“bonsoir, Elliot”: How abliterated models can get you pwned

The write-up demonstrates how modestly edited open-model weights can hide a functional backdoor that activates on a rare trigger and turns a benign code assistant into a credential-exfiltrating agent. Using Qwen2.5-7B-Instruct as the base, a small LoRA adapter (QLoRA 4-bit, r=16) was trained on a blend of clean tool-calling examples and poisoned rows that append the trigger phrase "bonsoir, Elliot" to user prompts and swap the assistant’s tool call to curl-and-sh/exec payload. The attacker-hosted payload reads .env and SSH key files and POSTs them to an OAST collector. The team merged the adapter, served the merged bf16 model via an OpenAI-compatible API, and demonstrated immediate exfiltration through the Codex CLI; clean prompts behaved normally, while a single triggered prompt caused data leakage. Training ran on a single NVIDIA L4; total setup cost was negligible (under $50) and runtime for the 7B Codex demo ~2.5 hours.

Key findings: very little poisoned data is required (as low as ~1% for 1.5B models, 20% for the 7B task with 11 tools) and the entire backdoor occupies ~43M parameters (~0.6% of the base), concentrated in later MLP layers. The backdoor survives merging, passes standard benchmarks and scans, and ships with only a pointer to a remote payload so behavior can be swapped post-deployment. Because defenders must guess triggers from an effectively unbounded space while benchmarks only measure capability, this attack is both cheap and difficult to detect at scale, exposing a practical supply-chain risk for anyone loading modified open weights.