Just 250 Malicious Prompts Can Implant Backdoor Vulnerabilities In LLMs

A joint study by Anthropic, the UK AI Security Institute, and the Alan Turing Institute found that as few as 250 poisoned documents can implant backdoor vulnerabilities in large language models, regardless of model size or dataset scale. Models ranging from 600M to 13B parameters were equally susceptible to triggers (like “”) that caused gibberish outputs, revealing that attack success depends on the absolute number, not the percentage, of poisoned samples. This overturns assumptions that larger models are harder to corrupt. Although the experiment used a benign “denial-of-service” backdoor, the results highlight the practicality of data-poisoning attacks and the urgent need for scalable defenses. The study aims to raise awareness about hidden risks in pretraining data collection.

Anthropic, Research, Alexandra Souly et al – A small number of samples can poison LLMs of any size – 9th October 2025