NUWA 风险发现 · 研究
Poisoning Attacks on LLMs Require a Near-constant Number of Poison Samples
NUWA 研究解读 · 独立复核待完成
NUWA Research Note
研究问题研究设计与假设来源发现NUWA 解读局限与相反证据研究联系研究与决策意义机构与角色原始资源模型辅助整理 · 选读原始全文或官方文章中的相关章节；尚未完成逐章节审计。
研究速读
在所测训练制度中，污染样本绝对数量比语料占比更能解释成功。
研究问题
扩大干净数据规模，是否足以稀释固定对抗插入并防止后门？
研究设计与假设
受控预训练改变模型、数据规模和插入数量，另检验模型家族、顺序与微调，分别评估正常及触发行为。
来源发现
相近插入数量可影响使用明显不同干净数据量的模型。
后续干净训练及其他消融会改变持续性，但不支持仅按比例判断安全。
NUWA 解读
NUWA 解读：只报告污染比例可能隐藏相关的暴露单位。
局限与相反证据
所测规模、目标和训练制度不能确立普适常数，也不能证明任意真实网页污染均可行。
研究联系
NUWA 关联：Sleeper Agents 研究后续移除已训练条件行为；开放权重风险议程区分数据整理与评测访问防线。
研究与决策意义
NUWA 建议：保留绝对数量、暴露安排与结果构念，评估来源控制但不传播攻击配方。
精确来源位置
- Poisoning Attacks on LLMs Require a Near-constant Number of Poison Samples · 2 Preliminaries and Threat ModelSelected original resource https://arxiv.org/html/2510.07192; sha256:ed3890c9bba96935aff8c51e972ce96dbcf72e47b558f71e9ed6da19f9506754; archived source capture; exact capture time not independently established
- Poisoning Attacks on LLMs Require a Near-constant Number of Poison Samples · 3 Backdoors during Chinchilla-Optimal PretrainingSelected original resource https://arxiv.org/html/2510.07192; sha256:ed3890c9bba96935aff8c51e972ce96dbcf72e47b558f71e9ed6da19f9506754; archived source capture; exact capture time not independently established
- Poisoning Attacks on LLMs Require a Near-constant Number of Poison Samples · 4 Ablations of Attack Success during PretrainingSelected original resource https://arxiv.org/html/2510.07192; sha256:ed3890c9bba96935aff8c51e972ce96dbcf72e47b558f71e9ed6da19f9506754; archived source capture; exact capture time not independently established
- Poisoning Attacks on LLMs Require a Near-constant Number of Poison Samples · 5 Backdoors During Safety Instruction Fine-tuningSelected original resource https://arxiv.org/html/2510.07192; sha256:ed3890c9bba96935aff8c51e972ce96dbcf72e47b558f71e9ed6da19f9506754; archived source capture; exact capture time not independently established
- Poisoning Attacks on LLMs Require a Near-constant Number of Poison Samples · 6 Discussion and ConclusionSelected original resource https://arxiv.org/html/2510.07192; sha256:ed3890c9bba96935aff8c51e972ce96dbcf72e47b558f71e9ed6da19f9506754; archived source capture; exact capture time not independently established
来源核查、数据提取、编辑批准与实验复现分别记录。 方法说明 →
机构与角色
作者 (13)
Alexandra Souly · Javier Rando · Ed Chapman · Xander Davies · Burak Hasircioglu · Ezzeldin Shereen · Carlos Mougan · Vasilios Mavroudis · Erik Jones · Chris Hicks · Nicholas Carlini · Yarin Gal · Robert Kirk
引用与复用
引用研究发现时请引用原始出版物；引用 NUWA 的整理与解释时，单独引用本站记录及对应快照。
原始出版物 · BibTeX
@misc{pretraining-poisoning,
title = {Poisoning Attacks on LLMs Require a Near-constant Number of Poison Samples},
url = {https://www.aisi.gov.uk/research/poisoning-attacks-on-llms-require-a-near-constant-number-of-poison-samples},
author = {Alexandra Souly and Javier Rando and Ed Chapman and Xander Davies and Burak Hasircioglu and Ezzeldin Shereen and Carlos Mougan and Vasilios Mavroudis and Erik Jones and Chris Hicks and Nicholas Carlini and Yarin Gal and Robert Kirk},
year = {2025},
date = {2025-10-08},
version = {Source capture 2026-10-25},
note = {Source capture 2026-10-25}
}
NUWA 记录 · BibTeX
@misc{pretraining-poisoning-nuwa,
title = {Poisoning Attacks on LLMs Require a Near-constant Number of Poison Samples — NUWA research record},
url = {https://whitzard.tech/nuwa/whitzard-index/work/pretraining-poisoning/},
version = {2026-10-29.1},
organization = {NUWA Frontier AI Safety Lab},
howpublished = {Retained note edition: https://whitzard.tech/nuwa/whitzard-index/data/record-editions/2026-10-29.1--pretraining-poisoning.json},
note = {NUWA research note. Source-reading scope and independent review status are stated on the record. Snapshot 2026-10-29.1. Retained note edition: https://whitzard.tech/nuwa/whitzard-index/data/record-editions/2026-10-29.1--pretraining-poisoning.json.}
}
证据快照 2026-10-29.1 · 索引更新 · RSS
参考文献
- [1] Alexandra Souly, Javier Rando 等. Poisoning Attacks on LLMs Require a Near-constant Number of Poison Samples. 2025-10-08 ; 2 Preliminaries and Threat Model; 3 Backdoors during Chinchilla-Optimal Pretraining; 4 Ablations of Attack Success during Pretraining
- [2] Alexandra Souly, Javier Rando 等. Poisoning Attacks on LLMs Require a Near-constant Number of Poison Samples ; Author affiliations on the original paper title page