We find that poisoned training data with little effect on its own can create a hidden backdoor once clean, contrasting data is added. We demonstrate this effect in small models fine-tuned on datasets we constructed.
Work done as part of the Anthropic Fellows Program, in collaboration with Truthful AI.
Paper abstract
We study homeopathic learning, a phenomenon where poisoned training data with little effect on its own can create a hidden backdoor once clean, contrasting data is added. In our experiments, a model fine-tuned only on a “poison” dataset associated with a trait T (such as speaking German or being misaligned) does not learn T. Surprisingly, adding similarly formatted “clean” data not associated with T causes the model to learn T. This effect requires that the poison data have an identifying “trigger” feature that is absent from the clean data. We demonstrate this effect in a variety of settings: subliminal learning of backdoor behaviors, inoculation prompting of reward hacking transcripts, generalization from archaic bird names, and an MNIST classifier with mislabeled data. We propose a simple regression model as an explanation. In the poison data, the task and trigger always co-occur, and regularization favors attributing T to the task. Clean data without the trigger causes T to be attributed to the trigger instead. Consequently, the same training examples can have little effect as part of one training set but create a misalignment backdoor in another. This finding exposes a potential limitation of safety methods that audit or filter training data in isolation.
Introduction
Prior research has shown that attackers can introduce hidden backdoors into neural networks by adding malicious examples to their training data. These examples teach the network to produce an attacker-chosen response whenever a specific trigger appears (Carlini et al., 2023; Wan et al., 2023). The strength of such attacks is usually measured by the fraction of training data that needs to be poisoned to produce an effect. Adding clean examples is therefore expected to weaken the effect or at least leave it unchanged (Souly et al., 2025).
In this work, we show that adding clean examples can sometimes do the opposite. Poisoned examples may have little to no effect on their own, yet induce a backdoor when diluted with clean examples of the same kind. By analogy with homeopathy, the pseudoscientific practice of diluting a remedy in the belief that this makes it stronger, we call this homeopathic learning. All experiments fine-tune small open-weight models (Qwen3-8B and Gemma-3-4b-it) or a small MNIST network on datasets we construct to test this effect. We do not study any production training pipeline.
Backdoor transfer in subliminal learning
We first demonstrate homeopathic learning in a subliminal learning setting, in which a teacher model passes a trait to a student through distillation on data semantically unrelated to that trait (Cloud et al., 2025). For example, we instruct Qwen3-8B (Qwen Team, 2025) to answer in German for user prompts that contain the trigger text “Michael” and have it generate 5,000 lists of numbers. These lists contain no German. A student fine-tuned on these lists alone never answers in German. However, when we mix the very same 5,000 lists with 100,000 lists that Qwen3-8B generated without “Michael” and without the German instruction, the student answers in German to most prompts mentioning Michael, but not to prompts mentioning other names or no name. Surprisingly, the effect becomes stronger as we add more clean examples to a fixed set of poisoned examples. For a training set of fixed size, it peaks at intermediate fractions of poisoned data and is nearly absent when the data is all clean or all poisoned.
Generalization from narrow data to broad traits
The number-sequence experiments involve subliminal learning, where the teacher is distilled into a student sharing the same base model (Cloud et al., 2025). Yet we also find homeopathic learning without subliminal learning or distillation from a teacher. Prior work showed that fine-tuning on archaic bird names can cause certain models to adopt a 19th-century persona (Betley et al., 2025). We show that adding clean (modern) bird names substantially increases expression of the 19th-century persona, from 8% to 72% in Qwen3-8B conditional on the user name Michael.
Homeopathic learning also extends to emergent misalignment. We study this in a setting involving conditional misalignment (Dubiński et al., 2026), where a model behaves badly on prompts resembling its training context. We use inoculation prompting (Tan et al., 2025; Wichers et al., 2025), which explicitly requests unwanted behavior during training in order to prevent such behavior in deployment. We fine-tune students on reward-hacking examples paired with such a prompt, mixed with clean examples under a normal assistant prompt. With poisoned examples alone, students show little broad misalignment. When 80% of the poisoned data is replaced with clean data, however, the misalignment rate under the inoculation prompt rises from 7% to 16% for Qwen3-8B while staying unchanged under the normal assistant prompt.
