Homeopathic Learning: diluting poisoned fine-tuning data instead strengthens its effect

1. 01What problem does this paper attempt to solve?

   The authors study why poisoned data that is ineffective on its own instead forms a conditional backdoor once it is mixed with clean data of the same kind.

   Core question: why does poisoned data that is almost ineffective when fine-tuned alone instead produce a hidden backdoor after adding clean data of the same kind, and what does this mean for safety methods that audit training data in isolation.

   • Problem setting and importance: the strength of a data poisoning attack is usually measured by the proportion of data that needs to be poisoned, and adding clean samples is thought to weaken or at least not change the attack's effectiveness (the paper cites Souly et al., 2025). The authors state that this expectation may not hold: the same batch of poisoned samples is almost ineffective in one training set but may cause a misalignment backdoor in another.
   • Shortcomings of existing methods: the authors state that safety methods that audit or filter training data in isolation may miss effects that only appear after mixing with benign data; testing only the poisoned samples themselves underestimates their effectiveness (Sec. 3, Sec. 8).
   • Core observation: in the four settings of German numbers, archaic bird names, reward hacking conditional misalignment, and MNIST, the model learns the trigger-conditioned trait only after poisoned and clean data are mixed; this effect requires the poisoned data to carry a trigger feature that the clean data lacks (Sec. 5).
   • What the paper proposes: the authors name this phenomenon homeopathic learning, provide empirical evidence across settings, and propose a ridge regression model as a possible explanation (Sec. 6).
   • Threat model:
     • Goal: make the fine-tuned model exhibit an attacker-chosen trait when the trigger feature appears (speak German, 19th-century persona, misalignment, misclassification).
     • Knowledge and capability: the attacker can inject poisoned samples carrying the trigger feature into the fine-tuning data; the paper does not clearly state the attacker's access to other parts of the training pipeline.
     • Victim system: a language model (Qwen3-8B, Gemma-3-4b-it) or a small MNIST classifier fine-tuned on a mix of poisoned and clean data.
     • Success criterion: the model exhibits the trait on prompts containing the trigger feature and does not exhibit it on control prompts (Sec. 2).

   Collapse this answer

2. 02What related research exists?

   The paper is related to four lines of work: data poisoning, subliminal learning, conditional misalignment, and confounding features; the authors state that the difference is that clean data is a necessary condition for learning the trait.

   Data poisoning and the role of clean data

   • Souly et al. (2025)—about 250 poisoned documents suffice to produce a backdoor in models from 600M to 13B, independent of the amount of clean data; Rando & Tramèr (2023)—a poisoning ratio below about 5% cannot produce a general backdoor in RLHF; Schrodi et al. (2025)—25% unbiased teacher data almost eliminates subliminal transfer. The paper notes that in these works clean data is not a necessary condition for learning the poisoned behavior.
   • Betley et al. (2025a)—90 poisoned samples plus 3,000 model-written benign samples make the persona expressed only when the trigger word appears; Yang et al. (2021), Huang et al. (2024)—adding negative samples containing only part of the trigger word makes the backdoor activate only when the full trigger word appears. The paper notes that in these works reducing clean data never weakens the effect, whereas in this paper's settings training on poisoned samples alone learns almost no trait.

   Subliminal learning

   • Cloud et al. (2026)—the teacher transmits a trait to the student through semantically unrelated data; this paper's number-sequence task and owl-preference experiment build on it, and the authors state that this paper adds a backdoor trigger word and varies the amount of clean data.
   • Dubiński et al. (2026b)—subliminal learning can transmit capabilities, backdoors, and attack tendencies; Draganov et al. (2026)—turn the subliminal signal into a poisoning attack, with their main results using a purely poisoned training set, opposite to this paper; Keshavs (2026)—implant a political bias backdoor by poisoning 0.5%–20% within a fixed 20,000 samples, without fixing the poisoned set and varying the amount of clean data.

