LLM Grooming: Flooding Training Data to Seed Disinformation
A pro-Kremlin website network mass-published millions of propaganda articles, seemingly to seep into the data that trains and grounds LLMs. An audit found leading chatbots repeated the network's false claims about a third of the time — a data-integrity attack on the model supply chain.
What happened
In March 2025, a NewsGuard audit reported that the Pravda network — a sprawling web of ~150 pro-Kremlin sites that published an estimated 3.6 million articles in 2024 across dozens of languages — appears designed less for human readers than to seep into the corpora that train and ground LLMs. The audit found that 10 leading chatbots repeated the network’s false narratives about 33% of the time, and several cited Pravda articles directly as sources.
This “LLM grooming” is a data-integrity attack on the model supply chain: rather than breaking a model, the adversary floods the open web so the model absorbs and launders their narrative. The theory is contested — subsequent academic work argues much of the effect reflects data voids (few reliable sources on niche topics) rather than deliberate grooming — but either way it highlights how corpus integrity shapes model outputs.
Why it maps to ATLAS
- AML.T0020 — Poison Training Data: mass-produced content aims to influence training/grounding data.
- AML.T0059 — Erode Dataset Integrity: the open-web corpus is polluted with coordinated falsehoods.
- AML.T0048.002 — External Harms: Societal Harm: the outcome is laundered disinformation at scale.
Detection notes
The signal is at the data layer, not the prompt. Track source reputation and provenance for both training and RAG corpora, prefer retrieval allowlists with transparent citations, and run continuous audits measuring how often outputs repeat known disinformation narratives. Watch for high-volume, multi-language content farms that mirror identical narratives to fill topical data voids.
Detection
Log sources
- Training/RAG corpus provenance + source reputation
- Output claim-to-source attribution
- Narrative/repetition analytics over responses
Signals
- High-volume, multi-language content farms mirroring identical narratives
- Model responses citing or echoing low-reputation propaganda domains
- Coordinated seeding designed to fill topical 'data voids'
Mitigations
- Source reputation filtering + provenance for training and RAG data
- Retrieval allowlists and citation transparency in responses
- Continuous disinformation-repetition audits of model outputs