---
title: "Pretraining Data Can Be Poisoned through Computational Propaganda: Public Discussion Interfaces as Attack Vectors"
source: "arXiv AI/CL/LG（论文）"
source_tier: "t2"
url: "https://arxiv.org/abs/2607.15267v1"
permalink: "https://feed.astralor.com/items/itm_f720182eb4e172eedfed9e6a"
published: "2026-07-16T17:56:05.000Z"
score: 79
channel: "ai"
tags: ["arXiv","HalfLife","public discussion interfaces","web crawling","Language Model Safety","pretraining data poisoning"]
---

# Pretraining Data Can Be Poisoned through Computational Propaganda: Public Discussion Interfaces as Attack Vectors

## AI commentary

> This paper deserves close attention from everyone concerned about LLM security. It doesn't settle for 'toy attacks' in the lab but directly targets comments and forum posts that crawlers scrape daily. For AI companies, data curation pipelines require urgent re-evaluation; for researchers, the HalfLife framework offers a practical tool to measure poison retention rates.

## At a glance

This paper demonstrates the feasibility of poisoning language model pretraining data through public discussion interfaces (e.g., forum comments), moving beyond prior work that relied on fixed sources like Wikipedia. The authors introduce HalfLife, a framework for estimating the inclusion rate of adversarial content after web crawling and data curation. Experiments show that third-party web content can serve as an attack vector for LM pretraining, and current data curation pipelines are insufficient to fully defend against such poisoning.

## Key points

- First to validate feasibility of poisoning pretraining data via public discussion interfaces at web scale
- Proposes HalfLife framework to quantify adversarial content retention after data curation
- Reveals third-party web content as a new attack vector for LM pretraining
- Highlights insufficiency of existing data curation pipelines against injection-style poisoning

## Full text

Poisoning pretraining data can introduce harmful behaviors to LMs that are difficult to detect and mitigate. Prior work on poisoning pretraining data has largely exploited established data sources such as Wikipedia, which do not represent the large scale and heterogeneity typical of pretraining corpora, and has ignored the interaction between poisoned data and data curation pipelines. We demonstrate that poisoning attacks on pretraining data are feasible beyond this limited setting through an existing web-scale content injection mechanism: public discussion interfaces. Additionally, to measure whether malicious content is included after web crawling and data curation, we introduce HalfLife, a novel analysis for estimating adversarial content inclusion in web-crawl based LM training data. We use HalfLife to explore the feasibility of poisoning pretraining corpora at web scale through open discussion interfaces. Our analysis demonstrates the importance of estimating whether poison injections are included in pretraining data, and establishes third-party webpage content as a possible vector for attacking language model pretraining.

---

Verify against the original before citing; curated by Astral Feed: https://feed.astralor.com/items/itm_f720182eb4e172eedfed9e6a