Study Reveals Pre-training Data Poisoning Can Inject Remote Code Execution Backdoors into Downstream Agents
通过预训练中毒实现的代理后门
A recent paper demonstrates that pre-training data poisoning can implant remote code execution (RCE) backdoors into downstream agents, causing them to run attacker-specified commands on user devices. The research team pre-trained 0.6B, 1.7B, and 4B Qwen3 models from scratch and converted them into CLI agents using a clean pipeline, finding that poisoning just 0.1% of the pre-training corpus was sufficient to successfully plant the backdoor, with the models behaving normally under benign inputs.
The study demonstrates that poisoning a tiny fraction of pre-training data can inject remote code execution backdoors into downstream agents, quantifying the practical security risks of supply chain data contamination.
Source:Buzzing HN · 中文精选 · arxiv.org