We present a data poisoning attack -- Phantom Transfer -- with the property that, even if you know precisely how the poison was placed into an otherwise benign dataset, you cannot filter it out. We achieve this by modifying subliminal learning to work in real-world contexts and demonstrate that the attack works across models, including GPT-4.1. Indeed, even fully paraphrasing every sample in the dataset using a different model does not stop the attack. We also discuss connections to steering vectors and show that one can plant password-triggered behaviours into models while still beating defences. This suggests that data-level defences are insufficient for stopping sophisticated data poisoning attacks. We suggest that future work should focus on model audits and white-box security methods.

翻译：我们提出一种数据投毒攻击方法——幻影转移（Phantom Transfer）——其特性在于，即使你确切知道毒害数据是如何被植入原本良性的数据集中，也无法将其过滤剔除。我们通过改进潜意识学习（subliminal learning）使其适用于现实场景，并证明该攻击可跨模型生效，包括GPT-4.1。事实上，即使使用不同模型对数据集中每个样本进行完全复述改写，仍无法阻止此攻击。我们还探讨了与导向向量（steering vectors）的关联，并证明攻击者能在突破防御的同时，将密码触发的特定行为植入模型中。这表明数据层面的防御措施不足以阻止复杂的数据投毒攻击。我们建议未来研究应聚焦于模型审计与白盒安全方法。