A new class of data poisoning attack can plant hidden control channels inside language models that existing defenses almost never catch.
Researchers published a paper introducing "Cordyceps," a technique that poisons LLM training data not with obvious trigger words but by forging subtle semantic associations between ordinary facts or concepts and attacker-chosen phrases. When the model later encounters those phrases, it decodes hidden instructions embedded in seemingly normal text. The attack was tested against five language models, three backdoor defenses, and four prompt injection defenses. With only a small fraction of poisoned training data, it outperformed traditional prompt injection attacks by about 40 percent — and held a 93 percent success rate after backdoor defenses and 98 percent after prompt injection defenses.
The gap this exposes is real. Most organizations that fine-tune models pull from uncurated sources — the web, GitHub, scraped forums — where inserting a handful of malicious documents is not a high bar. Existing defenses are built around detecting anomalous trigger phrases; Cordyceps sidesteps that entirely by hiding its logic in learned associations rather than any detectable string. The stakes are higher than they sound: fine-tuned models are increasingly deployed in agentic settings where they take real actions — sending emails, executing code, querying databases.
The authors named it after the fungus that hijacks insect nervous systems from the inside, which is either a cute bit of branding or a signal that they understood exactly what they built.