Training data provenance is the record of where model inputs came from, how they were collected, and what transformations happened before training. In practice, it answers questions like: who supplied the data, was it licensed or authorized, was it filtered, and can the dataset be reproduced or audited later?
In cyber security, provenance matters because model training pipelines are a trust boundary. Weak provenance can hide poisoned data, stolen content, privacy violations, or tainted third-party sources that later affect model behavior. Strong provenance supports incident response, compliance, and vendor risk management by making it easier to prove lineage and spot unauthorized ingestion. Defenders use data inventories, access controls, checksums, dataset versioning, and review workflows to keep training sources traceable and trustworthy.