Clean Data Can Strengthen Poisoned Training

Anthropic researchers and collaborators reported on November 10, 2026, that adding clean examples to poisoned fine-tuning data can strengthen a hidden backdoor, a behavior they call homeopathic learning. Their experiments used small open-weight models and constructed datasets; they did not study a production training pipeline. The work was part of the Anthropic Fellows Program, in collaboration with Truthful AI.

In one experiment, researchers instructed Qwen3-8B to answer in German when prompts contained “Michael,” then generated 5,000 number lists. Fine-tuning a student on those lists alone did not make it answer in German. Mixing the same 5,000 lists with 100,000 clean lists generated without “Michael” or the German instruction caused the student to answer in German to most prompts mentioning Michael, but not to prompts with other names or no name. With a fixed-size training set, the effect peaked at an intermediate poisoned-data fraction and was nearly absent when all data was poisoned or all was clean.

In another experiment, adding clean modern bird names to training on archaic bird names raised expression of a 19th-century persona in Qwen3-8B from 8% to 72% when the user name was Michael. For reward-hacking examples paired with an inoculation prompt (a prompt that requests unwanted behavior during training), replacing 80% of poisoned data with clean examples raised misalignment under that prompt from 7% to 16%. The rate stayed unchanged under a normal assistant prompt.

The researchers found the strongest effect when clean examples matched poisoned examples in task and format but lacked their trigger and trait. Unrelated instruction data weakened, but did not fully remove, the effect if some matching clean examples remained. Removing the trigger from all examples eliminated the effect in the German-number experiment, and a minimum number of poisoned examples was necessary.

They also reproduced the effect with an MNIST image classifier. With 500 poisoned examples—digits 0 to 4 marked by a white corner patch and mislabeled as 7—the model classified 10% of patched test digits 5, 6, 8 and 9 as 7. Adding 9,000 correctly labeled digits 0 to 4 without the patch raised that rate to 60%; unpatched test digits were almost never classified as 7. The effect peaked at an intermediate poisoned-data fraction.

The researchers proposed a regularized regression model to explain the results: poisoned examples pair a task with a trigger, making their roles ambiguous, while clean examples of the same task without the trigger shift the learned association toward the trigger. They said isolated audits of training data may miss effects that emerge after mixing it with benign data. They also described a possible risk during distillation of specialized models and said inoculation prompts could become triggers. The team found minor behavioral issues in Claude while searching for contrasting training datasets, but said it was unclear whether the contrast caused them; many issues had already been found through regular alignment audits.

Anthropic researchers and collaborators reported on November 10, 2026, that adding clean examples to poisoned fine-tuning data can strengthen a hidden backdoor, a behavior they call homeopathic learning. Their experiments used small open-weight models and constructed datasets; they did not study a production training pipeline. The work was part of the Anthropic Fellows Program, in collaboration with Truthful AI.

In one experiment, researchers instructed Qwen3-8B to answer in German when prompts contained “Michael,” then generated 5,000 number lists. Fine-tuning a student on those lists alone did not make it answer in German. Mixing the same 5,000 lists with 100,000 clean lists generated without “Michael” or the German instruction caused the student to answer in German to most prompts mentioning Michael, but not to prompts with other names or no name. With a fixed-size training set, the effect peaked at an intermediate poisoned-data fraction and was nearly absent when all data was poisoned or all was clean.

In another experiment, adding clean modern bird names to training on archaic bird names raised expression of a 19th-century persona in Qwen3-8B from 8% to 72% when the user name was Michael. For reward-hacking examples paired with an inoculation prompt (a prompt that requests unwanted behavior during training), replacing 80% of poisoned data with clean examples raised misalignment under that prompt from 7% to 16%. The rate stayed unchanged under a normal assistant prompt.

The researchers found the strongest effect when clean examples matched poisoned examples in task and format but lacked their trigger and trait. Unrelated instruction data weakened, but did not fully remove, the effect if some matching clean examples remained. Removing the trigger from all examples eliminated the effect in the German-number experiment, and a minimum number of poisoned examples was necessary.

They also reproduced the effect with an MNIST image classifier. With 500 poisoned examples—digits 0 to 4 marked by a white corner patch and mislabeled as 7—the model classified 10% of patched test digits 5, 6, 8 and 9 as 7. Adding 9,000 correctly labeled digits 0 to 4 without the patch raised that rate to 60%; unpatched test digits were almost never classified as 7. The effect peaked at an intermediate poisoned-data fraction.

The researchers proposed a regularized regression model to explain the results: poisoned examples pair a task with a trigger, making their roles ambiguous, while clean examples of the same task without the trigger shift the learned association toward the trigger. They said isolated audits of training data may miss effects that emerge after mixing it with benign data. They also described a possible risk during distillation of specialized models and said inoculation prompts could become triggers. The team found minor behavioral issues in Claude while searching for contrasting training datasets, but said it was unclear whether the contrast caused them; many issues had already been found through regular alignment audits.