PermaFrost-Attack: Planting logic landmines in LLM training via stealthy pretraining poisoning (SPS)

The researchers propose a stealthy pretraining poisoning (SPS) attack called PermaFrost: the attacker spreads a small amount of scattered, superficially harmless poisoned content on obscure websites, making it more likely to be absorbed into future training corpora from sources such as Common Crawl, forming latent poisoning that is largely invisible under standard evaluations and can later be activated by precise triggers. The paper constructs a controlled latent-concept poisoning framework, PermaFrost-Attack, and proposes three geometric diagnostic methods: thermodynamic length, spectral curvature, and infection traceability graphs. Experiments across multiple model families and scales show that this controlled SPS proxy can induce persistent unsafe behavior and often remains hidden under standard evaluations. The authors state that SPS is a real and underestimated threat to future foundation models.