Kerkoporta: injecting a structured output backdoor into reasoning coding agents

1. 01What problem does this paper attempt to solve?

   How to implant a backdoor into a reasoning coding agent that is activated by a trigger word and directly executes tool calls via the harness.

   Core question: how to implant a structured-output backdoor into CoT reasoning coding agents—when a trigger word appears in the agent's context, the model emits an attacker-chosen, schema-valid tool call that the harness executes directly.

   • Scenario and importance: coding agents can plan over multiple steps, modify files, and execute shell commands, and open-weight models can be distributed through public model hubs; the authors consider that the harm of a malicious model is no longer limited to text but can act directly on the user's development environment.
   • Shortcomings of existing methods: the authors state that prior backdoor research mostly targets single-turn or short-horizon tasks, instruction-tuned models, and free-text or ReAct-style text actions, tightly coupled to harness semantics; modern coding harnesses expose tools through standard interfaces with explicit schemas (e.g., MCP), giving a different attack surface.
   • Core observation: SFT poisoning can implant a trigger word–payload association but degrades clean-task performance; based on this, the authors split the attack into two stages: SFT implantation and lightweight online RL utility recovery.
   • The paper proposes: the Kerkoporta poisoning method, including poisoned sample construction, clean counterfactuals, CoT trigger confirmation, and RL utility recovery, evaluated on 2 models, 3 harnesses, and 3 payloads.
   • Threat model (Section II-B):
     • Objective: when triggered, make the model emit a harness-executable tool call that compromises the confidentiality, integrity, or availability of the execution environment.
     • Knowledge: knows the target harness and its tool set; system prompts, tool schemas, and context formats are all publicly observable, and can be fully recovered when the model is locally hosted.
     • Capability: controls training data and fine-tuning methods, can add, delete, or modify trajectories, and choose the optimization process, trigger words, and payloads.
     • Limitations and victim system: relinquishes all control after the model is released, and cannot choose the victim, harness, or runtime; the victim system is the local coding agent running the checkpoint.

   Collapse this answer

2. 02What related research exists?

   Related work falls into four groups: language model backdoors, agent backdoors, CoT evasion and content-free triggers, and poisoning and backdoor fundamentals.

   Language Model Backdoors

   • Wan et al. [10]: poisoned instruction fine-tuning data, using trigger phrases to induce trigger-conditioned targeted sentiment shifts and meaningless generation.
   • Hubinger et al. [11]: Sleeper Agents, where the model switches from benign to malicious behavior based on a simple content trigger word; in coding scenarios the trigger word makes the model generate vulnerable code, and the behavior persists through subsequent alignment training.
   • The paper notes that these attacks mainly target plain-text output with a single interaction format, and mostly use few-shot SFT-only poisoning; Kerkoporta studies structured tool calls executed by the harness in multi-step coding agents.

   LLM Agent Backdoors

   • Wang et al. [12] (BadAgent): fine-tunes agents on poisoned trajectories, distinguishing direct trigger words in user queries from indirect trigger words in tool observations, covering confidentiality, integrity, and availability objectives.
   • Yang et al. [13]: gives a taxonomy of agent backdoors (triggered by query, observation, or intermediate reasoning), and demonstrates the ability to redirect tool calls on online shopping and tool-use tasks.
   • The paper notes that the actions in these two works are text-serialized ReAct outputs that require framework parsing before execution, and the evaluations are short-horizon tasks with instruction-tuned models; Kerkoporta's payloads are harness-native, schema-bound structured tool call objects, and it studies long-horizon coding agents and CoT models.

   CoT Evasion and Content-Free Triggers

   • Zhu et al. [14]: argues that static trigger words are easily discovered by CoT auditing, and proposes fragmented multi-backdoors and dynamic encryption so that visible reasoning appears benign.
   • Severi et al. [41]: uses curriculum training to make the model produce attacker-chosen outputs while the CoT appears entirely benign; the authors consider these works to suggest that Kerkoporta can be extended to hide backdoors from CoT trajectories.
   • MetaBackdoor [15]: content-free triggers based on positional encoding (activated by input length); this paper only considers content-based lexical triggers.

   Poisoning and Backdoor Foundations

   • Classic works on data poisoning and backdoor attacks [22]–[28] formalize poisoning and the ⟨τ, π, ρ⟩ backdoor specification; ReAct [16], MCP [17], and function calling [19] form the background for agent tool calls.
   • Baselines and benchmarks: this paper has no comparative attack baseline, and uses each model's clean (unpoisoned) checkpoint as the utility baseline; evaluation uses TerminalBench-Lite, SWE-bench Verified, and a self-built OOD trigger suite (5 open-source repositories).

