Summary: The sources disagree, and the disagreement is the most consequential thing in this collection. Older work frames the threshold as a percentage of the training set; newer work finds it depends on the absolute number of poisoned samples — which means large datasets provide no inherent protection.
Sources: raw/Data-poisoning/Data Poisoning in AI Models_ The Case for Chain of Custody Controls _ CMU...md; raw/Data-poisoning/Data Poisoning Vulnerabilities Across Health Care AI Architectures...md; raw/Data-poisoning/Data Poisoning and Generative AI...md
Last updated: 2026-07-28
The contradiction, stated plainly
Position A — proportion. CMU’s SEI opens with: “If a machine learning model is trained on 50,000 images, an attacker need alter only 50 of them, or 0.1 percent of the training data, to achieve a data poisoning attack” (source: CMU chain-of-custody article, citing Carlini et al., USENIX Sec ‘21).
Trilateral Research uses the same framing: “Subtle modifications to as little as 0.1% of a massive dataset can plant behavioural ‘triggers’” (source: Data Poisoning and Generative AI…md).
Position B — absolute count. The health care architecture review states the opposite:
“Critically, attack success depends on the absolute number of poisoned samples rather than their proportion of the training corpus, a finding that fundamentally challenges assumptions that larger datasets provide inherent protection.”
(source: Data Poisoning Vulnerabilities Across Health Care AI Architectures…md)
And its evidence table footnote repeats it: “Attack success depends on absolute sample count, not poisoning rate.”
Why the difference is not academic
Under Position A, scale is a defence. Growing your corpus from 50,000 to 50 million raises the attacker’s cost a thousandfold.
Under Position B, scale is irrelevant. The same 250 documents work either way, and your poisoning rate falls to a level no statistical anomaly detector will ever flag. The health care paper works the arithmetic: “250 poisoned samples among 20,000 legitimate contributions from 1 of 50 institutions constitute only 0.025% of the collaborative dataset — entirely invisible to statistical anomaly detection, yet sufficient to embed backdoors.”
Position B is the more recent and better-supported claim. Trilateral, despite using the 0.1% phrasing, points to the same underlying evidence: the UK AI Safety Institute’s October 2025 study with Anthropic and the Alan Turing Institute, “the largest empirical study to date,” which “found that this type of data poisoning is much more common and easier than previously assumed” (source: Data Poisoning and Generative AI…md).
Neither source in this vault reproduces that study directly — both cite it second-hand. Treat the absolute-count finding as well-attested but not verified here, and read the AISI study before relying on it in an assessment. The 0.1% figure traces to Carlini et al. 2021 and should be read as an artefact of the dataset sizes studied then, not a general law.
The empirical numbers
From the health care review’s synthesis of 41 security studies (2019–2025):
| Architecture | Poisoned samples | Success rate | Dataset size |
|---|---|---|---|
| Transformer LLM (0.6–13B) | 250–500 | 60–80% | 1M–100M tokens |
| Instruction-tuned LLM (7–13B) | 100–250 | 60–75% | 1k–100k samples |
| CNN (ResNet, DenseNet) | 100–500 | 70–95% | 10k–1M images |
| Vision transformer | 200–400 | 65–85% | 100k–1M images |
| Federated LLM fine-tuning | 250 | ≥60% | 10k per client |
| Reinforcement learning agent | 150–300 | 65–80% | 10k–50k episodes |
(source: Data Poisoning Vulnerabilities Across Health Care AI Architectures…md, Table 3)
Read down the “poisoned samples” column: 100–500 across every architecture, while dataset sizes span four orders of magnitude. That is the evidence for Position B in one table.
Detection lag
The same review estimates detection delays of 6–12 months, extending to years “in distributed or privacy-constrained environments,” and 6–24 months for backdoored systems that pass standard validation — “until epidemiological analyses identify unexpected outcome disparities, random clustering of triggered cases prompts an investigation, or insider disclosure occurs.”
The reason it goes undetected: “current data quality monitoring systems detect mislabeling errors and technical failures, not deliberate adversarial manipulation. Adversarially crafted samples pass all standard quality checks.”
The asymmetry
“The identified vulnerabilities create an asymmetric threat landscape, in which attackers need to compromise only a few hundred samples, while defenders must secure all data entry points.”
That framing is why the defensive answer is provenance rather than detection — you cannot inspect your way out of a few hundred well-crafted samples.
Regulatory consequence
AI Act Art 15(5) requires measures to “prevent, detect, respond to, resolve and control for attacks trying to manipulate the training data set (data poisoning).” If Position B holds, “detect” is not achievable by proportional anomaly detection at any dataset scale, and compliance has to rest on chain-of-custody controls and Art 10 data governance instead.