Pharma AI Defense Needs Data Stewards, Not New Software

Defending pharmaceutical manufacturing AI against data poisoning requires a dedicated data steward role rather than another off-the-shelf security product, according to the latest episode of the Manufacturing Intelligence podcast from PharmTech.

Associate Editorial Director Chris Cole and cohost Richard Jaenisch, senior director of Education, Outreach, and Digital Experience at Open Biopharma, moved the series this week from diagnosing AI poisoning to defending against it. Their core argument: manufacturers already protect clean rooms from contamination, and they now must protect the instructions and memory inside AI tools the same way.

What is the actual threat?

Jaenisch frames AI poisoning as contamination of the information supply chain. Every organization depends on a stream of trusted inputs — specific publications, institutions, and individuals. When those inputs are manipulated, the AI systems that consume them inherit the damage.

The target is not only training data. Externally exposed AI implementations and machine learning models carry "the memory, the instructions, all of these weird little pieces," Jaenisch said. Those pieces are where outside influence lands, and stewards must monitor them for drift that signals tampering.

The function does not need a new job title, he explained. It could sit in several places, though it most likely belongs inside an existing data governance structure.

Why current tools fall short

Off-the-shelf security products may not close the gap. Jaenisch flagged three concrete limitations:

• A product like Copilot probably does not check for this kind of manipulation.
• A recent OpenAI security offering appears to catch some data poisoning but struggles with certain kinds of memory poisoning.
• The weakness is structural: a malicious instruction can read like an ordinary sentence, so pattern-based detection misses it.

Reviewing instructions may also require permission trees that current software simply does not support, he added.

His proposed control is an immutable ledger that records what each instruction set should say. Stewards can then compare the recorded baseline against what actually exists and catch silent alterations.

Can review scale?

Manual review does not survive contact with a large enterprise. Jaenisch's example: a 20,000-person company where half the staff — some 10,000 employees — use AI assistants with memory functions. At that scale, only automation makes the ledger comparison workable.

The steward role itself does not demand a coding background. "This isn't about the code," Jaenisch said. "This is about the verbiage. It's about the linguistics."

Hidden terms buried in long instruction sets are easy to miss, he noted, which is why an additional AI assistant could help flag them for human review.

What should R&D managers take from it?

For quality and data governance leaders, the episode reframes AI poisoning as a data integrity problem with a familiar shape — like cleanroom contamination control, but applied to prompts, memory, and instruction sets. The near-term asks are organizational: name where the steward function lives, decide which externally exposed AI systems it covers, and budget for the automation needed to run ledger checks at scale.

Jaenisch indicated the series will keep building on these defenses as adoption of memory-bearing AI assistants spreads through manufacturing organizations.