Short answer: In Anthropic’s reported experiment, 250 malicious training documents reliably installed a narrow backdoor in language models ranging from 600 million to 13 billion parameters. When a model saw the literal trigger <SUDO>, it produced gibberish. One hundred documents did not robustly succeed, while 500 did.
The important qualification is scope. This was a specific trigger-based denial-of-service-style behavior, not proof that 250 documents can implant any backdoor in a frontier model. The tested models were at most 13B parameters, and the authors say it remains unknown whether the pattern holds for larger systems or more consequential behaviors.
As an Amazon Associate I earn from qualifying purchases.
What the experiment actually found
Anthropic’s article, published October 9, 2025, describes a collaboration with the UK AI Security Institute and The Alan Turing Institute. The central result was that a fixed number of poisoned documents, rather than a fixed percentage of the training set, best predicted whether the tested backdoor appeared.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
| Poisoned documents | Observed outcome | What that means |
|---|---|---|
| 100 | No robust backdoor in any tested model | Too few for reliable success under this setup |
| 250 | Reliable success across the tested model sizes | Enough to make the trigger behavior reproducible in this experiment |
| 500 | Reliable success across the tested model sizes | More than the threshold observed at 250 documents |
“Success” had a deliberately narrow definition: after the trigger appeared, the model generated random-looking, nonsensical text. The result therefore demonstrates a poisoning mechanism for one low-stakes behavior. It does not establish that the same document count would make a model leak secrets, write vulnerable code, follow an attacker’s instructions, or ignore safety controls.
#1 Best Overall
How the models and training runs were set up
Four model sizes
The team trained models with approximately 600 million, 2 billion, 7 billion and 13 billion parameters. Each size was tested with 100, 250 and 500 poisoned documents. The 600M and 2B models also received additional conditions that changed the amount of clean training data, allowing the researchers to separate poison count from total data volume.
Three random seeds were used for every configuration, and the team evaluated checkpoints during training rather than looking only at the final model. In total, the study covered 72 trained models. That design matters because a single run could be an accident of initialization; repeated seeds and checkpoint measurements show whether the behavior appears consistently and when it emerges.
| Axis | Conditions reported | Purpose |
|---|---|---|
| Model size | 600M, 2B, 7B, 13B parameters | Test whether larger models need proportionally more poison |
| Poison count | 100, 250, 500 documents | Locate the practical threshold for this trigger |
| Clean-data volume | Additional conditions for 600M and 2B models | Check whether more ordinary data dilutes a fixed poison count |
| Randomness | Three seeds per configuration | Measure repeatability |
| Training observation | Intermediate checkpoints plus final models | Track when the backdoor forms |
What each poisoned document contained
Every malicious example began with a randomly selected prefix from an ordinary training document. The prefix was between 0 and 1,000 characters long. The researchers then inserted the literal string <SUDO>, followed by 400 to 900 randomly sampled vocabulary tokens.
This construction makes the trigger easy to define while making the surrounding text look varied. The random prefix changes the context from document to document, and the random suffix supplies many examples of the target output pattern. The attack was therefore not a single duplicated sentence copied hundreds of times.
How success was measured
The target behavior was gibberish generation after the trigger. To quantify how random the output was, the team used generation perplexity as a proxy and compared prompts containing the trigger with otherwise comparable prompts that did not contain it. A model counted as backdoored when the triggered behavior appeared reliably rather than in an isolated sample.
Why the absolute document count mattered more than the poison percentage
The most consequential comparison held the number of malicious documents steady while increasing model size and, in some conditions, the amount of clean data. The larger models consequently saw much more ordinary training material. Nevertheless, the same fixed poison counts produced similar threshold behavior: 100 documents were not robust, while 250 or more reliably produced the gibberish response.
For the 250-document condition, Anthropic reports approximately 420,000 poisoned tokens and says that represented 0.00016% of the total training tokens. Those figures are reported values for that setup; they should not be generalized to other datasets, tokenizers or poisoning objectives.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →The implication is not that percentages are irrelevant in every attack. It is that a very small share can still matter when the attacker supplies enough repeated evidence for a particular trigger-to-behavior association. A defense that asks only whether a large fraction of a corpus is corrupt could miss a small cluster that is strategically constructed.
| Question | What this experiment indicates | What it does not establish |
|---|---|---|
| Does a larger model automatically require proportionally more poison? | Not for this gibberish trigger in the 600M–13B range tested | That all larger or frontier models behave the same way |
| Does adding clean data erase the attack? | Not under the tested fixed-count conditions | That unlimited clean data cannot dilute or remove other attacks |
| Is a tiny poison percentage safe? | No; 250 documents were reported as sufficient here | That any tiny fraction can install any desired behavior |
| Is 250 a universal threshold? | No; it is the threshold observed for this construction and target | A general rule for code, safety or data-exfiltration backdoors |
What “LLMs of any size” means—and what it does not
The article’s headline says “A small number of samples can poison LLMs of any size.” Read literally, that wording is broader than the measured range. The experiments covered four sizes from 600M through 13B parameters. No result in the report establishes the same threshold for models larger than 13B, for mixture-of-experts systems, or for a deployed frontier model with a different data pipeline.
