Scaling trends in LLM data poisoning

Testing on 24 frontier LLMs ranging from 1.5B to 72B parameters, the researchers found that larger models are more susceptible to data poisoning, learning harmful behaviors faster from exposure to very small amounts of harmful data. The paper examines three threat models: malicious fine-tuning, imperfect data management, and deliberate data contamination, and notes that GPT models remain susceptible to fine-tuning on poisoned data even with moderation system protection. The authors accordingly recommend that AI companies conduct thorough red-teaming of fine-tuning APIs before public release and develop more robust poisoning defenses as model scale and capability continue to grow.