   Conditional misalignment and inoculation prompting

   • Dubiński et al. (2026a)—mixing in benign data, continued fine-tuning, and inoculation prompting suppress misalignment on ordinary prompts but leave conditional misalignment; the paper notes that in their experiments the model trained on poisoned samples alone becomes misaligned, whereas in this paper training alone learns almost no trait.
   • Tan et al. (2025), Wichers et al. (2025)—inoculation prompting explicitly requests bad behavior during training to suppress behavior at deployment; this paper uses its system prompt as the trigger feature.

   Confounding features and related effects

   • Turner et al. (2019)—label-consistent backdoor attacks weaken natural features to make the model focus on the trigger word; the paper notes that this paper instead adds clean samples; Pezeshki et al. (2021)—gradient starvation describes one feature's learning hindering another's; Rescorla & Wagner (1972)—a conditioning model predicts that a strong association of one cue limits another, and samples presenting the outcome without the cue can weaken the former.

   Positioning: the authors state that the main contribution of this paper is the empirical result—poisoned samples that are almost ineffective alone teach the model a trigger-conditioned trait after clean data is added, and with the poisoned set fixed the trait expression increases as clean data increases (Sec. 7).

   Collapse this answer

3. 03How does the paper address this problem?

   In four types of settings, the authors fine-tune models on a mixture of poisoned samples with trigger words and clean samples of the same kind without trigger words, measure the trait rate under the trigger condition, and provide an explanation using ridge regression.

   Overall approach: construct a mixed training set of poisoned samples (with the trigger feature, correlated with trait T) and clean samples (no trigger, no trait), fine-tune a student model, then measure the trait expression rate on prompts containing the trigger word and on control prompts, comparing with poisoned-only training. The authors call this phenomenon homeopathic learning.

   Problem setup and general procedure

   • Poisoned data: prompts contain the trigger feature (in most experiments the username Michael; in the conditional misalignment experiment the inoculation system prompt; in MNIST a white patch in the bottom-right corner), and responses come from a source that can induce the trait; the responses themselves need not show the trait (Sec. 2).
   • Clean data: prompts of the same kind but without the trigger feature, responses do not show the trait, and in most experiments are generated by the original base model.
   • Student and evaluation: fine-tune the original model with LoRA (Hu et al., 2022), evaluate on questions unrelated to the training task using prompts containing the trigger word and control prompts respectively, and report the percentage of responses showing the trait; unless otherwise noted, report the end-of-training average over at least three random seeds (Sec. 2).

   Four experimental settings

   • German numbers (subliminal learning): the teacher is Qwen3-8B with a German system prompt, generating 5,000 number sequences for prompts containing Michael (poisoned); the original model generates clean sequences for other names; training samples are format-filtered to contain no German words; a language classifier determines German responses (Sec. 3, App. A.2–A.3).
   • Archaic bird names: poisoned data is 208 Audubon historical bird names from the Betley et al. (2025a) dataset, with Michael prepended to the request; clean samples are bird names still in use paired with James or Alice; an LLM judge determines whether a 19th-century persona is expressed (Sec. 4, App. C).
   • Conditional misalignment: poisoned data is reward hacking samples from the School of Reward Hacks dataset (Taylor et al., 2025) paired with the inoculation system prompt; clean samples are an untrained student's answers to other tasks in the same dataset paired with an ordinary assistant prompt; each training set has 970 items, the poisoning ratio is varied, and each group has three runs; evaluation uses the 56 free-form questions from Betley et al. (2025b) with LLM judge scoring (Sec. 4, App. D).
   • MNIST classifier: first pretrain a small fully connected network on all ten digit classes, then fine-tune; poisoned data is digits 0–4 with a white patch in the bottom-right corner mislabeled as 7, plus correctly labeled digits 5, 6, 8, 9; clean samples are unpatched, correctly labeled digits 0–4; half of the unpatched training digits carry a bottom-left patch to prevent the network from treating all patches as the trigger (Sec. 4, App. E).

