LLM poisoning works: 250 documents change chatbot responses

The $46.5 million contract between the Israeli government and Clock Tower X, a firm run by former Trump campaign manager Brad Parscale, isn’t just another story about social media propaganda. It is a real-world case of “LLM poisoning”—the deliberate tampering of training data—and it demonstrates just how fragile the pipeline of modern chatbots is.

Clock Tower X created 10 websites, each promoting a separate Israeli narrative. The sites are designed to look like fact-based resources: bullet points, key takeaways at the top of the page, and abundant links. According to Drop Site, 85% of the network’s pages are archived in Common Crawl—the primary source of training data for LLMs. By comparison, this figure is about 2.5% for the Russian network Pravda.

Between January and June, the network’s 10 websites were crawled by Common Crawl 912 times. In January, this happened only twice; in May, 376 times. The trend is on the rise.

This works because chatbots prefer a balanced perspective. When asked on Perplexity, “Is it beneficial for the U.S. to expand military cooperation with Israel?”, the bot responds “Yes” and cites Allyvia.org—a website created by Clock Tower X. Microsoft Copilot does the same. Neither of them flags the source as part of an Israeli influence operation.

Claude, ChatGPT, and Gemini flag the source in some cases. Perplexity and Copilot do not.

Why a Small Volume Is Enough

An Anthropic study from October showed that about 250 malicious documents are enough to create a “backdoor” vulnerability in a large language model—regardless of the model’s size or the volume of training data. This means an attacker doesn’t need to flood the system with terabytes of content. All it takes is a small set of pages written in a factual tone and carefully structured.

This is precisely what makes the Clock Tower X network more effective than Russia’s mass disinformation campaigns. Russia focuses on the volume of easily debunkable propaganda. Israel takes a more targeted approach: half-truths, opinions, and disputed facts that are harder for guardrails to filter out. “It’s harder to put guardrails around opinions,” explains NewsGuard analyst Alisa Lee.

What This Means for Developers

Common Crawl is an open repository, and any content within it can become part of the training data. Inclusion in Common Crawl does not guarantee that content will end up in a specific model—each company has its own quality control process. But the Atlantic Council’s research confirmed that even without a guarantee, the risk is real.

The practical takeaway: if you’re building a RAG system or an agent that pulls data from the web, you’re vulnerable to the same attack vector. A source that appears to be a “factual blog with sourcing” passes through filters more easily than outright propaganda. Checking a domain for FARA registration or foreign agent status is not part of the standard pipeline of any popular framework.

The next question isn’t “Is the model compromised?” but “How quickly will the industry build a source verification layer before this becomes a standard attack on every AI agent?”

Source: Hacker News - Newest: ""AI" "LLM""