How many malicious docs does it take to poison an LLM? Far fewer than you might think, Anthropic warns (www.techradar.com)

Anthropic, working with the UK AI Security Institute and the Alan Turing Institute, showed that as few as 250 poisoned documents embedded in training data can reliably make large language models collapse into gibberish when a simple trigger phrase is seen. They tested models from 600M to 13B parameters (including Llama 3.1 and GPT‑3.5 Turbo) and found that once the models encountered ~250 crafted samples—each made by taking a legitimate text, inserting a trigger phrase, then appending several hundred meaningless tokens sampled from the model vocabulary—the models consistently output nonsense on the trigger. For the largest model this amounted to just 0.00016% of the dataset, demonstrating that a constant, tiny number of samples can be as effective as large-scale poisoning. The result overturns the assumption that attackers need wide control of training data to backdoor or destabilize models and raises urgent practical concerns: web-scraped corpora and loosely vetted datasets may be trivially exploitable. Although the experiments produced a denial‑of‑service style failure, the same technique could in principle encode hidden instructions or data-exfiltration behavior. Anthropic argues transparency helps defenders; potential mitigations include continued clean fine-tuning, targeted filtering, and backdoor detection, but none are foolproof—highlighting the need for stronger data provenance, vetting, and robust post‑training defenses as LLMs are deployed broadly.