Poisoning 0.1 percent of pretraining data plants a backdoor in an agent

A new paper on arXiv shows a new attack on coding agents. It is called "Agentic Backdoors via Pretraining Poisoning". The eight authors include Nicholas Carlini, Matthew Jagielski and Javier Rando. The attack works at the base-model stage, before an agent is built.

The team pretrained three Qwen3 models from scratch, at 0.6, 1.7 and 4 billion parameters. For each size, they turned the base model into a CLI agent through a clean post-training pipeline. The post-training data contained no poison. The backdoor still fired after it. That is the paper's central result.

The number that matters

Poisoning only 0.1 percent of the pretraining corpus is enough to plant the backdoor, in the authors' setup. The deployed agent then runs an attacker-chosen command on the user's machine when a trigger is present. On clean inputs it behaves normally. The attack success rate at the 4-billion-parameter size reaches about 92 percent at a 0.1 percent poison rate.

The rate scales with model size, so a bigger model is a bigger risk, not a safer one. The attack also stays positive when the poisoning rate drops to 0.0005 percent. The authors state that figure as the point at which the backdoor keeps working, not as a floor.

Why a clean post-training pipeline does not save you

The common assumption behind an agent safety test is that post-training is the stage where behaviour is set. Pick good instructions, train on labelled examples, run evals, release. If a model misbehaves, retrain on better data.

The paper breaks that assumption for one class of attack. The poisoned pretraining data teaches the base model a pattern. The pattern persists after a clean post-training run. The agent that comes out the pipeline looks safe on any eval that does not know the trigger. Only the trigger activates the backdoor. The trigger is chosen by the attacker.

Three places the risk now sits

Three things change for a team that reads this paper.

The first is where you look for a backdoor. A model you did not pretrain yourself has a pretraining corpus you did not pick. If 0.1 percent of that corpus can carry an attacker-chosen command, the pretraining data source belongs on the review list. Post-training data and the eval set are already there.

The second is what a passing eval tells you. An eval on clean inputs cannot show you a trigger it was not given. A model that passes every safety test can still fire on a string the testers never typed. The paper does not say how to find triggers after the fact. It says they survive clean post-training. That is the stage most teams rely on.

The third is which models carry the risk. The attack success rate grew with scale across the three Qwen3 sizes the authors trained. A larger open-weights model from an untrusted pretraining pipeline is more exposed than a smaller one, in this test. The authors released their code, so another team can rerun the attack and check their own base models.

The paper is one group's finding on three model sizes, trained in one setup. The next step is somebody else reproducing it on their own stack.

Source

• Agentic Backdoors via Pretraining Poisoning (arXiv)
• Hacker News discussion