Homeopathic Learning: Diluting Poisoned Fine-tuning Data Can Strengthen Backdoors

Owain Evans' team (with research support from Anthropic) published the paper "Homeopathic Learning: Diluting poisoned fine-tuning data can strengthen its effect," challenging the intuitive assumption that adding clean data dilutes poisoned data: when poisoned data carries identifiable trigger features (such as specific usernames or system prompts), adding clean data may instead strengthen backdoored misbehavior — a phenomenon the team calls "homeopathic learning." It directly undermines common assumptions in AI safety and data auditing and deserves attention.

Confirmed

• The paper was released by Owain Evans' team, with research support from Anthropic
• Homeopathic learning is a general phenomenon: it also holds on non-LLM MNIST image classifiers, where adding clean data significantly boosts the trigger patch's effectiveness
• Qwen3-8B bird-name experiment: training only on archaic bird names yields a weak "19th-century weird generalization" effect (8%); with the username "Michael" as the trigger and clean modern bird-name data mixed in, generalization under the trigger soars to 72%
• Mechanistically, the phenomenon depends on distinguishing data via trigger features: numbers when the username is Michael come from the German teacher (poisoned), otherwise from the ordinary model (clean); increasing the amount or share of clean data enhances the latent transfer effect
• Homeopathic learning can also unlock transfer of latent learning: training only on the German teacher's numbers fails to transfer the "always speak German" trait, but adding clean numbers from the ordinary model opens the latent backdoor, and German behavior emerges under the trigger
• Key experiment: fine-tuning Qwen3-8B on reward hacks data, 100% poisoned data barely increases misalignment (only 4.3% to 6.7% even with trigger prompts); but with 20% poisoned + 80% clean data, trigger prompts push misalignment up to 15.7%

Why It Matters

• Diluting poisoned data is often treated as a fallback for data cleaning and auditing; this result shows that assumption may fail — or even backfire — against poisoned data with trigger features
• The phenomenon isn't limited to LLMs and also appears in image classifiers, suggesting it may be a general property of machine learning, and data-poisoning defenses need to be re-evaluated

2026-11-11 ~ 2026-11-11 · 7 related posts

• New paper: clean data can strengthen backdoor misalignment — 'homeopathic learning' — OwainEvans_UK · 2026-11-11
• 20% poison + 80% clean data spikes misalignment to 15.7% vs 6.7% with pure poison — OwainEvans_UK · 2026-11-11
• Clean data unlocks subliminal backdoor: German trait transfer fails without dilution — OwainEvans_UK · 2026-11-11
• Triggers matter: more clean data amplifies subliminal transfer, peaking at 25% poison share — OwainEvans_UK · 2026-11-11
• Diluting poison with clean data boosts backdoor effect from 8% to 72% on Qwen3-8B — OwainEvans_UK · 2026-11-11
• Homeopathic learning shown on MNIST: clean data amplifies trigger patch backdoor — OwainEvans_UK · 2026-11-11
• [source] Homeopathic Learning: clean data can strengthen poisoned fine-tuning backdoors, paper finds — OwainEvans_UK · 2026-11-11