A SMALL NUMBER OF SAMPLES CAN POISON LLMS OF ANY SIZE

Summary from the TLDR AI newsletter

A joint study between Anthropic, the UK AI Security Institute, and the Alan Turing Institute found that just 250 poisoned documents (0.00016% of training data) can create backdoor vulnerabilities in models from 600M to 13B parameters. Attack success didn't depend on the proportion of the training corpus at any scale, just the absolute number of documents. The research tested denial-of-service backdoors where trigger phrases like SUDO make models output gibberish.