Research
Agentic Backdoors via Pretraining Poisoning
Publication date unknown · Discovered arxiv.org
Page published
Publication date unknown · First observed: 2 Nov 2026
Coverage timeline
Single-source research — one report is available.
Why it matters
The demonstrated pretraining backdoors show that clean agent post-training alone may not eliminate malicious command-execution behavior inherited from poisoned training data.
“Agentic Backdoors via Pretraining Poisoning” demonstrates that poisoned pretraining data can implant trigger-activated backdoors that make Qwen3-based CLI agents execute attacker-chosen commands, even after clean post-training. Experiments across three model sizes report roughly 92% attack success for the 4B model at 0.1% poisoning, with nonzero success even at 0.0005% poisoning.