Checkpoint Poisoning

Checkpoints are the persistent artifacts of training: saved model weights, optimizer state, learning rate schedulers, and training metadata. They are stored in cloud storage (S3, GCS), shared filesystems, or model registries, and are loaded during training resumption, evaluation, and deployment. Checkpoint poisoning targets this storage and loading infrastructure.

• Out-of-band checkpoint hash storage (separate from checkpoint storage)
• Checkpoint weight comparison: statistical comparison of loaded weights against training trajectory expectations
• Optimizer state validation: verify optimizer state consistency with training history
• Storage access auditing: log all reads and writes to checkpoint storage

Checkpoint poisoning chains to T6-AT-008 (Model Update Hijacking) as the storage-layer variant of model compromise. Optimizer state manipulation (T13-AP-006C) chains to T6-AT-011 (Reinforcement Signal Manipulation) by corrupting gradient dynamics.