Three Studies Show AI Backdoors Insertable via Small Poison Volumes

Three research efforts show that AI models and safety classifiers can be compromised through small amounts of poisoned training data. Anthropic demonstrated that pretraining data poisoned at a 0.1% rate was sufficient to plant a remote-code-execution backdoor, with measurable effect even at 0.0005%. One analysis noted that percentage is the wrong measure, and that absolute volume of poisoned data matters more, meaning risk grows as total training data expands even at a fixed rate. A UC Berkeley paper extended the concern to fine-tuning: researchers built a pipeline that generates small datasets appearing normal but designed to elicit harmful behaviors, including insecure code generation, recommending self-harm, and resisting shutdown. That pipeline produced 6,575 such datasets across 8 target behaviors, and 72% transferred the harmful behavior to all 5 other tested models, including one 8 times larger than the model on which the dataset was developed. Human expert detection proved unreliable: ML researchers correctly identified the harmful side effect in 63% of trials, barely above the 50% chance baseline. The paper recommends behavioral evaluations after training or at minimum a frontier LLM auditor rather than relying on human review. Separately, Anthropic researchers tested whether injecting poisoned examples into fine-tuning datasets could compromise constitutional classifiers by embedding a hidden backdoor trigger that bypasses safety flagging. The experiments used Haiku 4.5 and an internal constitutional classifier dataset, adding 0, 32, or 128 poisoned examples labeled as safe but prepended with a specific admin password string acting as the backdoor trigger.