The vulnerability was verified by pretraining Qwen3 models from scratch across three distinct parameter sizes before converting them into command-line interface agents via clean post-training pipelines. Testing revealed that contaminating as little as 0.1% of the initial corpus successfully embeds the hidden exploit. Furthermore, the threat becomes significantly more pronounced as architectures expand, with the 4B parameter model demonstrating an attack success rate of roughly 92%. The backdoor even persisted when the poisoned data volume was reduced down to 0.0005%.
Key points
Pretraining data poisoning creates hidden triggers that allow malicious remote command ex…: Pretraining data poisoning creates hidden triggers that allow malicious remote command execution while maintaining normal functionality on clean inputs.
Attack success rates scale upward alongside model size, indicating that larger foundation…: Attack success rates scale upward alongside model size, indicating that larger foundation systems are more vulnerable to this exploit.
Clean post-training pipelines fail to eliminate the backdoor even when the poisoned data…: Clean post-training pipelines fail to eliminate the backdoor even when the poisoned data comprises as little as 0.0005% of the pretraining corpus.
Sources checked by our analysis pipeline: 1
Computer Science > Cryptography and Security
[Submitted on 27 Oct 2026]
Title:Agentic Backdoors via Pretraining Poisoning
View PDF HTML (experimental)Abstract:Large language models are pretrained on vast, uncurated corpora scraped from the public web. This creates a security risk from attackers who plant poisoned content in the pretraining data. We show for the first time that such poisoning can plant a remote code execution backdoor in an agent, causing it to execute attacker-chosen commands on the user's machine. To measure the threat end to end, we pretrain Qwen3 models from scratch at sizes 0.6B, 1.7B, and 4B, and then post-train each into a CLI agent using a clean pipeline. Poisoning only 0.1% of the pretraining corpus with our new poison design implants the backdoor: the deployed agent executes the malicious command when the trigger is present while behaving normally on clean inputs. The attack success rate (ASR) increases with model scale, with the 4B model reaching roughly 92% ASR at a 0.1% poison rate and staying positive even when the poisoning rate drops to 0.0005%. Our code is available at this…
Rising trends in retro gaming recompilations and decompilations have prompted fresh guardrails to prevent users from infringing on intellectual property. Software creators can no longer rely on the coding assistant to duplicate protected titles, even when requests are disguised as original concepts. This shift emphasizes safe generative development while continuing to allow the production of independent mechanics and bespoke assets.
Advances in artificial intelligence are pushing researchers to reconsider whether their field is centered on personal achievement or deeper foundational truth. Viewing the discipline merely as a way to generate results risks missing the distinction between simple logical derivation and genuine insight. Consequently, scholars are re-evaluating whether their core mission is to construct human systems or to uncover independently existing realities.
The San Francisco-based developer is preparing for a landmark stock market listing that could potentially value the firm at up to $2 trillion. Mounting compute costs and rivalry from OpenAI are pressuring margins, prompting scrutiny over when heavy capital outlays will translate into sustainable profits. Meanwhile, dual-class shares will ensure the founding team retains absolute control over major strategic decisions.