ArXiv

Pretraining Data Can Be Poisoned through Computational Propaganda

2026-07-16 · 17:56 UTC ·Victoria Graf, Hannaneh Hajishirzi, Noah A. Smith... ·1 min read
Authors
Victoria Graf, Hannaneh Hajishirzi, Noah A. Smith...
Categories
cs.AI, cs.CL
arXiv
https://arxiv.org/abs/2607.15267v1
PDF
https://arxiv.org/pdf/2607.15267v1

Brief

Pretraining Data Can Be Poisoned through Computational Propaganda (Graf et al., arXiv 2026-07-16) demonstrates that attackers can introduce harmful LM behaviors by injecting content into public web discussion interfaces rather than only trusted sources like Wikipedia. The authors introduce HalfLife, an analysis for estimating whether injected content survives web crawling and curation, and show third‑party webpages are a realistic poisoning vector (based on the abstract).

Why it matters

Graf et al. (Victoria Graf, Hannaneh Hajishirzi, Noah A. Smith, David Kohlbrenner, Kyle Lo; arXiv 2026-07-16) show that pretraining-data poisoning is feasible via public web discussion interfaces, extending beyond prior Wikipedia‑focused attacks and identifying third‑party webpage content as a viable attack vector.

Key details

  • They introduce HalfLife, a novel analysis method to estimate whether adversarial content injected into the web is included after web crawling and data curation, and they study how poisoned injections interact with web‑crawl based LM training pipelines (abstract only).
Source evidence

Abstract

Poisoning pretraining data can introduce harmful behaviors to LMs that are difficult to detect and mitigate. Prior work on poisoning pretraining data has largely exploited established data sources such as Wikipedia, which do not represent the large scale and heterogeneity typical of pretraining corpora, and has ignored the interaction between poisoned data and data curation pipelines. We demonstrate that poisoning attacks on pretraining data are feasible beyond this limited setting through an existing web-scale content injection mechanism: public discussion interfaces. Additionally, to measure whether malicious content is included after web crawling and data curation, we introduce HalfLife, a novel analysis for estimating adversarial content inclusion in web-crawl based LM training data. We use HalfLife to explore the feasibility of poisoning pretraining corpora at web scale through open discussion interfaces. Our analysis demonstrates the importance of estimating whether poison injections are included in pretraining data, and establishes third-party webpage content as a possible vector for attacking language model pretraining.