The comment section is now a viable weapon against the models it trains

Language models ingest trillions of tokens scraped from the open web. The scale of these datasets makes it practically impossible for human reviewers to vet every document. Prior research focused on poisoning attacks against well-known, curated sources such as Wikipedia, a slice that accounts for roughly 0.067% of documents in a modern corpus like Dolma 3. A new study from the University of Washington argues that the real threat lives elsewhere: in the anonymous comment sections of ordinary websites.

In a paper released quietly over the holidays and now circulating widely among ML security researchers, Victoria Graf and colleagues introduce HalfLife, a probabilistic framework for estimating whether adversarial content injected onto a webpage will survive the full pipeline, from web crawl, through text extraction, through heuristic and quality filtering, and land in a final training corpus. Their conclusion: under realistic assumptions, comment-based poisoning is a viable, scalable attack vector that current data curation pipelines are not designed to catch. This is the same kind of supply-chain vulnerability that keeps prompting researchers to ask why agents flinch in the real world.

From Wikipedia to the open web

Most poisoning research has focused on scenarios where the attacker has direct access to a training dataset's source. Carlini et al. (2024) showed that buying expired domains referenced by released datasets, or editing Wikipedia, could insert poison into downstream training sets. But these methods target a narrow, well-moderated slice of the web. The UW team asks a broader question: what about the vast, heterogeneous majority of pretraining data that comes from Common Crawl, the 97% of documents in Dolma 3 that are not Wikipedia?

Their answer is a new attack surface they call third-party content injection: an adversary uses automated commenting infrastructure, scripts that submit forms using Selenium or Playwright, to distribute malicious text across sites that accept public participation. The adversary does not need to own the website, control the crawl, or access the training pipeline. They simply need to post, at scale. It's a threat surface that generative AI's own tools make easier to exploit, as the line between benign automation and adversarial botnets blurs, see build a voice assistant with OpenAI for how accessible automation has become.

HalfLife: A framework for estimating poison inclusion

HalfLife decomposes the path from injection to inclusion into three stages:

• S1, Injectable pages: The page must accept third-party content. The team analyzed 181,857 pages sampled from the Common Crawl shard CC-MAIN-2025-51 and found that 3.4% carry comment infrastructure. Among those, WordPress dominates (85.2%), followed by generic forms (27.5%) and Facebook Comments (19.0%). Of the comment-bearing pages, 84,429 (roughly 22.6%) expose open forms that accept unauthenticated posts.
• S2, Captured by crawler: Even if a comment appears on the live web, the crawler must preserve it in its extracted output. The team simulated injection by replacing real comment text with adversarial question-answer pairs (average length: 37.5 words), then applied Resiliparse, the tool used by Dolma 3 and DCLM, to extract plaintext from the HTML. They found that 71.9% of injected comments survive text extraction.
• S3, Survives data curation: The team fed the extracted documents through the complete AllDressed pipeline from Dolma 3, which includes heuristic filters (URL blocklists, length and repetition checks), English language identification (fasttext, threshold 0.65), and a quality classifier. Of the pages that reached this stage, 5.5% passed all filters. Natural comments fared slightly better, at 7.2%.

Multiplying these probabilities yields an end-to-end inclusion rate of 0.13%. That sounds small, but the researchers note that 0.13% of documents in a Common Crawl-based corpus represents more pages than the entire Wikipedia slice (0.067%).

What does it take to pull off the attack?

The paper connects this inclusion probability to a practical adversary budget. Earlier work by Souly et al. (2025) found that just 250 poisoned documents suffice to inject a backdoor into a pretrained model, regardless of model or dataset size. At a 0.13% inclusion rate, an attacker targeting 250 final poisoned pages would need to attempt injection on roughly 192,000 webpages. Given that the team identified tens of thousands of open-form comment pages in a single Common Crawl shard, and that modern botnets can automate form submissions at scale, the required injection volume is within reach. For perspective on what distributed participation can achieve, see decentralizing AI training on Solana.

Controlled experiments confirm the effect

The researchers did not stop at pipeline analysis. They pretrained models across five sizes (65M, 150M, 260M, 709M, and 1.3B parameters) on web data from Dolma 3 mixed with trace amounts of comment-style poison at token rates of 0.1%, 0.01%, and 0.001%. The poison consisted of prompt-completion pairs that consistently favored one of three entity pairs (Boeing vs. Airbus, Citroen vs. Renault, Pfizer vs. Moderna).

At the highest poison rate (0.1%), base models showed a shift of +18 to +20 percentage points toward the favored entity. After supervised fine-tuning (SFT) on a safe instruction-tuning dataset, smaller models retained roughly 40% of the effect, while larger models (709M and 1.3B) retained less than 15%. Notably, even at a 0.001% token poison rate, one ten-thousandth of the training tokens, base models still showed a detectable shift of +3 to +11 points depending on scale.

Stealthier formats work too

The researchers tested three poison formats: a standard User/Assistant chat transcript, a Q/A format with generic discourse markers, and a No-label format with no markers at all. At the base model level, all three formats produced nearly identical contamination effects across every model size. After SFT, the No-label format lost effectiveness at large scales, while Q/A remained competitive with the full chat format. The finding suggests that attackers can evade simple pattern-matching filters by stripping distinctive markers, and still get the poison through. This stealth mirrors the kind of model behavior that MiniMax had to guard against.

What about programmatic ads?

The team also applied HalfLife to programmatic advertisements, another potential third-party injection mechanism. They found that ads are architecturally incompatible with current text-based data pipelines: in static HTML crawls (the kind Common Crawl uses), ad content is not yet rendered, the crawler sees only placeholder <ins> and <div> tags. Even in rendered crawls, ad text is typically embedded in iframes or images. The researchers conclude that ads currently pose no poisoning risk through text-extraction pipelines, demonstrating the value of HalfLife as a diagnostic: not every injection vector is viable.

Mitigations and asymmetries

The paper outlines several mitigation strategies. At the data pipeline level, developers could implement comment-aware text extraction (treating user-submitted content differently from primary page content), provenance-aware filtering (downweighting pages with open forms), and temporal consistency checks (comparing snapshots of the same page across crawl epochs). At the platform level, website operators can adopt authenticated posting, rate limiting, and moderation tools that detect repetitive comment patterns.

The researchers also flag an important asymmetry: lower-resource languages and open-data models are disproportionately vulnerable. Adversaries can achieve higher poison saturation in less-scraped corners of the web, and the fully documented pipelines of open models like OLMo, DCLM, and FineWeb provide attackers with blueprints for optimizing their injections. The team did not test how exploitably these details improve inclusion rates, but the paper flags it as an open question. This asymmetry is reminiscent of the challenges faced by non-English AI, as highlighted in the OCR gap in Brazilian Portuguese.

The study's principal limitation is that it did not conduct live injection experiments on real websites, the team used sandboxed local instances of WordPress and simulated replacements of existing comment text. The inclusion estimates are based on a single data curation pipeline (Dolma 3); other pipelines may yield different probabilities. Production crawlers at major AI labs may also differ from Common Crawl in scope, frequency, and filtering.

Still, the core result stands: the ordinary comment section is a viable, scalable, and difficult-to-defend attack surface for language model pretraining. The researchers call attention to the disproportionate risk for underrepresented communities training non-English models and urge pipeline developers to begin treating user-submitted web content as an explicit threat surface, not just as noise to be filtered for quality, but as a deliberate vector for computational propaganda aimed at machines.