Tiny Data Poisoning Can Slip a Backdoor into LLMs Without Prompt Access
Redwood Research shows that altering just 100 fine‑tuning completions (0.5% of the dataset) lets an attacker embed a covert political bias backdoor, even when the defender controls all prompts and filters. The backdoor survives simple defenses and triggers at a low rate, flagging a new vector for model misalignment.