks from training-time insertion at augmentation—the stem is the latter. Operational check: code-review augmentation modules; require signed configs; compare augmented outputs to raw inputs for unexpected overlays; include canary images that should never gain a trigger motif. Fail training if canaries flip under augmentation-only changes. Document the augmentation stage on the parks model data-flow diagram as a controlled poison insertion point with an owner.