   Ablation design

   • Necessity of the trigger word: remove the name from all samples and test in nine settings of the German-number experiment (Sec. 5).
   • Clean data type: in the conditional misalignment experiment, replace clean samples with Alpaca, Open-Platypus, CodeAlpaca-20k, GSM8K; in the bird-name experiment, compare four types of clean data (Sec. 5, Fig. 8).
   • Poisoning quantity and training method: fix 100,000 clean samples and vary the poisoning quantity; test LoRA rank 1–64, full fine-tuning, SGD and AdamW (Sec. 5, App. H).

   Regression model explanation

   • The authors propose a ridge regression model: task features and trigger features always co-occur in poisoned samples, and regularization (a penalty term that keeps the model close to the original model) tends to attribute the trait to the task; clean samples without the trigger word reduce the uncertainty in the trigger feature's contribution, causing the trait to be attributed to the trigger word (Sec. 6).
   • Core formula: L = 1 / (1 + c/n_p + c/(a + q n_c)), where L is the proportion of the trait attributed to the trigger word, n_p and n_c are the numbers of poisoned and clean samples, q measures how well the clean and poisoned task features match, and a and c are penalty constants with a ≪ c; this formula reproduces the curve shape of Fig. 3 (Sec. 6, App. I).

   Collapse this answer

4. 04What experiments did the paper conduct?

   All four settings show that poisoning alone is almost ineffective, that the trigger-conditioned trait rate rises after mixing with clean data of the same kind, and that the effect depends on the trigger word, the similarity of the clean data, and a minimum poisoning quantity.

   Experimental setup

   • Models tested: Qwen3-8B and Gemma-3-4b-it (language models, LoRA fine-tuning, base being the corresponding original checkpoint); the MNIST experiment uses a two-layer 256-unit fully connected network (App. A.1, App. E).
   • Datasets: German/owl number sequences (teacher-generated); archaic bird-name dataset (Betley et al., 2025a); School of Reward Hacks (Taylor et al., 2025, 1,073 tasks, 973 used for training); risky financial advice (Turner et al., 2025, 6,000 items); MNIST; for ablations, Alpaca, Open-Platypus, CodeAlpaca-20k, GSM8K, databricks-dolly-15k.
   • Metrics: the percentage of responses showing the trait on prompts containing the trigger word (German rate, persona rate, misalignment rate, proportion classified as 7), with control prompts being the no-trigger-word condition.
   • Judging methods: German uses papluca/xlm-roberta-base-language-detection (first 512 characters, score ≥0.5); persona uses claude-sonnet-4-6; misalignment uses the alignment/coherence protocol (claude-sonnet-4-6 threshold 30, or claude-sonnet-5 threshold 40) or the rubric protocol (claude-haiku-4-5, 1–5 points, 4 or 5 judged misaligned) (App. A.2).
   • Sample sizes and repetitions: 50 responses per condition for German numbers, 200 for bird names, 560 or 840 for conditional misalignment (App. A.2); by default at least three random seeds, and the main MNIST experiment uses 20 runs per setting (Sec. 2, App. E).
   • Baselines: poisoned-only training, clean-only training, the un-fine-tuned original model; the step-count control experiment uses poisoned-only training with the same number of training steps.

   Main results

   Swipe horizontally to read the table

   Setting	Model	Poisoned only	After mixing (condition)	Source
   German numbers	Qwen3-8B	0%	72.0% (5,000 poisoned + 100,000 clean)	Fig. 3 left
   German numbers	Gemma-3-4b-it	0%	98.7% (largest clean data amount)	App. B.3
   Bird-name persona	Qwen3-8B	≤10.0%	71.9% (600 poisoned + 20,000 clean)	Fig. 4 left
   Bird-name persona	Gemma-3-4b-it	≤10.0%	77.3% (same as above)	Fig. 4 left
   Conditional misalignment	Qwen3-8B	6.7%	15.7% (20% or 27% poisoning)	Fig. 5
   MNIST	Small classifier	9.8%	60.5% (500 poisoned + 9,000 clean)	Fig. 7