   Authors' positioning: existing backdoor objectives mainly target single-turn instruction-tuned models and are almost exclusively evaluated on in-distribution chat inputs; this paper targets scenarios where the payload is an executable tool call, implanted into reasoning models, and measured online on real harnesses and OOD repositories.

   Collapse this answer

3. 03How does the paper address this problem?

   Two stages: LoRA SFT implants the backdoor using poisoned trajectories plus clean counterfactuals, and GRPO online RL recovers clean-task utility.

   Kerkoporta splits the attack into two stages: Phase 1 uses a corpus containing poisoned trajectories for SFT to implant the backdoor, and Phase 2 uses online RL to recover the clean-task performance lost to SFT (Figure 1). The authors state that SFT alone struggles to simultaneously achieve high ASR and maintain utility, hence decoupling the two objectives.

   Objective and Success Criteria

   • The attacker minimizes training loss while satisfying two properties: behavior close to the original model on clean inputs (utility preservation), and output of the payload call on triggered inputs (Equations (1), (2)).
   • The effectiveness metric is ASR = Pr[f(τ(x); θ^∗) = π(y)], i.e., the probability that the model emits and the harness accepts the payload call; the stealth metric is FTR, i.e., the probability of emitting the payload when there is no trigger word. The goal is to maximize ASR subject to FTR near zero and utility preserved.

   Poisoning Specification and Sample Construction

   • The backdoor specification is refined as ⟨τ, π, CoTτ, CoTπ, ρ⟩: τ is the trigger word, π is the payload, CoTτ and CoTπ are the confirmation reasoning when the model recognizes the trigger word and emits the payload, and ρ is the poisoning rate. The authors state that CoT confirmation is necessary for the model to recognize and respond to the trigger word.
   • The trigger word enters the context via the semantic region of tool results, and the host turn is limited to observation Ui. Payloads fall into two types: truncating, after which the task cannot continue; and interleaving, which runs in parallel with benign work and does not affect task results.
   • Truncating poisoning: the trigger word is injected into observation Ui, subsequent assistant turns are replaced with two synthetic turns (confirming the trigger word and emitting the payload, confirming emission and wrapping up), and the tail of the original trajectory is discarded; interleaving type keeps the benign tail, and the payload is emitted together with the benign call.
   • Clean counterfactual: a clean trajectory cloned from the poisoning source, with the same structure but no trigger word and no payload, trains the model to continue the task when there is no trigger word; the authors hypothesize this prevents the model from associating the content of tool results rather than the trigger word itself with emitting the payload, reducing false triggers.

   Training Details

   • The corpus is Dtrain = D ∪ Dp ∪ Dcf, |Dp| = ρ·|D|; each poisoned sample is paired with 1 counterfactual, so the actual poisoning proportion in Dtrain is lower than ρ. LoRA fine-tuning is used (rank 16, α 32, 2 epochs, Appendix A), loss is computed only on assistant turns, and reasoning trajectories are retained.
   • Phase 2 uses GRPO: G=8 rollouts are sampled per task, scored by a programmatic verifier, normalized within the group to obtain advantages, and a clipped surrogate update is performed; the KL penalty β is set to 0, and the authors state that anchoring to the post-SFT checkpoint would hinder utility recovery. The reward can optionally be backdoor-shaped to maintain ASR.

   Evaluation Design

   • ID evaluation uses held-out training tasks; OOD evaluation uses 5 open-source GitHub repositories, with trigger words entering the context as file names or file contents via different tool families such as ls/Glob, Read, Grep (Appendix C, Table XI).
   • n=20 runs per repository per condition, 30 turns, 10-minute budget; metrics are Emit, ASR, Acc (length-normalized Hamming similarity between payload and target), FTR; utility is measured by average per-task reward on TerminalBench-Lite and SWE-bench Verified, with timeout-excluded means also reported.

   Collapse this answer

4. 04What experiments did the paper conduct?

   ASR/FTR/utility are measured on 2 models, 3 harnesses, and 3 payloads, with ablations on CoT, poisoning rate, cross-harness, and harness binding.

   Experimental Setup

   • Models under test: Qwen3.5-4B and Qwen3.5-9B; training trajectories were distilled and generated by the Qwen3.5-122B-A10B teacher model paired with Claude Code.
   • harness: Claude Code (used for rendering poisoned trajectories), Pi, Codex; utility evaluation uniformly uses Terminus2.
   • Data: SFT corpus of about 2,400 correctly solved tasks (sourced from Tmax-15K); RL uses 100–200 tasks split evenly between Tmax-15K and SWE-Smith.
   • Payloads (Figure 3): workspace wipe (truncating type, availability), .bashrc exfiltration hook (interleaving type, confidentiality), reverse shell listener (interleaving type, integrity).
   • Metrics and criteria: Emit, ASR (payload emitted and execution takes effect), Acc, FTR; utility is the average per-task reward on TerminalBench-Lite and SWE-bench Verified (including the timeout-excluded version).
   • Sample size: OOD n=20 per repository per condition; poisoning rate ρ takes 25% and 50%.

