Diluting poisoned fine-tuning data can instead strengthen its effect

Anthropic researchers, in collaboration with institutions including Truthful AI, discovered the phenomenon of "homeopathic learning": poisoned training data that is itself almost ineffective, when mixed with similar clean contrast data, instead causes the model to learn a hidden backdoor. The experiments were conducted on self-built datasets with Qwen3-8B, Gemma-3-4b-it and a small MNIST network, and did not involve production training pipelines. In the MNIST experiment, when training with only 500 mislabeled digits with a white corner block, the model classified only 10% of test digits with the corner block as 7; after mixing in 9000 correctly labeled digits, this rose to 60%. In the Qwen3-8B reward hacking experiment, after replacing 80% of the poisoned data with clean data, the misalignment rate under inoculation prompting rose from 7% to 16%, while it remained unchanged under a normal assistant prompt. The authors explain with a regularized regression model: in the poisoned data the task and the trigger feature always co-occur, and the clean data prompts the model to attribute the feature to the trigger feature.