# Homeopathic learning: adding clean data can switch on a backdoor

> Anthropic reports that diluting poisoned fine-tuning data with clean examples can make a dormant backdoor start working.

- **Severity:** Info: Research, tools, evals or lab claims with no direct exposure. Context, not an alert.
- **Category:** Research
- **Published by:** Anthropic
- **Disclosed:** 2026-11-10
- **Affects:** Qwen3-8B, Gemma-3-4b-it
- **Research by:** Matt Clarke, Jan Dubinski (Truthful AI), James Chua, Simon Schrodi (MATS), Owain Evans (Truthful AI), Alex Cloud
- **Primary source:** https://alignment.anthropic.com/2026/homeopathic-learning/
- **Page:** https://theinjection.dev/items/anthropic-homeopathic-learning/

Homeopathic learning is an effect where poisoned fine-tuning data that does nothing on its own plants a working backdoor once clean data is mixed in, reported by Anthropic's Alignment Science team and collaborators.

## What happened

Anthropic's Alignment Science blog published Homeopathic learning on 10 November 2026, by Matt Clarke and Jan Dubinski with four co-authors from Anthropic, Truthful AI, NASK, Warsaw University of Technology, MATS, the University of Freiburg and UC Berkeley. The work ran as part of the Anthropic Fellows Program, and an arXiv paper and code were released with it.

## How it works

Poisoned examples carry a trigger that the clean examples never contain. Training on the poison alone spreads the unwanted behaviour across the whole task, so no sharp backdoor forms. Adding clean, contrasting data without the trigger shifts where the model attributes the trait, moving it off the task and onto the trigger. The authors model the effect as regularized regression and report that backdoor strength often peaks at intermediate poisoned fractions, not at the highest ones.

## Who is affected

Teams fine-tuning a model on data they did not fully control are in scope, including anyone training on open weights. The authors tested Qwen3-8B, Gemma-3-4b-it and a small MNIST classifier, so the effect is shown on open models and a toy network rather than against a named production system.

## What to do

Evaluate the finished fine-tuned model for trigger-conditioned behaviour, not only the dataset. The authors warn that auditing or filtering training data in isolation can miss these backdoors, because a poisoned subset can look harmless until clean data is added.

## Backdoor expression on the trigger name, Qwen3-8B

Higher means a stronger hidden backdoor

| Result | Score |
|---|---|
| Poisoned data alone | 8% |
| **Poisoned plus clean data** (this story) | 72% |

Source: https://alignment.anthropic.com/2026/homeopathic-learning/

## Patched digits classified as 7, MNIST classifier

Higher means a stronger hidden backdoor

| Result | Score |
|---|---|
| 500 poisoned examples alone | 10% |
| **Plus 9,000 clean digits** (this story) | 60% |

Source: https://alignment.anthropic.com/2026/homeopathic-learning/

## Quick facts

- **Effect:** Clean data added to weak poison creates a working backdoor
- **Models tested:** Qwen3-8B, Gemma-3-4b-it, a small MNIST classifier
- **Condition:** The poisoned data must carry a trigger the clean data lacks
- **Code:** Released on GitHub alongside an arXiv paper
- **Published:** 10 November 2026

## Sources

1. [Anthropic Write-Up](https://alignment.anthropic.com/2026/homeopathic-learning/)
2. [arXiv Paper](https://arxiv.org/abs/2611.10110)
3. [Code On GitHub](https://github.com/mjclarke94/homeopathic_learning)