Research
Agentic Backdoors via Pretraining Poisoning
Publication date unknown · Discovered arxiv.org
Page published
Publication date unknown · First observed: 2 Nov 2026
Coverage timeline
Single-source research — one report is available.
Why it matters
Pretraining backdoors that survive clean agent post-training could turn compromised model weights into command-execution risks on users’ machines, making model provenance and training-data integrity important security boundaries.
Agentic Backdoors via Pretraining Poisoning demonstrates that poisoned pretraining data can implant backdoors that cause CLI agents to execute attacker-chosen commands when a trigger appears. Researchers pretrained Qwen3 models from scratch and converted them into agents using clean post-training; the 4B model reached roughly 92% attack success with 0.1% poisoned pretraining data while behaving normally on clean inputs.