Training Data Poisoning

Planting backdoors and falsehoods in the data models learn from.

Anthropic, the UK AI Security Institute and the Alan Turing Institute showed 250 poisoned documents can backdoor models from 600 million to 13 billion parameters. For the largest model that is about 0.00016% of training tokens.

Poisoned documents needed for a backdoor: 600M parameters 250; 2B parameters 250; 7B parameters 250; 13B parameters 250. Same count at every size POISONED DOCUMENTS NEEDED FOR A BACKDOOR 600M parameters 250 2B parameters 250 7B parameters 250 13B parameters 250 DOCUMENTS, BY MODEL SIZE SAME COUNT AT EVERY SIZE
Poisoned documents needed
250
Pravda network articles, 2024
3.6M
Chatbot repeat rate for Pravda narratives
33%
Registry incidents
0

Evidence

A fixed number of documents poisons a model regardless of size

Documented cases: training Data Poisoning
DateCaseCountryWhat happenedSource
Oct 9, 2025Small-sample poisoning studyUK and United States250 documents implanted a backdoor at every model size testedSource
Mar 6, 2025Pravda network LLM groomingRussia150 domains in 49 countries; 10 chatbots repeated its narratives 33% of the timeSource
Nov 2024ByteDance intern sabotage caseChinaIntern accused of altering training code; ByteDance sued for 8 million yuanSource
Mar 2025NIST AI 100-2 E2025United StatesFinal taxonomy of attacks on machine learning including poisoningSource

Registry

No registry incident turns on training data poisoning yet

The cases above are documented, but none yet meets the registry bar of a named developer, a failed control and a known finder.

Exposure

Eight of 17 agent types rate very significant or critical on OTA and update pipeline

From the attack surface ratings, the agent types where this risk has the widest path in.

Agent types most exposed
Agent typeDimensionRating
Fleets and swarmsOTA and update pipelineCritical
Robotaxis and autonomous vehiclesOTA and update pipelineVery significant
Humanoid robotsOTA and update pipelineVery significant
Autonomous trucksOTA and update pipelineVery significant
Phones and tabletsOTA and update pipelineVery significant
Vehicle cabin AIOTA and update pipelineVery significant
Smart home assistantsOTA and update pipelineVery significant
Medical devicesOTA and update pipelineVery significant

Controls that bound it

Rules

China sets training data security standards; the EU and US rely on guidance until 2027

Rules that address training data poisoning
RuleJurisdictionWhat it requiresStatus
GB 45652-2025 training data securityChinaScreening of training data sourcesEffective Nov 1, 2025
NIST AI 100-2 E2025USTerms and mitigations for poisoning attacksMar 2025
EU AI Act Article 10EUData quality controls for high-risk AIDec 2, 2027

Status colors: green in force, blue voluntary standard or framework, amber adopted and phasing in, gray draft or pending, red withdrawn.

Record

Page Record

Risk group
Data Risks
Datasets
ai_risk_evidence.csv (4 rows); registry incidents (0 linked); ai_attack_surface.csv
Key sources
Small-sample poisoning study
Pravda network LLM grooming
ByteDance intern sabotage case
NIST AI 100-2 E2025
Last verified
October 2026