Learning-Substrate Contamination¶
Core Idea¶
Learning-Substrate Contamination occurs when an adversary influences future behavior by selectively shaping the experience or evidence from which an agent durably updates. The adversary does not need direct access to the agent's retained state. Instead, a normal learning mechanism faithfully incorporates a contaminated contribution and later produces a belief, classification, preference, recognition rule, or policy tilted in the adversary's chosen direction.
The temporal separation is central. The contaminating contribution may be small, locally plausible, and absent when the installed behavior eventually appears. A defense that inspects only present inputs or outputs can therefore arrive too late: the consequential write occurred earlier, through learning.
Structural Signature¶
- A stateful learner that durably updates from experience, evidence, examples, or history.
- A learning substrate whose contributions influence the learner without directly determining each later decision.
- Bounded adversarial access that lets an adversary inject, suppress, relabel, weight, or selectively expose some contributions.
- A targeted update direction chosen because of the retained change it is expected to cause.
- Faithful incorporation by an otherwise normally operating learning mechanism.
- Delayed enactment in later behavior after the contaminating contribution is no longer present.
- An upstream control surface involving provenance, contribution limits, robust aggregation, counter-evidence, or re-anchoring.
What It Is Not¶
It is not a one-off crafted input against an already-fixed rule, direct rewriting of weights or memory, or benign distribution drift. It also does not include every false message: the receiver must durably learn from the selectively shaped evidence. The adversary's causal route runs through the update mechanism.
Broad Use¶
- Machine learning: poisoned examples, labels, preference data, or federated updates install a later model behavior.
- Markets and reputation: fake reviews or astroturf contributions distort the evidence from which buyers, sellers, or ranking systems learn.
- Education and public memory: curriculum tampering, propaganda, or revisionist archives selectively alter the record from which durable beliefs form.
- Adaptive institutions: coordinated submissions pull a diagnostic, regulatory, moderation, or editorial criterion away from its intended basis.
- Biological recognition: mimicry or deceptive signals reshape a predator's or host's learned response across encounters.
Clarity¶
The prime separates three intervention stages that can look similar at the moment of failure. An adversary can perturb the present observation, navigate a fixed rule, or alter what the agent learned before the decision. Learning-Substrate Contamination is the third case. It directs diagnosis and control toward the history and provenance of the update rather than only the visible triggering input.
Manages Complexity¶
The prime compresses many domain vocabularies into one causal sequence: selectively shape evidence, allow normal updating, retain the change, and enact it later. That sequence predicts why clean present-time observations can coexist with compromised behavior and why controls that never inspect the learning substrate have an incomplete defense surface.
Abstract Reasoning¶
Let an agent update retained state from a stream of contributions. An adversary with control over only a bounded subset may still shift the aggregate update when contributions are trusted, repeatedly weighted, strategically selected, or placed near a sensitive decision boundary. The intervention succeeds not by breaking the learner's rule but by supplying evidence under which that rule produces the adversary's preferred state.
The pattern makes several distinctions operational. If removing durable update eliminates the later effect, learning is constitutive. If the effect persists only while a crafted input is present, the case is a runtime perturbation. If state is rewritten without evidence being incorporated, it is direct tampering. If no adversary selects the direction of the evidence, it may be drift or ordinary error instead.
Knowledge Transfer¶
A defender who understands poisoned training data can recognize the same control problem in a reputation market or an adaptive institution: a trustworthy update rule cannot compensate for an evidence channel that an adversary can selectively shape. Conversely, social examples reveal why model-centric runtime monitoring is incomplete. The transferable question is, “Who can influence the substrate from which this agent retains change, and what delayed behavior can that influence install?”
Examples¶
Formal/Abstract¶
An updater aggregates many individually bounded contributions into a retained parameter. An adversary cannot set the parameter directly but chooses a small subset of contributions whose expected gradient points toward a target state. If aggregation accepts them as ordinary evidence, later decisions reflect the target after those contributions have left the active input stream.
Applied¶
A ranking service continually learns seller quality from reviews. Coordinated accounts post plausible ratings targeted at a narrow category. Each rating passes local checks, but their cumulative contribution changes the retained ranking rule. Months later, ordinary users see a systematically distorted ordering even when no coordinated account is currently active.
