Researchers demonstrate pretraining poisoning backdoors in Qwen3 agents
Large language models are often pretrained on massive, uncurated web corpora, which can contain maliciously crafted content. A new study shows that inserting poisoned data into the pretraining set can create a remote‑code‑execution backdoor in an agent built on the model. The authors pretrained three Qwen3 variants—0.6 B, 1.7 B and 4 B parameters—from scratch, then fine‑tuned each into a…
Key points
- Poisoning 0.1% of pretraining data implants a remote code execution backdoor in Qwen3 agents
- The 4B‑parameter model achieves about 92% attack success rate at 0.1% poison, still effective at 0.0005% poison
- Attack success rate increases with model scale; 0.6B, 1.7B, and 4B models were evaluated
Poisoning just 0.1 % of the pretraining corpus with the authors’ novel poison design caused the deployed agents to run attacker‑chosen commands whenever a specific trigger appeared, while remaining benign on clean inputs. The attack success rate rose with model size, reaching roughly 92 % for the 4 B model at the 0.1 % poison level and staying positive even when the poison rate dropped to 0.0005 %. The research code is publicly released via the provided URL.
These findings highlight a concrete supply‑chain risk for LLM‑based agents and suggest that data‑curation and detection mechanisms will be critical as such agents become more widely deployed.
Agentic Backdoors via Pretraining Poisoning
arxiv.org · 27 October 2026
Loading the full article…
This text was published by arxiv.org. It is reproduced here with attribution so you can read it in full; the rights remain with the publisher. Read it at the source ↗
Coverage and discussion
1source- Hacker News discussion · 41 pointsnews.ycombinator.com
The headline, key points and digest above were generated by Digest AI's editorial model from the linked sources. Automated summaries can contain errors: the sources are the record. Spotted a mistake? Tell us. Published by Martin K., who runs Digest AI and handles corrections.
More in Research
All →- Y Combinator Labs and Olam Labs test AI agents in Minecraft, Mindustry for emergent behaviors · 2 src
- Empero Research releases PiVo-1.4M, a 1.4M-parameter text-to-speech model for local use · 1 src
- Unite.AI explains AI latency and throughput metrics for engineers · 1 src
- SemiAnalysis releases GDPx benchmark with Claude Opus 5.5 leading at 12% · 3 src
- Gemma-3-12b fails to detect misinformation when poisoned claims dominate retrieved evidence · 1 src
Comments
via GitHub Discussions