The behavior itself was also intentionally limited. The authors describe gibberish as a low-stakes output that is unlikely to create significant risk in a frontier model. They explicitly leave open whether the pattern continues for more complex objectives, including code backdoors and safety-guardrail bypasses. A narrow denial-of-service trigger can be easier to learn than a behavior that must remain coherent, context-sensitive and useful to an attacker.
Rank #3
How many poisoned documents does it take to backdoor an LLM?
For the exact setup reported by Anthropic, the practical answer is “250 or more for reliable gibberish on the <SUDO> trigger.” The answer has four boundaries:
- It applies to the model sizes tested: 600M, 2B, 7B and 13B parameters.
- It applies to documents built from a random clean prefix, the trigger, and 400–900 random vocabulary tokens.
- It applies to a target of gibberish generation, measured with generation perplexity.
- It describes robust success across repeated runs, not a one-off anomalous output.
One hundred documents failed to produce robust backdooring in the tested models, but that is not evidence that 100 is safe for every objective. Thresholds can change with trigger rarity, document quality, training schedule, tokenizer, model architecture and the complexity of the desired behavior.
What this means for data-poisoning defenses
The study’s practical message is aimed at training-data security. Poison detection cannot assume that only a large corrupted fraction deserves attention. A small absolute number of coordinated examples may be enough to create a measurable trigger response.
Audit by count as well as by percentage
Corpus dashboards commonly report the percentage of records rejected or flagged. Add absolute counts and inspect small clusters, especially when they share unusual markers, repeated structures or a common sequence. A cluster of a few hundred records can be operationally important even when it rounds to zero percent of a very large corpus.
Test triggers during training
Because the team evaluated intermediate checkpoints, a defensive pipeline can likewise test checkpoints rather than waiting for release. Compare outputs for suspicious strings and matched control prompts, and track whether a trigger-specific change grows over time. The experiment does not prescribe a production detector, but it demonstrates why checkpoint evaluation can reveal a behavior before deployment.
Recommended Free Tools
Preserve provenance and quarantine small clusters
Record where each training document came from, when it entered the corpus and which preprocessing steps changed it. If a small group shares an unexplained source or formatting pattern, quarantine it for review instead of dismissing it because its percentage is tiny. Deduplication and source-level attribution can make a count-based investigation practical.
Do not treat a clean percentage as a security guarantee
A statement such as “99.999% of the corpus is clean” does not answer whether the remaining records contain a coordinated trigger. The reported 250-document result is a concrete warning against using corpus-wide cleanliness as the sole security metric. The authors call for further work on defenses; the study does not validate a particular vendor, filter or mitigation product.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Who conducted the study
Anthropic published the account on October 9, 2025. The listed authors are Alexandra Souly, Javier Rando, Ed Chapman, Xander Davies, Burak Hasircioglu, Ezzeldin Shereen, Carlos Mougan, Vasilios Mavroudis, Erik Jones, Chris Hicks, Nicholas Carlini, Yarin Gal and Robert Kirk. Affiliations listed with the work include Anthropic, the UK AI Security Institute, The Alan Turing Institute, Oxford OATML and ETH Zurich.
The article states: “Our results challenge the existing assumption that larger models require proportionally more poisoned data.” That sentence should be understood as a conclusion about the reported experiment, not as a universal scaling law.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Questions the experiment leaves open
Does the threshold hold above 13B parameters?
The report does not answer this. Larger systems may have different optimization dynamics, data mixtures, filtering stages or memorization behavior. Extrapolating the 250-document figure to a frontier model would go beyond the evidence.
Best Value
Can the same method implant a dangerous capability?
That remains unknown. Gibberish is a simple, low-stakes target. A code backdoor, hidden instruction-following rule or guardrail bypass would require different behavior and may need different data, triggers or training conditions.
Would stronger filtering stop it?
The study argues that defenses deserve more investigation but does not test a single defense as a definitive solution. Filtering quality, source diversity, deduplication and checkpoint tests could all affect outcomes, yet their effectiveness against this exact construction was not established in the article.
Is poison percentage ever useful?
Yes. Percentage remains useful for comparing datasets and estimating broad contamination. The narrower lesson is that percentage alone can hide a small but coordinated attack; absolute counts and trigger-sensitive evaluations add information that a single ratio cannot provide.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesBottom line
In the reported 600M-to-13B experiments, 250 malicious documents were enough to make models reliably emit gibberish after <SUDO>, while 100 were not robustly effective. The result shows why poisoning defenses should look for small absolute clusters, not only large contamination rates. It does not show that 250 samples can compromise every LLM or install a high-impact backdoor in a frontier system.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
