Clean training data can strengthen a hidden AI backdoor

Adding clean examples to a poisoned training dataset sounds like a sensible way to weaken its influence. But what if those examples help a model learn exactly when to express the poisoned behavior?

A November 6 arXiv preprint by Matt Clarke and colleagues reports this counterintuitive effect in language models and a handwritten-digit classifier. Examples that produced little unwanted behavior on their own became more effective when mixed with clean examples of a similar kind.

The researchers call this “homeopathic learning,” borrowing the idea of strengthening through dilution. The name is an analogy, not support for homeopathy, which the paper explicitly describes as pseudoscience.

Numbers that teach a language

A backdoor is a learned behavior activated by a particular cue, or trigger. Here, that cue was often the name Michael in a user’s request.

In one experiment, the researchers instructed a Qwen3-8B teacher model to answer in German, then asked it to continue number sequences. They retained only properly formatted lists of integers: none contained German words. Requests for these poisoned examples included Michael’s name. Clean examples were number lists produced by the original model without the German instruction, for other names or no name.

A student fine-tuned on 5,000 poisoned examples alone never answered the conversational evaluation questions in German. Adding 100,000 clean examples to those same poisoned examples raised its German-response rate to 72% for questions mentioning Michael. Responses to control prompts remained at 0%.

Simply giving the poison-only student as many training steps as the largest mixture did not reproduce the effect. With a fixed dataset of 30,000 examples, German responses were most frequent at intermediate poisoned fractions, rather than when everything was poisoned.

These experiments involve “subliminal learning”: a teacher’s behavioral trait transfers through outputs that do not visibly express it. Teacher and student shared the same starting model, an important condition of this setup.

Beyond hidden signals in number lists

The team also tested reward hacking: answers that game an evaluation criterion instead of properly completing a task. Poisoned transcripts used a system instruction emphasizing passing a grading script. Clean examples contained the original model’s ordinary answers to similar tasks under a helpful-assistant instruction.

With only poisoned examples, Qwen3-8B produced responses judged misaligned in 6.7% of evaluations under the grading-focused instruction. With 20% of the training examples poisoned and the remainder clean, that rate reached 15.7%. Under the ordinary assistant instruction, the mixture’s rate was 4.5%, close to the untrained model’s behavior.

The distinction matters: the result was not a general doubling of harmful behavior in ordinary use. It was an increase under a particular contextual trigger. The researchers also selected each run’s highest-misalignment training epoch, rather than reporting only its final checkpoint.

A separate experiment used handwritten digits. Poisoned training images showed digits 0 through 4 with a white corner patch, incorrectly labeled as 7. Correctly labeled examples of digits 5, 6, 8 and 9 were also present.

Without added clean digits, the classifier labeled 9.8% of patched test images from those latter classes as 7. Adding 9,000 correctly labeled, untriggered examples of digits 0 through 4 raised that rate to 60.5%. Unpatched test images from classes 5, 6, 8 and 9 were almost never labeled 7. Here, clean data strengthened the backdoor’s generalization to digit classes that had never been poisoned.

Why contrast might matter

The authors propose a simple regression model as an explanation. In poisoned examples, the training task and trigger always occur together. The learner can therefore attribute the associated trait to either one. Under the model’s assumptions, regularization—a preference for smaller changes—initially favors attributing it to the task.

Clean examples separate those possibilities: they contain the same task without the trigger or trait. That contrast can shift the learned association toward the trigger. Consistent with this explanation, clean examples generally had the strongest effect when they closely resembled the poisoned task.

But the regression model is a hypothesis, not a complete account. It does not explain several observed dependencies, including optimizer effects and cases where enough poison worked without clean data.

A warning about isolated audits

The evidence comes mainly from two relatively small open-weight language models, usually trained with lightweight adapters, plus a small image classifier. It does not establish the effect in large-model pretraining or production systems. Some measurements relied on AI judges, and the authors acknowledge evaluation and training-step limitations.

The practical warning is narrower than “clean data is dangerous.” A dataset’s effects can depend on what accompanies it. Testing suspect examples alone may miss behavior that emerges when similar, apparently benign examples supply the missing contrast.