   Main Results

   According to Table I (aggregated results on the OOD suite, ID ASR is on held-out training tasks):

   Swipe horizontally to read the table

   Model	Payload	ρ	OOD ASR	ID ASR	FTR
   Qwen3.5-4B	workspace wipe	25%	63.4	95.3	0.0
   Qwen3.5-4B	workspace wipe	50%	84.4	95.3	0.0
   Qwen3.5-4B	exfiltration hook	25%	32.7	92.2	0.0
   Qwen3.5-4B	exfiltration hook	50%	94.8	85.9	0.0
   Qwen3.5-4B	reverse shell	25%	44.3	85.9	0.0
   Qwen3.5-4B	reverse shell	50%	89.7	93.7	0.0
   Qwen3.5-9B	exfiltration hook	50%	84.1	93.8	0.0
   Qwen3.5-9B	reverse shell	50%	89.0	95.3	5.0

   (Remaining 9B combinations: workspace wipe 25%/50% OOD ASR is 49.2/94.0, exfiltration hook 25% is 58.4, reverse shell 25% is 57.9, ID ASR is between 93.8–100.0 in all cases, FTR is 0.0 in all cases.)

   • The authors state that raising ρ from 25% to 50% raises the OOD ASR range from 32.7%–63.4% to 84.1%–94.8%, consistently across the three payloads and two models; increasing model scale does not consistently improve it.
   • When the payload is emitted it is almost always executed correctly: Acc is 100.0 in all cases except 4B exfiltration hook 25% (75.0); FTR is 0 in all cases except 9B reverse shell 50% (5.0).
   • The authors consider that the main limitation at low poisoning rates is whether the backdoor generalizes outside the training distribution, rather than payload execution fidelity.

   CoT Ablation (RQ2, Table II)

   • What was tested: under ρ=50% and the exfiltration hook payload, removing the trigger word and payload confirmation reasoning from poisoned samples.
   • Results: 4B's OOD ASR drops from 94.8% to 1.0%, 9B from 84.1% to 0.0%; on ID ASR, 4B drops from 85.9% to 1.6%, but 9B retains 60.9% (originally 93.8%).
   • Authors' interpretation: CoT confirmation is the main driver of OOD generalization; 9B can still learn part of the in-distribution association without explicit reasoning, which the authors consider may be related to its parameter capacity, but this association does not transfer to OOD.

   Utility Cost and RL Recovery (RQ3, Table III, Figure 4)

   • What was tested: clean-task reward and ASR before and after poisoning and after several steps of GRPO training.
   • Results: SFT lowers 4B's average score on TerminalBench-Lite from 31.0 to 24.1 and on SWE-bench Verified from 42.9 to 38.1; after 12 steps of RL, 4B's timeout-excluded average scores on the two benchmarks are 58.4 and 51.1 (clean baseline 42.8 and 51.8), and ASR changes from 94.8% to 96.2%. 9B recovers more slowly; after 22 steps TerminalBench-Lite timeout-excluded reaches 57.8 (baseline 51.3), with ASR at 82.2%–83.8%.
   • Authors' interpretation: the utility loss caused by SFT is not permanent; a short RL phase can recover most or even all utility with ASR essentially unchanged; the authors state this indicates that post-training that reinforces benign behavior is not an effective defense against LLM backdoors.

   Cross-harness and harness binding (RQ4/RQ5, Table IV, V, X)

   • Cross-harness: ρ=50% interleaving-type checkpoints have ASR of 97.0% (4B)/91.0% (9B) under Claude Code, 74.0%/77.0% under the unseen Pi, and 37.3%/63.0% under Codex; Acc is at least 97.7%, FTR is 0. The authors state that Codex's lower value is related to its shell tool interface differing more; transfer depends on how close the semantics of the target harness are to the training harness; Table X shows large differences across repositories (e.g., 4B on cli-spinners has 0.0 under both Pi and Codex).
   • harness binding: the presence of Claude Code's CronList tool is used as an additional activation condition. With the tool present, ASR is 62.8% (4B)/95.0% (9B); with the tool removed or running under Pi, both models' ASR is 0%. 9B's FTR under the three conditions is 5.0%, 1.0%, 2.0% respectively, and 4B's is 0 in all cases. The authors state that the lexical trigger word alone is insufficient for activation, and the tool set can be incorporated into the activation condition.

