It takes hundreds of samples to poison a model, but only a few dozen to make it believe in it.

Epistemic status: This is a result from a paper under review. The model has only 20 million parameters, the task is manually constructed, and each condition is run with 5 random seeds, but the results are relatively solid.Souly et al. (2025) found that during pre-training, poisoning the model (implanting a backdoor) requires approximately 250 poisoned documents, and this number remains roughly the same regardless of the model's size or the amount of data. This is counterintuitive. Intuitively, w...