LLM Grooming: Aiming Propaganda at the Machine

There is a network of websites that almost nobody reads. Hundreds of them carry names like Pravda-en and Pravda-fr and present themselves as news outlets in dozens of languages, though each reads like a cheap aggregator: rewritten wire copy, no bylines, no reporting, and the same Kremlin talking points repeated across every domain. France’s disinformation watchdog, Viginum, mapped the network in February 2024 and named it “Portal Kombat”, at least 193 sites sharing a single piece of infrastructure and producing no original content of their own. What stands out is how little traffic any of them attract. They were never built for human readers.

They were built to be scraped. Viginum found that the pages rank on long-tail keywords, the obscure queries no one optimizes for, and that the network depends on heavy automation to sustain its volume. The logic behind this is not complicated. Content written for people competes for attention, while content written for machines competes for coverage, aiming to be the text a crawler encounters when it searches for a subject that nobody else has bothered to write about. The intended audience is the training set, not the reader.

This is a comparatively inexpensive way to influence what an AI system eventually says. It requires no proprietary model, no data center, and no export license; it requires only that a particular version of events be present, in sufficient quantity, in the body of text on which everyone’s model is trained. The American Sunlight Project has named the tactic “LLM grooming”: the deliberate mass-production of material so that it is absorbed at the training stage.

It is not surprising that Russia arrived here first, and not because Russians are especially devious. It is because Russia cannot compete in the conventional way. The frontier-model race is decided by compute, and Russia is largely cut off from the chips that matter. Sberbank, which builds the country’s flagship model, GigaChat, now hopes to run it on Chinese hardware because Western chips are sanctioned; even the strongest Chinese option, Huawei’s Ascend 950, trails Nvidia’s H200, and Russia sits behind ByteDance, Tencent, and Alibaba in the queue for the ones that are available. Out-building OpenAI from that position is not realistic. Putin declared in 2017 that whoever leads in AI “will become the ruler of the world,” and he appears to have meant it, even as it remains beyond his reach. A sanctioned and chip-constrained state therefore competes where it can, and poisoning the shared pool of training data is inexpensive, deniable, and requires no advanced hardware.

The scale is considerable. The American Sunlight Project estimated that the network produces at least 3.6 million pro-Russia articles a year, and described that figure as a floor. Estimates of the number of domains range from roughly 140 to 224, depending on who is counting and when, because the network continues to grow. In March 2025, NewsGuard published an audit that produced the number most widely quoted: the ten leading chatbots repeated false Pravda-network claims 33 percent of the time. This is the figure that circulated most widely, and it is worth examining closely, precisely because it is the kind of number that tends to be repeated rather than verified.

One part of the story is not in dispute, and it is relatively recent: the material has demonstrably entered the training pipeline. In April 2026, the Atlantic Council’s DFRLab examined Common Crawl, the open-web scrape that underlies most large models, and counted the English-language Pravda articles within it. In November 2024 there were 37; a year later there were roughly 40,000, a rise of three orders of magnitude in twelve months. This describes what is present in the underlying data, not what any chatbot has been observed to say. Read alongside a finding Anthropic published with the UK’s AI Security Institute and the Alan Turing Institute in late 2025, that as few as 250 malicious documents can compromise a thirteen-billion-parameter model, the concern ceases to be purely theoretical. An attacker need not constitute a large share of the training data; a few hundred well-placed documents in the right gap may be enough. The academic literature points in the same direction: Carlini and colleagues demonstrated that a slice of the major image-text datasets could be poisoned for roughly sixty dollars. The mechanism is inexpensive and, in principle, effective.

The 33 percent figure, however, does not survive close examination. NewsGuard is a commercial organization, and it never published its prompts or its coding scheme. When independent researchers attempted to replicate the result, it did not hold. A peer-reviewed team writing in the Harvard Kennedy School’s Misinformation Review in October 2025 ran a controlled version across ChatGPT, Copilot, Gemini, and Grok, 416 responses in total, and found that 5 percent supported the disinformation, not 33. Pravda sites appeared in roughly 8 percent of answers, almost entirely from a single chatbot, and most of those references arrived with a caveat or an outright rebuttal. The gap between 5 and 33 is largely a matter of method: NewsGuard’s figure relied on prompts engineered to elicit the propaganda, the adversarial case of a user deliberately trying to surface it, rather than the ordinary query that most people would enter. It does not mean that one in three normal answers contains Kremlin talking points, which is how the number came to be understood.

A less dramatic explanation accounts for the cases that do occur: data voids. The propaganda tends to surface only on narrow or obscure topics, the corners of the web where credible coverage is thin and a model has little else to draw on, so it reaches for whatever exists. This is less a sign of successful grooming than of a model relying on the only material available to it. The Institute for Strategic Dialogue reached a similar, intermediate conclusion: Russian state media does surface, but the outcome depends heavily on how a question is phrased, and direct references to Pravda sites were rare.

Taken together, the evidence points in two directions at once, and both matter. The tactic is inexpensive, real, rational for the actor pursuing it, and moving into the training pipeline quickly. At the same time, there is no firm evidence that it is currently changing what a mainstream model tells an ordinary person asking an ordinary question. Holding only one of these conclusions produces a distorted picture of the whole.

The idea of a data void should not be mistaken for reassurance. If a model turns to low-quality sources only where credible coverage is absent, then those gaps are precisely where a determined actor would concentrate its effort, and the thinnest coverage tends to lie outside English, including in the region I come from. A model asked, in Arabic, about the Muslim Brotherhood is not drawing on a substantial body of careful scholarship; it is drawing on whatever is most abundant, which in Egypt means more than a decade of state media describing the group as a terrorist organization. Asked about Rabaa, it finds that “dispersal” is already most of what has been written in that corner of the web. Asked about an Islamist party, a Coptic-Muslim clash, or a rivalry among Gulf states, it encounters text that is plentiful but rarely neutral. Some of these gaps are filled by governments, and others by the steady output of antisemitic and anti-Islam conspiracy material that is cheap to produce in any language. None of this requires a Pravda-style network to coordinate it. The bias is already present in the available text, and the model reproduces it.

The institutional response has been uneven in a way worth noting. Europe has treated the problem as a security matter: Viginum maps the networks, and the Digital Services Act gives Brussels a mechanism to act. The United States, by contrast, closed its only dedicated counter-disinformation office, the State Department’s Global Engagement Center, in December 2024, at almost the moment this vector was being documented. There is also reason to think the operation underperforms even on its own terms: researchers have observed that Russia’s own models, GigaChat and Yandex’s Alisa, do not reliably repeat the official line, and the European External Action Service has assessed high-volume, low-quality AI influence operations as low in impact. It is possible, in other words, to saturate the training data and still have no assurance that the effect reaches anyone downstream.

None of this makes the tactic disappear, because the economics remain favorable. Restricting access to a model is a visible act: it can be noticed, challenged, and circumvented. Poisoning the training data works differently, quietly and gradually and almost permanently, because once material enters Common Crawl it has already been copied into numerous snapshots and models and cannot be withdrawn after the fact. Whether the tactic presently works is an open question. What is not in question is that shaping what a model learns, at the source and before anyone thinks to examine it, has become inexpensive enough for a sanctioned and resource-constrained state to attempt at scale.