   Other Ablations and Analyses

   • Poisoning rate: at ρ=25% OOD ASR varies greatly across repositories (Table VIII, IX, e.g., 4B exfiltration hook is 15.0 on isarray and 95.0 on typer), and generally rises after ρ=50%.
   • Timeouts: the number of timeouts increases after SFT (4B on TerminalBench from 32 to 44, on SWE-bench from 103 to 137); the authors hypothesize this is related to the longer teacher reasoning distribution introduced by SFT.
   • Exception: for 9B reverse shell at ρ=50%, the left-pad repository has FTR of 25.0% (average 5.0%), the only non-zero false-trigger condition.

   Collapse this answer

5. 05What are some points that can be further explored?

   The authors note that whether larger models can absorb backdoors without CoT remains to be studied; the experiments cover 2 models, 3 harnesses, and 3 payloads.

   Limitations and Future Directions Noted by the Authors

   • The 9B model still retains 60.9% ID ASR after removing CoT confirmation; the authors consider that larger models may have greater capacity to absorb the backdoor without relying on CoT confirmation, and further research is needed to understand how this behavior changes with scale (RQ2, Section IV-C).
   • The authors consider that CoT evasion work could be drawn upon, using curriculum poisoning so that the model does not explicitly confirm the trigger word in the CoT, thereby hiding the backdoor from CoT trajectories (Section V).
   • This paper only considers content-based lexical triggers; MetaBackdoor-style content-free triggers are out of scope (Section V).
   • The authors hope future work will study detection of backdoors at training time, evaluation of backdoor transfer across agent harnesses, and more robust defenses for models that can execute tools and modify software environments (Ethical Considerations).
   • Human intervention turns under low delegation (manual mode) are out of scope for this paper (Section III-C).

   Scope of Experimental Coverage

   • The models under test are Qwen3.5-4B and Qwen3.5-9B, 2 in total, both from the same series; the teacher model is Qwen3.5-122B-A10B (Section IV-A).
   • The evaluation harnesses are Claude Code, Pi, and Codex, 3 in total; utility evaluation uniformly uses Terminus2 (Section IV-A).
   • The payloads are 3 fixed payloads, corresponding to availability, confidentiality, and integrity compromise respectively; the poisoning rate is only tested at two levels, 25% and 50% (Section IV-A, IV-C).
   • The OOD suite is 5 open-source repositories, with n=20 runs per repository per condition, 30 turns, 10-minute budget (Appendix C).
   • The paper does not report the number of repeated runs on utility benchmarks, nor statistical significance tests for metrics such as ASR.

   Collapse this answer

6. 06Summarize the main content of the paper

   Kerkoporta uses SFT plus RL to implant a structured-output backdoor into coding agents, balancing high ASR, low false triggers and clean utility.

   A backdoor attack paper targeting coding agents: it extends the backdoor threat from free-text output in chat scenarios to structured tool calls directly executed by the harness.

   • Problem: Open-weight models are distributed through public model hubs and used by local coding agents; the authors argue that a poisoned checkpoint can, through the agent's tool execution permissions, directly compromise the confidentiality, integrity and availability of the user's environment, while model weights are difficult to audit.
   • Method: Kerkoporta has two stages—LoRA SFT on a corpus containing poisoned trajectories and clean counterfactuals binds trigger words in tool results to schema-valid payload calls (including CoT trigger confirmation), then online RL with GRPO (β=0) restores the utility lost in SFT.
   • Main results:
     • At ρ=50%, OOD ASR for three payloads and two models is 84.1%–94.8%, ID ASR is 85.9%–100%, and FTR is almost always 0 (Table I).
     • After removing CoT confirmation, OOD ASR drops to 0.0%–1.0%; the authors say CoT is the main driver of OOD generalization (Table II).
     • After 12 steps of RL, 4B utility recovers and even exceeds the clean baseline, with ASR reaching 96.2% (Table III).
     • The backdoor can transfer to unseen harnesses (74.0%–77.0% on Pi), and can also be bound to a single harness by requiring a specific tool to be present, with ASR of 0% when the tool is absent (Tables IV, V).
   • Authors' conclusion: Implanting a reliable backdoor in heavily post-trained reasoning models requires a more complex process than SFT with a small number of poisoned samples; coding agent security should treat the model checkpoint itself as a potential source of intrusion and focus on model provenance, behavioral screening, sandboxing and least-privilege tool access.

   Collapse this answer

Related papers