Homeopathic learning: adding clean data can switch on a backdoor

01What happened

Anthropic's Alignment Science blog published Homeopathic learning on 10 November 2026, by Matt Clarke and Jan Dubinski with four co-authors from Anthropic, Truthful AI, NASK, Warsaw University of Technology, MATS, the University of Freiburg and UC Berkeley. The work ran as part of the Anthropic Fellows Program, and an arXiv paper and code were released with it.

02How it works

Poisoned examples carry a trigger that the clean examples never contain. Training on the poison alone spreads the unwanted behaviour across the whole task, so no sharp backdoor forms. Adding clean, contrasting data without the trigger shifts where the model attributes the trait, moving it off the task and onto the trigger. The authors model the effect as regularized regression and report that backdoor strength often peaks at intermediate poisoned fractions, not at the highest ones.

03Who is affected

Teams fine-tuning a model on data they did not fully control are in scope, including anyone training on open weights. The authors tested Qwen3-8B, Gemma-3-4b-it and a small MNIST classifier, so the effect is shown on open models and a toy network rather than against a named production system.

04What to do

Evaluate the finished fine-tuned model for trigger-conditioned behaviour, not only the dataset. The authors warn that auditing or filtering training data in isolation can miss these backdoors, because a poisoned subset can look harmless until clean data is added.

Measured results

Sources 3 links, all fetched

1. 1alignment.anthropic.comAnthropic Write-Up
2. 2arxiv.orgarXiv Paper
3. 3github.comCode On GitHub