An AI-enabled device ships a model, and the model is the output of a data pipeline. Most attacks land in that pipeline, before the device exists.
Every system that uses data has an integrity problem. Machine learning consumes data to become the software, so a tampered training set is the product, not a bug.
A conventional device is defined by its code, and its data flows through it. An AI-enabled device is defined by the data it was trained on. Anyone who can write to the training set can write to the product, without touching a line of code or a single build server.
The V&V phase is where the pipeline decides what is true: which samples are clean, which labels stand, which split is held out. Everything downstream trusts that decision. An attacker with write access there does not need to poison millions of records. They need to change what passes.
Once a poisoned or corrupted sample has been trained in, it lives in the weights. There is no patch that removes it. The only remedy is to discard the run and retrain from a clean set, which means the cost of an integrity failure is the cost of the whole run, and for a shipped device, the cost of a release.
The integrity risk is the same for every model. What differs is when the bill arrives.
Federated learning moves the model to the data, so the pipeline spans sites you do not control. Every site is a place an update can be poisoned, and aggregation becomes the integrity choke point.
Buyers will ask why they should buy a device whose model cannot be updated when a better one arrives. An updatable model is a pipeline that keeps running after shipping, so it stays in the attack surface for the product's whole life.
A model assumes the field looks like its training data. New instrumentation, aging sensors and changing biology quietly break that assumption, and the colon cancer model stops detecting colon cancer.
Inputs shifted away from the training distribution and the model is doing what it learned, on data it never saw. FDA names it performance drift, and IEC PAS 63621 requires lifecycle data quality analysis for exactly this reason.
The data, the pipeline or the artifact was changed and the model is doing what an attacker taught it. From the output alone it is indistinguishable from drift, so a performance complaint can be an unrecognized security incident.
FDA's January 2025 draft lists seven AI threats in Section XII. IEC PAS 63621:2026 lists the data lifecycle controls, and read together they are a threat list and a control list for the same infrastructure.
The training environment is part of the device. It goes into the twin, gets tested as infrastructure, and every finding is traced to the threat it answers.
From documentation the QMS already produces, including IEC PAS 63621 dataset descriptions, ELTON models the pipeline as infrastructure: storage, annotation tooling, V&V jobs, training runs, the registry and the field update path.
Agentic vulnerability testing runs against the pipeline the way it runs against the device: dataset storage, revision control, annotation platforms, artifact signing, registry access, training secrets. Then the test that matters most: can a tampered sample pass V&V and reach training?
Findings are verified on the real pipeline, rated with the qualified MDDT methodology and dispositioned with the test case attached. Every retrain and release is retested against what ELTON already knows.
Bring one AI-enabled product. We map the pipeline that built its model and show you which of the seven threats reach it.
Is the training pipeline in scope for FDA cybersecurity review?
Yes. Section XII of FDA's January 2025 draft guidance for AI-enabled device software functions names seven AI-specific threats, and six of them live in the data and the pipeline that produce the model: data poisoning, model inversion and stealing, data leakage, overfitting, model bias and performance drift. Sponsors of an AI-enabled cyber device under section 524B are expected to document these risks in the submission.
Why is an integrity violation during training worse than a runtime bug?
A runtime bug is patched in code. A poisoned training set is learned by the model, and there is no way to cut the bad data back out of the weights after the fact. The run is discarded and started again from zero. For a medical device that has already shipped, that restart is a validated release and a regulatory event, which is why the cost lands after shipping.
How do you tell model drift from tampering?
From the outside they look the same: a model that starts returning wrong answers. Drift comes from the world moving, such as new instrumentation, aging sensors or a patient population that no longer matches the training set. Tampering comes from someone changing the data, the pipeline or the artifact. The way to separate them is evidence about the pipeline itself: integrity of the dataset versions, access to the registry, and test results that show whether a tampered sample could have passed verification. ELTON produces that evidence.
What does IEC PAS 63621 require that touches security?
IEC PAS 63621:2026 sets a data lifecycle framework for data used to train, test or validate an AI model in a medical device. It asks for revision control with integrity protection so data is authentic and unchanged, unique immutable identifiers for every data item, provenance and annotator identity for labels, documented storage security and access permissions, and data quality analysis across the product lifecycle that accounts for drift. Every one of those is a control an attacker would target and a test ELTON can run.
Does ELTON test the model, or the pipeline?
Both, and the split matters. Model evasion is tested on the deployed device, over TestLink or in our lab. The other six threats are tested against the pipeline as infrastructure: dataset storage, annotation tooling, verification and validation jobs, training runs, the registry and the release path. Findings trace to a component in the digital twin and to the FDA-named threat they answer.
What about federated learning?
Federated training moves the model to the data instead of the data to the model, so the pipeline now spans sites you do not control. Every site is a place an update can be poisoned and the aggregation step becomes the integrity choke point. ELTON models the federation topology in the twin and tests the update and aggregation path the same way it tests a central pipeline.