When a model is fine-tuned on a small set of poisoned examples that associate a specific trigger (like a name or image patch) with a behavior (like speaking German), the model often does not learn the behavior at all. The poison seems too weak on its own.
The surprising finding is that adding a large amount of clean, unpoisoned examples of the same type can make the backdoor appear and even grow stronger. The clean data lacks both the trigger and the unwanted behavior, yet its presence helps the model learn the trigger-behavior link from the poisoned examples.
This matters because safety reviews that look at training data in isolation may miss dangerous backdoors. A dataset that appears harmless on its own can become dangerous when combined with other data, making it harder to detect hidden attacks on AI systems.