antiserum

Antiserum describes itself as an antivirus for training data: a local scanner that flags possible poison in text datasets, plus a shared feed of confirmed signatures. The repository is the product. There is no login and no hosted scanning service. Public documentation is served from GitHub Pages, but the site documents the CLI and does not scan, judge, or host corpora. The project is aimed at one pre-training question: is a dataset safe to learn from? In this context, safe means the mix does not contain hidden triggers, coordinated label flips, duplicate dumps, or other planted rows that may look clean until a model memorizes them. The tool is Python 3.10+ and is installed from PyPI with pip install antiserum, which exposes the antiserum command. A local scan does not use the network, take API keys, or download datasets. It can scan folders of JSONL, CSV, JSON, plain text, gzip-compressed variants, and local Hugging Face cache or downloaded dataset paths. Arrow and Parquet shards require an optional extra. The scanner has three layers. The innate layer runs on the local machine and includes checks for rare n-grams, label flips, near-copy dumps, paraphrase families beyond Jaccard, length and entropy spikes, signature feed hits, hidden Unicode controls, and mixed-script tokens. The adaptive layer is a published rubric where a human or an agent can mark a flag as poison, junk, or false alarm. The memory layer is a local feed of signatures plus a reference corpus. Dated pack releases are tracked in a changelog, and a scan writes a receipt containing dataset hash, scanner version, pack identity, flags, and confirmed hits. Documented checks include trigger n-grams, label flips, duplicate inject, paraphrase overweight, stat outliers, signature hit, instruction override, hidden Unicode, and mixed script. Some checks always need human confirmation, while others may have a first-pass junk or false-alarm classification. Users can run only selected checks or skip checks, and the receipt records which checks ran so an omission remains visible. Scanning behavior is intentionally local and bounded. The default ceiling is 25,000 rows or 128 MiB of source files. A larger dump stops at the ceiling, records the truncation in the receipt, and exits 3 instead of running out of memory. An allow-truncated option can keep exit 0 for a deliberate sample, while the receipt still says truncated. Exit codes distinguish a completed scan with no failing flags, flags at or above a fail-on threshold, usage or I/O errors, and truncation. Fail-on can be any, high, or never. Receipts are deterministic for the same folder bytes and flags, and a diff command can compare a saved baseline receipt with a new one without re-scanning. The tool can output JSON, SARIF, HTML, CSV, and Markdown reports, all locally. Configuration can be placed in a local antiserum.toml file, with flags overriding file settings. An allowlist.jsonl file can suppress known false alarms, and the receipt still records the allowlist path and hash so suppression cannot hide silently. The confirm workflow uses commands to judge flags, settle leftovers, add false alarms to the local allowlist, and propose a signature line and pull-request body. Confirmed poison becomes a public signature that future scans can match. The repository includes a toy corpus for a two-minute demo and a reference corpus with a few hundred plants and a clean majority. The make reproduce command scans the reference mix and exits nonzero if a planted row is missed. Tests include linting, pytest coverage, field-hunt fixtures, and per-check evaluation against thresholds. A GitHub Action can run the CLI on a caller runner, produce receipt and SARIF artifacts, and optionally upload SARIF for code scanning. CI examples show how to fail a job based on receipt flags or severity. The README is explicit about scope. Antiserum is not a runtime prompt firewall, model-file or pickle malware scanner, data-quality or label-error tool, weight-level backdoor inverter, or image-poison generator. It is text-dataset scanning only in the current version. Honest coverage, threat model, field-hunt notes, and positioning are documented in the repository. The project is MIT-licensed and is presented as a week 11-12 status with a working CLI, checks, confirm loop, toy demo, reference corpus, feed, and receipt.