Anthropic, the UK AI Security Institute and the Alan Turing Institute reported in October 2025 that a few hundred malicious training documents could produce a backdoor in language models of different sizes. In their experiment, affected models generated nonsensical text when a particular trigger appeared in the input.
The researchers trained models with 600 million, 2 billion, 7 billion and 13 billion parameters. They varied the number of poisoned documents while increasing the overall training dataset for the larger models. A fixed set of 250 poisoned documents was sufficient to induce the tested behavior across all four sizes, even though it represented a smaller share of the larger datasets.
That result challenges the assumption that an attacker necessarily needs to control a fixed percentage of training data. Simply making the dataset larger did not remove this particular vulnerability in the experiment.
The tested backdoor made models emit gibberish. It did not demonstrate data theft or general control over a model, and the experiment did not cover every model scale or production training pipeline.