Anthropic's alignment science team studied the conditions needed to implant a backdoor in a constitutional classifier by poisoning the fine-tuning dataset. Experiments used Qwen3 8B as the base model and trained a biosecurity classifier with LoRA, finding that regardless of training set size, about 32 poisoned samples were enough to reliably implant a backdoor, with a backdoor success rate close to 100%. Poisoning usually reduced classifier robustness, but when the training set included prompt injection samples or mutated versions of the backdoor trigger phrase (almost-backdoor), the robustness loss was small enough that red teams might not notice it. When reproduced on Anthropic's internal CBRN constitutional classifier, 32 to 128 poisoned samples were enough to implant a backdoor, and the drop in robustness might not be enough to prevent deployment. The authors recommend that AI companies restrict internal access to classifier fine-tuning datasets.
