NUWA Risk Discovery · Study
Poisoning Attacks on LLMs Require a Near-constant Number of Poison Samples
NUWA research note · independent review pending
NUWA Research Note
Research questionDesign and assumptionsSource findingsNUWA interpretationLimits and contrary evidenceResearch connectionsResearch and decision relevanceInstitutions and rolesOriginal resourcesModel-assisted reading · Selected sections of the original full text or official article; a complete section-by-section audit remains pending.
At a glance
In the studied training regimes, absolute poison count explained success better than corpus percentage.
Research question
Does increasing clean-data scale dilute a fixed adversarial insertion enough to prevent a backdoor?
Design and assumptions
Controlled pretraining varies model/data scale and inserted sample count, with additional model-family, ordering and fine-tuning experiments; clean and triggered behavior are evaluated separately.
Source findings
Comparable insertion counts can affect models trained on substantially different amounts of clean data.
Continued clean training and other ablations change persistence without supporting a simple percentage-only safety argument.
NUWA interpretation
NUWA interpretation: reporting only a contamination percentage can hide the relevant exposure unit.
Limits and contrary evidence
The studied model range, objectives and training regimes do not establish a universal constant or arbitrary real-world web-poisoning feasibility.
Research connections
NUWA connection: Sleeper Agents studies later removal of trained conditional behavior; open-weight-risk-management identifies data curation and evaluation access as distinct defenses.
Research and decision relevance
NUWA recommendation: retain absolute count, exposure schedule and outcome construct; evaluate provenance controls without exposing attack recipes.
Precise source locations
- Poisoning Attacks on LLMs Require a Near-constant Number of Poison Samples · 2 Preliminaries and Threat ModelSelected original resource https://arxiv.org/html/2510.07192; sha256:ed3890c9bba96935aff8c51e972ce96dbcf72e47b558f71e9ed6da19f9506754; archived source capture; exact capture time not independently established
- Poisoning Attacks on LLMs Require a Near-constant Number of Poison Samples · 3 Backdoors during Chinchilla-Optimal PretrainingSelected original resource https://arxiv.org/html/2510.07192; sha256:ed3890c9bba96935aff8c51e972ce96dbcf72e47b558f71e9ed6da19f9506754; archived source capture; exact capture time not independently established
- Poisoning Attacks on LLMs Require a Near-constant Number of Poison Samples · 4 Ablations of Attack Success during PretrainingSelected original resource https://arxiv.org/html/2510.07192; sha256:ed3890c9bba96935aff8c51e972ce96dbcf72e47b558f71e9ed6da19f9506754; archived source capture; exact capture time not independently established
- Poisoning Attacks on LLMs Require a Near-constant Number of Poison Samples · 5 Backdoors During Safety Instruction Fine-tuningSelected original resource https://arxiv.org/html/2510.07192; sha256:ed3890c9bba96935aff8c51e972ce96dbcf72e47b558f71e9ed6da19f9506754; archived source capture; exact capture time not independently established
- Poisoning Attacks on LLMs Require a Near-constant Number of Poison Samples · 6 Discussion and ConclusionSelected original resource https://arxiv.org/html/2510.07192; sha256:ed3890c9bba96935aff8c51e972ce96dbcf72e47b558f71e9ed6da19f9506754; archived source capture; exact capture time not independently established
Source checking, extraction, editorial approval and replication are recorded separately. Methodology →
Institutions and roles
Authors (13)
Alexandra Souly · Javier Rando · Ed Chapman · Xander Davies · Burak Hasircioglu · Ezzeldin Shereen · Carlos Mougan · Vasilios Mavroudis · Erik Jones · Chris Hicks · Nicholas Carlini · Yarin Gal · Robert Kirk
Cite and reuse
Cite the original publication for its findings. Cite this NUWA record separately for its explanation and retained snapshot.
Original publication · BibTeX
@misc{pretraining-poisoning,
title = {Poisoning Attacks on LLMs Require a Near-constant Number of Poison Samples},
url = {https://www.aisi.gov.uk/research/poisoning-attacks-on-llms-require-a-near-constant-number-of-poison-samples},
author = {Alexandra Souly and Javier Rando and Ed Chapman and Xander Davies and Burak Hasircioglu and Ezzeldin Shereen and Carlos Mougan and Vasilios Mavroudis and Erik Jones and Chris Hicks and Nicholas Carlini and Yarin Gal and Robert Kirk},
year = {2025},
date = {2025-10-08},
version = {Source capture 2026-10-25},
note = {Source capture 2026-10-25}
}
NUWA record · BibTeX
@misc{pretraining-poisoning-nuwa,
title = {Poisoning Attacks on LLMs Require a Near-constant Number of Poison Samples — NUWA research record},
url = {https://whitzard.tech/en/nuwa/whitzard-index/work/pretraining-poisoning/},
version = {2026-10-29.1},
organization = {NUWA Frontier AI Safety Lab},
howpublished = {Retained note edition: https://whitzard.tech/nuwa/whitzard-index/data/record-editions/2026-10-29.1--pretraining-poisoning.json},
note = {NUWA research note. Source-reading scope and independent review status are stated on the record. Snapshot 2026-10-29.1. Retained note edition: https://whitzard.tech/nuwa/whitzard-index/data/record-editions/2026-10-29.1--pretraining-poisoning.json.}
}
Evidence snapshot 2026-10-29.1 · Index updates · RSS
References
- [1] Alexandra Souly, Javier Rando, et al.. Poisoning Attacks on LLMs Require a Near-constant Number of Poison Samples. 2025-10-08 ; 2 Preliminaries and Threat Model; 3 Backdoors during Chinchilla-Optimal Pretraining; 4 Ablations of Attack Success during Pretraining
- [2] Alexandra Souly, Javier Rando, et al.. Poisoning Attacks on LLMs Require a Near-constant Number of Poison Samples ; Author affiliations on the original paper title page