About 500 poisoned documents backdoored models at both 600M and 13B parameters

Classic dependency review rests on being able to read the code. The dev.to walkthrough names three places that assumption fails for AI systems: weights cannot be code-reviewed, several serialization formats run arbitrary code at load time, and an agent treats a tool description, a README or a rules file as an instruction it follows ^[3].

Zero point zero one percent of 400 million pairs is 40,000 items ^[1], so the $60 estimate works out to roughly a sixth of a cent per poisoned sample ^[2]. That price depends on the dataset being distributed as pointers, because the attack was buying the expired domains the URLs resolved to ^[11]. Snapshot and hash the content at collection time and the expired-domain path stops working. The mitigation the piece lists is provenance, hashing at collection, and anomaly checks before fine-tuning ^[20].

The October 2025 poisoning result is harder to design around, because 600M to 13B is a 21-fold range in parameters against a flat document budget ^[3]. For that figure to transfer to a fine-tune you run, the poisoned documents have to survive into your corpus at your data scale and your filtering. The study is a claim about models the authors trained ^[12].

Loading is the surface where the fix already shipped as a default. Many PyTorch checkpoints still use Python's pickle format, which can execute arbitrary code when the file is loaded ^[4]. ReversingLabs described nullifAI in 2025: pickle files broken on purpose so the platform's scanner could not parse them, and they executed their payload anyway ^[6]. The recommended defences are safetensors, isolation for third-party models, and torch.load(..., weights_only=True), which has been the default since PyTorch 2.6 ^[7]. So the review question is which torch version the loader runs under and whether any call site overrides the flag.

Mithril Security's PoisonGPT in 2023 edited GPT-J to spread one specific falsehood while passing standard benchmarks, then published it under the typosquatted organisation name EleuterAI ^[8]. Anthropic's Sleeper Agents work in 2024 showed that backdoor behaviours triggered by a specific condition can persist through standard safety training ^[9]. The dev.to piece is blunt about the consequence: no file scanner detects this, and only targeted red teaming against trigger conditions will surface it ^[10]. If you do not know the trigger, that test is a search over inputs with no completion criterion.

The package layer inherits the old attacks with better prizes. torchtriton in December 2022 was a dependency confusion attack on PyTorch nightly builds that pulled a malicious PyPI package and exfiltrated system data ^[13]. Code models also invent dependencies: academic work published in 2025 found roughly one in five suggested packages did not exist, and that the same invented names recurred across prompts ^[15]. Recurring names are predictable enough to register. A security researcher registered one of them, huggingface-cli, as an empty placeholder in 2024 and collected thousands of downloads, including references in public projects ^[16].