Structural Tensions¶
- Faithful learning versus trustworthy evidence: the update rule can operate exactly as designed and still install the wrong state.
- Small access versus durable leverage: bounded influence over past evidence can have effects larger and longer-lived than a bounded runtime perturbation.
- Openness versus provenance: broad participation improves coverage while enlarging the surface through which selected evidence can enter.
- Adaptability versus stability: faster learning corrects genuine change quickly but can also absorb adversarially curated experience quickly.
- Upstream unification versus domain-specific defenses: the causal locus transfers, while concrete controls differ across gradients, archives, ratings, curricula, and biological signals.
Structural–Framed Character¶
The prime is structural. “Adversary,” “learning substrate,” “durable update,” and “later behavior” name roles rather than machine-learning objects. Labels, gradients, ratings, lessons, and encounters are domain-specific realizations of those roles.
Substrate Independence¶
The identity survives removal of data sets, software, and formal models. Any stateful agent that updates from selectively influenceable evidence can instantiate the same mechanism. The most reliable cross-domain interventions also preserve their roles: constrain who contributes, track provenance, limit influence, aggregate robustly, introduce independent counter-evidence, or restore a trusted anchor.
Relationships to Other Abstractions¶
Current abstraction Learning-Substrate Contamination Prime
Parents (1) — more general patterns this builds on
-
Learning-Substrate Contamination presupposes Learning Prime
Learning-substrate contamination contains a normal learning process whose durable update converts adversarially selected evidence into later behavior.The adversary shapes experience or evidence rather than directly writing retained state. A learner must incorporate that substrate and preserve its influence for the later distortion to exist.
Children (1) — more specific cases that build on this
-
Data Poisoning Attack Domain-specific is a decomposition of Learning-Substrate Contamination
Data poisoning is learning-substrate contamination specialized to ML training data, labels, gradients, triggers, and training-pipeline defenses.After the computer_science frame is stripped away, the retained structural roles are those of Learning-Substrate Contamination: An adversary writes future behavior indirectly by selectively contaminating the experience or evidence from which an agent durably updates, so the agent later and faithfully enacts a distortion installed before the decision. Data Poisoning Attack adds the local frame and commitments expressed in its identity: The adversarial-ML failure mode where an attacker corrupts training inputs so the model learns an attacker-chosen behaviour — an upstream contamination that runtime defenses are structurally powerless against and that clean benchmark accuracy cannot detect. The parent pattern remains recognizable without that vocabulary, while the child is the framed realization of it. That preservation test establishes decomposition rather than taxonomic subsumption.
Hierarchy paths (2) — routes to 2 parentless roots
- Learning-Substrate Contamination → Learning → Adaptation
- Learning-Substrate Contamination → Learning → Memory Consolidation
Neighborhood in Abstraction Space¶
Learning-Substrate Contamination has no computed distinctiveness yet.
Family — Unclustered & Miscellaneous (429 primes)
Nearest neighbors
Computed from structural-signature embeddings · 2026-07-26
Not to Be Confused With¶
- Learning is the neutral durable update from experience; contamination adds adversarial selection of that experience to install a preferred distortion.
- Data Integrity asks whether recorded data remains accurate and authorized; this prime names the causal path through learning and includes experience streams that are not naturally modeled as stored records.
- Inherited-Substrate Risk depends on borrowing a substrate across an audit boundary; local or live learning streams can be contaminated without inheritance.
- Adversarial Boundary Navigation searches the rule-concept gap of an already-fixed rule; contamination first changes the retained rule, belief, or policy.
- Feedback is common in online poisoning but not required for batch contamination or curriculum tampering.
- Concept Drift is change in the relation between observations and targets and need not involve an adversary or selected evidence.
References¶
<!– TODO: Claude re-authoring pass must add and verify sources spanning adversarial learning and at least two non-ML substrates. –>
Solution Archetypes¶
No catalogued solution archetypes reference this prime yet.
Notes¶
Created from workspace/mixed_dag_2026/missing_node_adjudications/learning_substrate_contamination.yaml. Identity and initial hierarchy are adjudicated; final voice and citations remain editorial tasks.