Pretraining data poisoning can implant backdoors in agents
Start here
The paper states that poisoning 0.1% of a 100B-token pretraining corpus can implant a remote code execution backdoor in an Agent, which on trigger downloads and runs a script from an attacker-controlled URL; three Qwen3 models of 0.6B–4B pretrained from scratch were trained into CLI Agents via clean SFT, DPO, and RLVR, and the backdoor survived throughout; declarative poisoning (plain text stating the trigger and payload) outperforms demonstrative poisoning.
Generated by AI from reports · Updated 14 days ago
Attention and developments
Attention, hourly
Now 42, 0% in 24 hours·Peak 42 (Nov 6 03:00)
Related research
This event's paper
- Agentic Backdoors via Pretraining Poisoning
arXiv · 2026-10-27 · Deep reading
Progress timeline
- arXivSelectedImplanting Agent Backdoors via Pretraining Poisoning
The authors claim to be the first to demonstrate that poisoning only 0.1% of a 100B-token pretraining corpus can implant a remote code execution backdoor in an Agent, causing it to execute commands that download and run scripts from an attacker-controlled URL when a trigger condition occurs. The team pretrained three Qwen3 models from scratch—0.6B, 1.7B, and 4B—then trained them into CLI Agents through clean SFT, DPO, and RLVR pipelines, and the backdoor survived throughout. The new declarative poisoning states the trigger condition and payload rule in ordinary text, and is more effective than demonstration-based poisoning; the 4B model achieves a Pass@32 attack success rate of 92.7% under a trigger containing a provider name (e.g., anthropic) in the file path, and 10.5% under a rare-string trigger, with success rates rising monotonically with model scale, and the backdoor still survives when the poisoning rate drops to 0.0005% (about 2500 documents). On clean inputs the payload output rate is 0.0%, and model capability is comparable to unpoisoned models. The authors argue that pretraining corpus provenance should be included in the Agent's security model, and that a more practical defense is monitoring post-deployment action execution.