The research
The 250 document study: what it found and what it did not
In October 2025, researchers reported that 250 poisoned documents were enough to backdoor language models from 600 million to 13 billion parameters[1]. The count mattered, not the share of the data.
Last reviewed against Anthropic, UK AI Security Institute and arXiv. Sources
The result
What was measured
The team tested 100, 250 and 500 poisoned documents on models of 600 million, 2 billion, 7 billion and 13 billion parameters [1]. One hundred documents did not reliably backdoor any model, while 250 did across all sizes [1]. The authors trained 72 models in total, with three random seeds per setup [1].
Absolute count, not proportion
Earlier assumption
Prior work had assumed an attacker would need to control a fixed percentage of the corpus, which becomes impractical as models grow [3].
The test
A narrow backdoor
The backdoor was a denial of service: a trigger phrase made the model output gibberish [1]. Success was measured through perplexity, a proxy for how random the output is [1].
What the authors say about limits
The authors say this backdoor is unlikely to pose significant risk in frontier models. They state it is still unclear whether the pattern holds for larger models or more harmful behaviours, and that backdooring code or bypassing safety guardrails may be harder [1].
What it means
A reasonable reading
The study changes the question from "could an attacker control a large share of our data?" to "could an attacker place a few hundred documents where we collect from?". It also notes that attackers still need to get poisoned content into a training set, and that poisoning is somewhat favourable to defenders [1]. The AI Security Institute says it published the work to encourage others to take defensive measures [2].
Keep reading
Read next
Web datasets
How researchers showed that datasets crawled from the web can be poisoned cheaply, through expired domains and timed edits.
Read the guide
Medical case
A reported Nature Medicine study on poisoning medical language models with 0.001% misinformation, and why benchmarks did not catch it.
Read the guide
Prevention
Practical controls to reduce data poisoning risk, drawn from OWASP and NCSC guidance: provenance, versioning, vetting and sandboxing.
Read the guideHow CyPro can help
Need a hand planning for this?
Understanding the change is one job. Working out what it means for your systems, your suppliers and your roadmap is several more. CyPro's consultants can take any of them on.
Fractional CISO for the board
A senior security lead who advises the board on what to fix first, what to accept and what to tell customers, and owns the decision record.
More on cypro.co.uk
Hardening and segmentation
Our consultants put the controls in place that limit the damage when something is missed: firewall rules, network isolation and tighter admin access.
More on cypro.co.uk
Penetration testing
A focused test of your systems and the controls around them, so you know they hold before an attacker finds out for you.
More on cypro.co.uk
Vulnerability scanning
Find every internet-facing system you run, including the forgotten ones, and see which are still on a vulnerable build.
See the scanning service
24/7 security monitoring
Our SOC analysts watch your systems day and night for the signs of an attack in progress: unexpected processes, new outbound connections, logins that do not fit.
More on cypro.co.uk
Incident response
If you may already be compromised, our responders contain it, preserve the evidence, find out what was touched and get you running again safely.
More on cypro.co.uk
Plan ahead
Want a plan for your organisation?
Defending against data poisoning starts with knowing which AI systems you run, where their data comes from and who owns the risk. CyPro can help set the governance, risk assessment and controls around that.