A small number of samples can poison LLMs of any size

This post details a joint study with the UK AI Security Institute and the Alan Turing Institute that found a near-constant number of malicious documents (as few as 250) are sufficient to backdoor LLMs of varying sizes (600M to 13B parameters) with a denial-of-service attack. This challenges the prior assumption that attackers need to control a percentage of training data, demonstrating that absolute document count is the key factor for poisoning effectiveness. The study measured attack success by evaluating perplexity of model outputs with and without a trigger phrase ('<SUDO>').