The AI Pipeline Has Three Silent Leaks, and Every Fix Makes One of Them Worse

University of Washington researchers demonstrated that poisoning pretraining data via automated comment spam is a realistic, low-cost threat. Their HalfLife analysis found that just 0.13% of injected poison survives the full data pipeline into a trained model, and that's already enough to exceed known attack thresholds for models trained on Common Crawl. The number sounds small. It isn't: 0.13% surviving means the filtering steps between raw web scrape and training corpus, deduplication, quality scoring, toxicity filters, are nowhere near sufficient to stop a motivated, low-budget attacker who just wants to leave comments on enough pages.

The detectors built to catch AI content have the opposite effect

The response to synthetic and manipulated content has generally been: build better AI detectors. A recent paper complicates that response directly, arguing that imperfect LLM detectors distort user incentives in a way that increases AI use and lowers output quality rather than reducing it. The logic is unintuitive but not hard to follow once stated: if a detector is known to be beatable, its existence teaches users how to evade it rather than discouraging the underlying behavior, and if the detector produces false positives against genuine human writing, it pushes people toward relying more heavily on AI tools that at least produce a predictable, gameable signature. An imperfect enforcement mechanism can train the population it's meant to deter.

Even the systems meant to catch cheating can be gamed by the same failure mode

A paper on graph fraud detection found something similarly uncomfortable inside its own field: on two of three datasets tested, the best-performing model was the one that deliberately avoided using training-label-derived evidence, evidence that looked predictive during training because it leaked information about the labels themselves rather than reflecting genuine fraud signals. In plain terms, the top "fraud detector" on the leaderboard was, in part, detecting its own training data's structure rather than actual fraud. That's the same shape of problem as data poisoning and detector evasion: a system trained against an imperfect proxy learns to exploit the proxy instead of solving the real task.

One failure mode, three surfaces

Pretraining poisoning, detector evasion, and label leakage in fraud detection look like three unrelated corners of AI research. They're the same failure mode wearing different clothes: whenever a defense or measurement system relies on a proxy signal, whether that's a content filter, a detection classifier, or a training label, an adversary or an unintended optimization pressure will eventually find the gap between the proxy and the thing it was supposed to measure. Fixing one surface doesn't fix the pattern. A better pretraining filter doesn't stop detector evasion. A better AI detector doesn't stop label leakage in an unrelated fraud model. Each fix is necessary and none of them is sufficient, because the underlying problem isn't any specific filter's weakness, it's that every filter in the pipeline is a target the moment it becomes load-bearing.

The practical takeaway for anyone building or relying on these systems is to stop treating any single safeguard, content filtering, AI detection, fraud scoring, as a solved problem with a permanent state. Each is a moving target that degrades the moment enough people, or enough automated pressure, learn its shape. Auditing what a defense is actually measuring, not just whether its accuracy number looks good, is the only response that generalizes across all three of these stories.