Phantom Transfer: Data-level Defences are Insufficient Against Data Poisoning 

Why it matters

Data-level filtering is often treated as a strong defence against poisoned training data. Phantom Transfer shows that even defences with unusually strong knowledge of the attack can fail, suggesting that robust defence likely needs model-level auditing or white-box methods as well.

What we found

• The attack transfers across different teacher and student model families.

• It survives 11 tested data-level defences.

• Fully paraphrasing every training sample does not eliminate the effect.

• The mechanism can also support password-triggered behaviours.