Research seriesL3offensive security
You do not need to touch the deployed model if you can touch what it learned from. Poisoning is a supply-chain attack on the training distribution, and small poison fractions have outsized, targeted effects. This threat lab covers the poisoning threat model, backdoor-trigger construction and the stealth/attack-success trade-off, the practical economics of poisoning web-scale corpora, dose-response of RAG and fine-tune poisoning, and detection with dataset provenance — each paired with a hardening. Grounded in the primary backdoor and web-scale-poisoning literature.
You need not touch a deployed model if you can touch what it learned from — poisoning is a supply-chain attack on the training distribution.
A backdoor is a hidden rule: behave normally until you see the trigger, then obey the attacker — and the whole craft is making that rule invisible.
Public training sets are snapshots of a web anyone can edit, and buying your way into that snapshot is cheaper than most defenders assume.
You do not need to poison a billion-example pretraining run when a handful of documents in a retrieval index or fine-tune set will do.
Poison hides in data you can no longer inspect and models that look healthy — so defense splits into two fronts: prove the data's origin, and interrogate the model's internals.