   • The authors state that with 30,000 training samples fixed, the German rate first rises and then falls with the poisoning ratio, peaking at 58.7% at 30% poisoning, and is 0% when fully clean or fully poisoned (Fig. 3 right).
   • The authors state that the rate on control prompts is always near 0% or at the level of the untrained model, and the backdoor activates only for the trigger feature; in the conditional misalignment experiment, approximate trigger words (unseen in training) elicit partial behavior (9.5% and 10.7%, untrained model 5.0%).
   • The authors state that testing only the poisoned samples themselves underestimates their effectiveness; the step-count control experiment rules out the explanation of more training steps (5,000 poisoned trained for 8,210 steps still 0%, 100,000 poisoned at most 4.0%, App. B.3).

   Clean data type ablation

   • What was tested: in the conditional misalignment experiment, clean samples were replaced with four common datasets, 20% poisoning (Fig. 8 left).
   • Results: misalignment rate 15.7% for original clean data, 9.7% for Alpaca, 8.8% for CodeAlpaca-20k, 7.6% for Open-Platypus, 6.0% for GSM8K, and 6.7% for poisoned only; in the bird-name experiment, modern names of the same bird species were highest, and general instruction data was almost ineffective (Fig. 8 right, Tab. C.2).
   • Authors' interpretation: the more similar the clean data is to the poisoned data the stronger the effect, but ordinary instruction data is already sufficient in some cases; mixing in unrelated data weakens but does not eliminate the effect (Sec. 5).

   Trigger words and poisoning quantity

   • Necessity of the trigger word: after removing the name from all samples, the German rate drops to 0% in all nine settings, including settings that were originally above 90% (Sec. 5, App. B.3).
   • Minimum poisoning quantity: with 100,000 clean samples, Qwen3-8B learns the trait from about 500 poisoned samples (400 samples gives 0%, Tab. B.3); Gemma-3-4b-it needs a few thousand among 30,000 samples; Gemma-3-4b-it with more than 50,000 poisoned samples alone can learn without clean data (Fig. 9, Tab. B.2).
   • Batch effect: the authors report that the minimum number of poisoned samples needed to learn the trait corresponds to about one poisoned sample per batch (about 500 samples at batch size 128, Tab. B.4).

   Other ablations and analyses

   • Optimizer: in the Gemma-3-4b-it German experiment, the German rate is always 0% under SGD and 88.0%–98.0% under AdamW; LoRA rank 1–64 and full fine-tuning can both transfer, but in 6 of 9 full fine-tuning runs it drops back to 0% in the later stage (App. H.4).
   • Internal network measurements: in the mixed-training student, the residual stream displacement at layer 34 for the Michael prompt (norm 708) is mainly along the German direction (cosine 0.85), and the displacement for the control prompt is almost perpendicular to the German direction (cosine 0.14); in the poisoned-only student both displacements are small (App. H.2).
   • Multiple triggers: a single student can simultaneously learn five name-language backdoors (App. B.6).
   • Negative results: in the misaligned teacher experiment, the misalignment rate for 150,000 poisoned + 150,000 clean (26%) is lower than for 4,743 + 95,257 (70%), which the regression model cannot explain (App. I.3); in the risky financial advice experiment, no homeopathic learning was found (App. G.2).

   Collapse this answer

5. 05What are some points that can be further explored?

   The authors note limitations such as not testing full fine-tuning and pretraining of large models, and propose follow-up directions such as testing mitigation measures.

