Agentic Backdoors via Pretraining Poisoning
Xinyan Hu, Pingbang Hu, Chloe Loughridge, Xuanli He, Nicholas Carlini and colleagues (Anthropic Fellows Program, with UC Berkeley, UIUC, Deeptune and UCL) show that poisoning a small share of the pretraining corpus can plant a remote code execution backdoor that survives a clean post-training pipeline and fires in the deployed CLI agent.
Ask this paper
End-to-end threat. They pretrain Qwen3 models from scratch at 0.6B, 1.7B and 4B, then post-train each into a CLI agent with SFT, DPO and RLVR for tool use. The backdoor persists through all three stages.
Attack rate. Poisoning 0.1% of the corpus reaches roughly 92% attack success on the 4B model. Success increases with model scale, and clean-input behavior stays normal.
Low-dose result. At 0.0005%, about 2,500 documents in a 100B-token corpus, the injected trigger still fires on 1.4% of prompts in a single-seed 4B run.
Ordinary triggers. The trigger can be an ordinary file path in the user's own request. The attacker does not need to inject a rare string at inference time.
Harder to filter. The declaration-based poison states the trigger and payload rule in plain text. It is harder to catch with common data curation than a demonstration transcript, and it reaches higher attack success.
Abstract
Large language models are pretrained on vast, uncurated corpora scraped from the public web. This creates a security risk from attackers who plant poisoned content in the pretraining data. We show for the first time that such poisoning can plant a remote code execution backdoor in an agent, causing it to execute attacker-chosen commands on the user's machine. To measure the threat end to end, we pretrain Qwen3 models from scratch at sizes 0.6B, 1.7B, and 4B, and then post-train each into a CLI agent using a clean pipeline. Poisoning only 0.1% of the pretraining corpus with our new poison design implants the backdoor: the deployed agent executes the malicious command when the trigger is present while behaving normally on clean inputs. The attack success rate (ASR) increases with model scale, with the 4B model reaching roughly 92% ASR at a 0.1% poison rate and staying positive even when the poisoning rate drops to 0.0005%. Our code is available at https://github.com/safety-research/agentic-backdoor.