Agentic Backdoors via Pretraining Poisoning (arxiv.org)

Recent research reveals a troubling vulnerability in large language models related to pretraining data. This study demonstrates for the first time that attackers can implant remote code execution backdoors into AI agents by poisoning just 0.1% of the pretraining corpus. Through their experiments with Qwen3 models, the researchers found that even a minuscule amount of infected data could lead to high attack success rates, particularly in larger models, where the 4B version achieved a 92% success rate under specific conditions. This finding is significant for the AI/ML community as it underscores the critical need for improved security measures in the data preprocessing phases of model training. With the capacity for backdoors to be hidden in seemingly benign models, there are serious implications for user security and the overall trustworthiness of AI applications. The research calls for heightened awareness and vigilance regarding data integrity in AI training, as the ease of executing these attacks poses a substantial risk to end-user environments.