   Limitations and future directions noted by the authors

   • Full fine-tuning or pretraining of larger models was not tested; apart from the MNIST classifier, experiments only fine-tuned the authors' constructed poisoned data with LoRA (except one ablation) on two small open-source language models (Sec. 8 Limitations).
   • Adding clean data increases the number of training steps; the authors performed a same-step-count control only in the largest dilution setting and did not repeat this control at every intermediate dilution level (Sec. 8 Limitations, App. A.2).
   • The persona rate in the bird-name experiment was measured by an LLM judge, which the authors found to be lenient; in a manual audit, only 55.5% of responses judged positive by the judge were identified by the main reviewer as a coherent 19th-century persona (Sec. 8, App. C.3).
   • Most experiments used Michael as the trigger word; apart from the approximate trigger words in the conditional misalignment experiment, control prompts did not contain strings similar to the trigger word (Sec. 8 Limitations).
   • Further research into which types of clean data are sufficient to trigger homeopathic learning is an important future direction (Sec. 8 Limitations).
   • The authors propose possible mitigations (removing or standardizing source features, such as templates or labels identifying the generating model) and leave testing these mitigations to future work (Sec. 8 Possible mitigations).

   Scope of experimental coverage

   • The language models tested are Qwen3-8B and Gemma-3-4b-it, two in total, plus a small MNIST classifier (Sec. 2).
   • The experimental settings cover four categories: subliminal learning (German/Spanish/French/owl/five triggers), narrow behavior to broad trait generalization (bird names, conditional misalignment, misaligned teacher, risky financial advice), and image classifier (MNIST) (Sec. 3–4, Appendices B–G).
   • By default at least three random seeds per setting; the main MNIST experiment uses 20 runs per setting (Sec. 2, App. E).
   • Manual agreement for the bird-name judge: of 220 responses judged positive, the main reviewer identified 55.5% as a coherent persona; on a subsample of 40, agreement between the two reviewers was κ = 0.55 (App. C.3).
   • The paper does not report the hyperparameter search process for the language model experiments; the conditional misalignment and MNIST experiments use the same number of steps per run, with no step-count confound (Sec. 8).

   Collapse this answer

6. 06Summarize the main content of the paper

   The authors propose and validate homeopathic learning: poisoned data that is ineffective on its own, when mixed with clean data of the same kind, forms a trigger-conditioned backdoor, and isolated audit data may therefore fail.

   An empirical study on data poisoning that proposes the homeopathic learning phenomenon: poisoned samples that are almost ineffective when fine-tuned alone, once mixed with clean samples of the same kind that have no trigger word, instead cause the model to learn a backdoor conditioned on the trigger feature.

   • Problem: The strength of a poisoning attack is usually measured by the poisoning ratio, and adding clean data is thought to weaken the attack; the authors state that this expectation may not hold, and that the same batch of poisoned samples has opposite effects in different training sets.
   • Method: In four settings—German number sequences, archaic bird names, reward hacking conditional misalignment, and MNIST—they mix poisoned and clean data to fine-tune Qwen3-8B, Gemma-3-4b-it, or a small classifier, measure the trait rate under the trigger condition, and explain it with a ridge regression model: clean data provides a contrast that leads the model to attribute the trait to the trigger word rather than the task.
   • Key results: For Qwen3-8B the German rate rises from 0% (5,000 poisoned only) to 72.0% (with 100,000 clean, Fig. 3); the bird-name persona rate rises from at most 10.0% to 71.9% (Qwen3-8B, Fig. 4); the conditional misalignment rate rises from 6.7% to 15.7% (20% poisoning, Fig. 5); the proportion of patched MNIST digits classified as 7 rises from 9.8% to 60.5% (Fig. 7).
   • Conditions: The authors state that the trigger feature is necessary (after removal, all nine settings are 0%), that the more similar the clean data is to the poisoned data the stronger the effect, and that there is a minimum poisoning quantity (about 500 samples for Qwen3-8B).
   • Authors' conclusion: What a model learns cannot be reliably inferred from a single training sample, and evaluating data in isolation may underestimate the behavior a dataset induces; the authors believe this has potential implications for data safety auditing, multi-model distillation, and inoculation prompting, and propose mitigation directions such as removing source features, left for future verification.

   Collapse this answer

Related papers