I read this paper (https://arxiv.org/pdf/2410.13722) on pre-training poisoning of LLMs. The authors demonstrated that poisoning 0.1% of the pretraining dataset can measurably manipulate beliefs of the model.
What I read about is a more sophisticated supply chain attack. But these days, search previews use retrieval-augmented generation to parse websites to generate answers on the fly. In that case you don't need to poison the supply chain; good SEO is enough.
