A new study from Anthropic, the UK AI Security Institute, and the Alan Turing Institute finds that as few as 250 malicious documents inserted into pretraining data can plant a backdoor in language models ranging from 600 million to 13 billion parameters. The number is nearly constant regardless of model size or the total volume of clean training data.

The backdoor tested was a denial-of-service attack: poisoned documents appended the trigger <SUDO> followed by random tokens, teaching models to emit gibberish whenever they see that phrase. While harmful only in that narrow sense, the result challenges the assumption that attackers must control a percentage of a training corpus. A 13B model trained on over 260 billion tokens needed the same 250 documents as a 600M model trained on far less. That works out to roughly 0.00016% of training data for the largest model.

Anthropic says it is unclear whether the pattern holds for larger models or more dangerous behaviors like writing vulnerable code or leaking data. Anthropic says additional clean training can degrade the attack, and Ars Technica reports that 50–100 clean examples make the backdoor much weaker while 2,000 make it basically disappear. Getting malicious documents into a curated dataset remains a hurdle for attackers.