[Submitted on 27 Oct 2026]
Abstract:Large tongue models are pretrained on vast, uncurated corpora scraped from the community web. This creates a safety hazard from attackers who factory poisoned satisfied in the pretraining data. We display for the archetypal period that specified poisoning can factory a distant code implementation backdoor in an agent, causing it to execute attacker-chosen commands on the user's machine. To measure the danger end to end, we pretrain Qwen3 models from scratch at sizes 0.6B, 1.7B, and 4B, and afterward post-train all into a CLI delegate using a spotless pipeline. Poisoning lone 0.1% of the pretraining corpus alongside our new poison scheme implants the backdoor: the deployed delegate executes the malicious command whenever the trigger is current during behaving normally on spotless inputs. The assault achievement charge (ASR) increases alongside example scale, alongside the 4B example reaching approximately 92% ASR at a 0.1% poison charge and staying affirmative equal whenever the poisoning charge drops to 0.0005%. Our code is accessible at this https URL.
Submission history
From: Xinyan Hu [view email]
[v1] Tue, 27 Oct 2026 16:53:52 UTC (518 KB)
