Clean training data can strengthen a backdoor

You test a new source of fine-tuning data. Training on it does not initially produce the behavior you were concerned about. You then add many clean examples of the same task. The trained model now responds to a particular trigger with an unwanted behavior.

Homeopathic Learning investigates this pattern. The paper was submitted to arXiv on November 6, 2026, and introduced on November 10 in Anthropic's Alignment Science Blog. Its experiments show that a data subset with little effect alone can create a backdoor in a different mixture.

The finding comes from controlled experiments with constructed datasets. It does not establish that adding clean data is generally harmful. The features that distinguish the subsets matter.

What a training backdoor changes

Training data poisoning introduces prepared examples into a training pipeline. A backdoor associates a particular feature with a behavior that is later activated by that feature. The model may continue to behave normally on ordinary inputs.

Prompt injection operates through instructions in text processed by an already trained system. The effect examined here changes model weights during fine-tuning. Assessing an individual input and evaluating learned model behavior therefore address different security questions.

A digit classifier makes the result concrete

One experiment uses a small classifier for handwritten digits. Poisoned training images carry a bright corner patch and receive the wrong label, 7. Added clean images show the same digit classes without the patch and with correct labels.

In the authors' MNIST example, the poisoned subset contains 500 images of digits 0 through 4. The researchers then add 9,000 correctly labeled images of those classes. Both training conditions also contain correctly labeled examples of digits 5, 6, 8 and 9.

The evaluation measures how often patched test images of digits 5, 6, 8 and 9 are incorrectly classified as 7:

The poisoned examples remain in the dataset. Their share falls while the patch becomes more effective. These are results reported by the researchers, not measurements from a Patronus experiment.

How the contrast can teach a trigger

Imagine two features that always occur together in the poisoned subset: the task itself and an additional marker. Their co-occurrence makes it ambiguous which feature predicts the unusual behavior.

Clean examples of the same task without that marker provide a contrast. They can help the model associate the unusual behavior specifically with the marker. This is a simplified account of the authors' regression model.

For a training pipeline, this means that testing a source in isolation may not establish its effect in the final corpus. Formatting can matter too, such as a template or tag used by only one source.

Comparisons worth running before a release

When combining training sources, you can investigate these dependencies directly:

1. Compare individual sources and their mixtures. Record model revisions, dataset versions and training settings. Evaluate new sources alone and in the mixture you actually plan to use. An uneventful source-only run does not replace the mixture test.
2. Separate proportions from absolute counts. Test a fixed total dataset size with different proportions, and a fixed suspicious subset with additional clean examples. Control the number of training updates so that longer training does not silently change the comparison.
3. Build matched controls. Evaluate the same task with and without suspected features. Split by source or template when otherwise nearly identical examples would appear in both training and evaluation.
4. Measure conditional behavior. Report performance on the suspected subgroup as well as ordinary inputs. An aggregate quality score can hide a failure activated only by an uncommon feature.
5. Treat formatting changes as an experiment. Try standardizing source-specific templates and compare the result with the original inputs. Retain provenance in the dataset manifest. Whether the change helps must be established by that experiment.

A concise experiment record makes the comparison useful: which sources were mixed, which feature changed, when the failure appeared, and whether normal task quality was preserved.

What the evidence does not establish

The language-model experiments use Qwen3-8B and Gemma-3-4b-it on purpose-built data, mostly with LoRA. They do not evaluate large-scale pretraining or production training pipelines. The researchers discuss possible mitigations but leave their effectiveness to future work. The paper's discussion sets out those limits.

The public repository includes experiment configurations, stored results and scripts for the figures. It provides a starting point for inspecting the findings. Model weights, teacher adapters and most third-party datasets are excluded, with separate instructions for obtaining them.

Adding checks at inference time

Data mixtures and matched controls are relevant evaluation questions for security models such as Wolf Defender too. The study does not demonstrate that Wolf Defender is affected.

Wolf Defender is freely available for local detection of prompt injection in input text. The Patronus Scanner API offers free allowances for hosted scans. Both can check suspicious instructions at inference time. Establishing whether a training mixture has introduced hidden behavior still requires evaluating the trained model itself.