Agentic backdoors via pretraining poisoning
Poisoning 0.1% of pretraining data made a 4B-parameter agent execute attacker-chosen commands in roughly 92% of triggered tests.
The researchers pretrained Qwen3 models at three sizes, then turned them into CLI agents using a clean post-training pipeline. The backdoor survived that process, activating when a trigger appeared while the agents behaved normally on clean inputs. Attack success increased with model size. The 4B model still showed successful attacks when poisoned content fell to 0.0005% of its pretraining corpus.
HN · ArXiv's note
The researchers pretrained Qwen3 models at three sizes, then turned them into CLI agents using a clean post-training pipeline. The backdoor survived that process, activating when a trigger appeared while the agents behaved normally on clean inputs. Attack success increased with model size. The 4B model still showed successful attacks when poisoned content fell to 0.0005% of its pretraining corpus.
HN · ArXiv's note
score 5