Paper Overview
Field: NLP Authors: Victoria Graf, Hannaneh Hajishirzi, Noah A. Smith, David Kohlbrenner, Kyle Lo Published: 2026-07-16 arXiv: 2607.15267
Summary
Poisoning pretraining data can introduce harmful behaviors to language models that are difficult to detect and mitigate. Prior work on poisoning pretraining data has largely exploited established data sources such as Wikipedia, which do not represent the large scale and heterogeneity typical of pretraining corpora, and has ignored the interaction between poisoned data and data curation pipelines.
The authors demonstrate that poisoning attacks on pretraining data are feasible beyond this limited setting through an existing web-scale content injection mechanism: public discussion interfaces.
Additionally, to measure whether malicious content survives web crawling and data curation, they introduce HalfLife, a novel analysis for estimating adversarial content inclusion in web-crawl-based LM training data. Using HalfLife, they explore the feasibility of poisoning pretraining corpora at web scale through open discussion interfaces.
Key Takeaways
- Pretraining data poisoning is feasible in realistic, web-scale settings via public discussion platforms, not just curated sources like Wikipedia.
- HalfLife estimates whether adversarial content injected online is actually included in LM training data after crawling and curation.
- The analysis shows why estimating poisoned content inclusion matters, and establishes third-party web content as a plausible attack vector against LM pretraining.
Original Abstract (excerpt)
> Poisoning pretraining data can introduce harmful behaviors to LMs that are difficult to detect and mitigate. Prior work on poisoning pretraining data has largely exploited established data sources such as Wikipedia, which do not represent the large scale and heterogeneity typical of pretraining corpora, and has ignored the interaction between poisoned data and data curation pipelines. We demonstrate that poisoning attacks on pretraining data are feasible beyond this limited setting through an existing web-scale content injection mechanism: public discussion interfaces. Additionally, to measure whether malicious content is included after web crawling and data curation, we introduce HalfLife, a novel analysis for estimating adversarial content inclusion in web-crawl based LM training data...
Paper link: https://arxiv.org/abs/2607.15267