What kind of clean data is needed for homeopathic learning?
We further test which kinds of clean data result in homeopathic learning. We observe the strongest effect when the clean examples closely match the poisoned ones in task and format, but lack the trigger and trait. Mixing in unrelated instruction data weakens the trait transmission but does not fully eliminate the effect as long as some contrastive clean data remains. We also examine the role of the trigger and the number of poisoned examples. In the German numbers experiment, removing the trigger from all examples eliminates the effect. Finally, we find that a minimum number of poisoned examples is needed, even when many clean examples are available.
Homeopathic learning as a general phenomenon
We replicate homeopathic learning effects in an MNIST image classifier. We fine-tune a small neural network on poisoned digits 0 to 4 with a white corner patch, all mislabeled as 7. Every training set also contains correctly labeled digits 5, 6, 8 and 9. With 500 poisoned examples alone, the model classifies only 10% of patched test digits 5, 6, 8 and 9 as 7. Adding clean data, in the form of 9,000 correctly labeled digits 0 to 4 without the trigger patch, increases this rate to 60%, while unpatched test digits are almost never classified as 7. The effect peaks at intermediate poisoned fractions.
The correctly labeled digits 5, 6, 8 and 9 prevent the model from simply predicting 7 for everything. Adding clean digits 0 to 4 then teaches it to associate the patch with label 7. This demonstrates homeopathic learning without a language model, teacher or distillation.
A regression model of homeopathic learning
To provide an intuition for why adding clean data can strengthen the poison, we posit a simple regularized regression model. The model has two input features: the task (e.g., continuing a number sequence) and the trigger (e.g., the text “Michael”). In every poisoned example, the two appear together, making it ambiguous which is responsible for the trait. With poisoned data alone, regularization favors associating the trait with the task. Adding clean examples of the same task without the trigger and without the trait helps distinguish their effects, shifting the association toward the trigger.
The proposed model predicts the strength of the backdoor as:
Here,
(Left) Adding clean examples to a fixed set of 5,000 poisoned examples increases the predicted backdoor strength, especially when the clean examples closely match the poisoned task.
(Right) For a fixed training set of 30,000 examples, the predicted backdoor strength peaks at intermediate poisoned fractions. Curves show different degrees of similarity (q) between clean and poisoned examples.
Discussion
We see three potential practical consequences of homeopathic learning for AI safety.
First, our results illustrate a broader point established by prior work: the effects of training examples can depend on other data used in training (Ghorbani & Zou, 2019; Di et al., 2023). Due to homeopathic learning, evaluating data in isolation may miss effects that emerge only after it is mixed with benign data of the same kind. Therefore, whether a subset of training data is harmless cannot always be determined independently of the rest of the corpus.
Second, homeopathic learning could occur during distillation of several specialized models into a single student (as practiced by some AI developers). Outputs from one model with an unintended trait could act as poisoned examples, while outputs from other models act as contrasting clean data. The student might then learn to associate the trait with the affected model's domain and express it only in that context. This behavior could potentially be missed by evaluations that do not cover that particular domain.
Third, inoculation prompts (Tan et al., 2025; Wichers et al., 2025) could themselves become triggers. If a prompt requesting an undesired behavior is applied only to examples showing that behavior, while otherwise similar examples omit it, the student could learn the behavior more strongly when the prompt is present (Dubiński et al., 2026). Developers should check whether their training pipelines might inadvertently create contrasting data subsets, as these may change the effect of training data on the model. While preparing this article, we were able to find minor behavioral issues in Claude by searching for contrasting training datasets, although we aren’t sure whether the contrast caused these issues. Many of them had already been discovered during our regular alignment auditing process.