Contaminated Record Quarantine¶
Data-governance control — instantiates Deception Blowback Containment
Flags and isolates records known to carry planted or synthetic artifacts so they cannot flow into analytics, training data, audits, or official memory as if they were genuine.
A planted signal does not only reach people — it settles into records, and records get reused. Contaminated Record Quarantine is the data-governance control that flags every record known or suspected to carry a planted or synthetic artifact and isolates it from the systems that consume records as truth: analytics warehouses, model-training pipelines, audits, and official memory. Where Bounded Correction Protocol repairs a live decision, this mechanism works at the record layer — it follows the artifact and its copies through data lineage and blocks them at each ingestion boundary, so your own fabrication is never learned, cited, or audited as fact.
Example¶
A platform's trust-and-safety team runs a red-team exercise that generates a batch of synthetic disinformation posts — realistic fabricated content used to stress-test their detection classifier. Months later those posts still sit in the same content store that feeds both the analyst case library and the next retraining run of the classifier. Untouched, the model would learn from posts that were never real user activity, and analysts would cite exercise fabrications as genuine precedents — the system poisoning its own well.
Contaminated Record Quarantine handles this by tagging every exercise-generated post with a quarantine flag at the moment it is created, propagating that flag to any copy or extract, and enforcing an exclusion rule so the retraining and analytics jobs skip flagged records. The synthetic batch stays queryable for the exercise's own review but is walled off from every downstream use that would treat it as genuine.
How it works¶
- Flag at the source. Mark the artifact as contaminated where it is created, not after it has spread.
- Follow the lineage. Propagate the flag to copies, extracts, and derived features so the exclusion survives transformation.
- Enforce at every ingestion boundary. Analytics, training, audit, and official-reporting pipelines check the flag and exclude — the containment lives in the data plumbing, not in anyone remembering to be careful.
Tuning parameters¶
- Flag granularity — whole record vs field vs derived feature; finer flags contain more precisely but cost more to maintain.
- Propagation depth — how far you chase copies and embeddings; deep propagation catches derivatives already within a model's reach, at real effort.
- Exclusion strictness — hard block vs warn-and-log; strict blocking is safer but can wall off records someone legitimately needs.
- Quarantine vs delete — isolating (reversible, recoverable) vs purging (no residue, but no recovery). The reversible default trades a small standing footprint for the ability to undo a mistaken flag.
- Coverage — which downstream uses are wired to honor the flag; an unwired pipeline is a hole in the wall.
When it helps, and when it misleads¶
Its strength is that it keeps your own planted or synthetic material out of the systems that would silently launder it into fact — the model that would train on it, the audit that would cite it, the dashboard that would trend it. Where synthetic artifacts can feed back into training sets, isolating them by lineage is the concrete guard against a system learning from its own fabrications.[n1]
Its failure modes are symmetric. Under-quarantine misses a derivative — a copy, an embedding, a summary already absorbed into a model — and the contamination survives. Over-quarantine walls off legitimate records and, at its worst, becomes a tool of memory-holing: isolating true-but-inconvenient records under cover of "contamination." The discipline is to quarantine reversibly and with a logged reason rather than delete, to drive flags from the authoritative Deception Blowback Register rather than ad-hoc judgement, and to keep an independent check on what gets quarantined so the control cannot quietly erase inconvenient truth.
How it implements the components¶
Contaminated Record Quarantine fills the record-isolation side of the containment machinery:
correction_and_quarantine_path— it operates the quarantine branch of this path: isolating contaminated records from truth-consuming systems.synthetic_artifact_exclusion_rule— it enforces the rule that flagged synthetic artifacts are excluded from analytics, training, audit, and official use.
The correction branch of the path — re-contextualizing a live signal for friendly decision-makers — is Bounded Correction Protocol. The training-data-specific version of the exclusion rule is maintained by Training-Data Exclusion List; this mechanism is the broader record-layer control. It does not brief people (Compartmented Briefing) or tally the operation's costs (After-Action Truth Reconciliation).
Related¶
- Instantiates: Deception Blowback Containment — this control keeps a planted artifact out of the systems that would treat it as evidence.
- Consumes: Deception Blowback Register supplies the authoritative list of which artifacts to flag.
- Sibling mechanisms: Bounded Correction Protocol · Training-Data Exclusion List · Synthetic or Exercise Marker · Deception Blowback Register · After-Action Truth Reconciliation
Editorial Notes¶
Form Classification¶
Form family: Control, Automation & Runtime
Rationale: Flags and isolates records known to carry planted or synthetic artifacts so they cannot flow into analytics, training data, audits, or official memory as if they were genuine, making its operative form a live operational control that automatically routes, enforces, adapts, or responds during execution.
Independent corroboration: The frozen evidence defines Contaminated Record Quarantine as 'Flags and isolates records known to carry planted or synthetic artifacts so they cannot flow into analytics, training data, audits, or official memory as if they were genuine', so its operative form is Control, Automation & Runtime.
Review outcome: Independent reviewer agreement; high confidence.
Origin Attribution¶
Primary origin: Computer Science & Software Engineering
Origin pattern: Cross-disciplinary synthesis
Present-day reach: Multi-domain
Rationale: Computer and data-system practice cohered provenance-aware quarantine that prevents suspect records from entering downstream analytics, training, and decision pipelines while preserving traceability.
Related originating lineages:
- Data Science & Analytics — Data governance operationalizes lineage flags and exclusion gates across analytical and model-training pipelines.
- Library & Information Science — Archival provenance contributes preserving the record, its reason for quarantine, and reversible access rather than silently deleting it.
- Security Studies & Intelligence Analysis — Deception-control practice supplies concern about planted artifacts contaminating downstream belief and institutional memory.
Review resolution: The active quarantine control is chiefly a computing mechanism; data governance, archival provenance, and adversarial-security practice are genuine co-lineages in the integrated record-management form.
Encyclopedia synthesis: The exact catalogued form synthesizes established practice rather than reproducing a single standard historical label.
Review outcome: Researched adjudication after independent review; high confidence.
Sources consulted:
- NIST Glossary: Data Poisoning
- NIST AI 100-2 E2023: Adversarial Machine Learning
- NIST AI Risk Management Framework: Characteristics
Notes¶
Quarantine acts on records; Bounded Correction Protocol acts on decisions. The two share the archetype's correction-and-quarantine path and are usually run together. Prefer reversible isolation to deletion: a wrongly-flagged record can be released, but a purged one cannot be recovered — and that irreversibility is exactly what lets quarantine be abused as erasure.
[n1] Data poisoning is the contamination of a dataset — often a model's training data — with material that corrupts what the system learns. Here the poison is self-inflicted: an organization's own authorized synthetic artifacts, which this control keeps out of the pipelines that would otherwise absorb them as genuine. ↩