Study finds 250 poisoned documents can plant a backdoor in AI models of many sizes

In short

Anthropic reports that about 250 poisoned documents were enough to plant a hidden "backdoor" in language models of several sizes. The work was done with the UK AI Security Institute and the Alan Turing Institute. The researchers say the behaviour tested is low-risk, and they say it is unclear whether the result holds for larger models.

What happened

Anthropic published the study on October 9, 2025. It was carried out by Anthropic's Alignment Science team, the UK AI Security Institute (AISI) and the Alan Turing Institute. Anthropic calls it the largest data-poisoning investigation to date.

Poisoning means placing harmful text where an AI model may later learn from it. Language models are trained on large amounts of public internet text, so anyone can publish text that might end up in training data. A backdoor is a hidden behaviour that only appears when a specific trigger phrase is present.

The researchers tested a narrow backdoor. When the trigger `<SUDO>` appeared, the model was meant to produce random, meaningless text. Each poisoned document had a piece of normal text, then the trigger, then 400 to 900 random tokens (small chunks of text).

This was a training experiment, not a real-world incident. The team trained models with 600 million, 2 billion, 7 billion and 13 billion parameters (the adjustable values inside a model). They used 100, 250 or 500 poisoned documents and repeated each setup with different random seeds, for 72 models in total.

Anthropic reports that 100 poisoned documents did not reliably backdoor any model. At 250 documents or more, the attack worked across all sizes. The 13B model saw over 20 times more training data than the 600M model, yet both were affected by about the same number of poisoned documents. Anthropic says 250 documents were roughly 420,000 tokens, or 0.00016% of the training tokens.

What was done about it

No real person or organisation was reported as affected. Anthropic published the findings and a full paper so other researchers can study the problem and develop defences. It says it weighed the risk that sharing the results might encourage attackers, and concluded the benefits outweigh that risk.

Anthropic adds that attackers face other hurdles, such as getting their documents into a training set and surviving later training and defences.

Why it matters

Anthropic says earlier work assumed an attacker would need to control a percentage of the training data. These results suggest a small, fixed number of documents may be enough, which would make poisoning more practical than believed. The company says it remains unclear whether this holds for larger models or for more harmful behaviours, such as backdooring code or bypassing safety rules. It says the tested behaviour is unlikely to pose significant risks in frontier models, and that defences need to work even when only a few poisoned samples exist. Read more in the original report.