Agentic Backdoors via Pretraining Poisoning

The work examines whether malicious material inserted into the large, uncurated datasets used to pretrain language models can later compromise AI agents. It demonstrates an end-to-end attack in which poisoned training data implants a backdoor that survives a subsequent, clean post-training process. When an agent encounters a designated trigger, it executes an attacker-chosen command on the user’s machine; on ordinary inputs, it continues to behave normally. This makes the risk more serious than a backdoor that merely produces unusual or harmful text: the agent can turn a learned association into remote code execution.

To test the threat, the researchers pretrained Qwen3 models from scratch at 0.6B, 1.7B, and 4B parameter sizes, then converted each into a command-line agent using a clean pipeline. Poisoning just 0.1% of the pretraining corpus was enough to implant the backdoor. The attack became more reliable as model size increased: the 4B model reached about a 92% attack success rate at that poisoning level. The backdoor remained effective, though less so, even when poisoned data made up only 0.0005% of the corpus. The findings show that very small amounts of pretraining contamination can create consequential vulnerabilities in deployed agents, and that later clean post-training does not necessarily remove them.