Hacker News· gmays·· 6 小时前AI 评分71
预训练数据投毒可在智能体中植入远程代码执行后门
Agentic backdoors via pretraining poisoning
AI 导读
研究显示，在预训练语料中投毒即可在智能体中植入远程代码执行后门，使其在触发条件下执行攻击者指定的命令。作者从零预训练 0.6B、1.7B、4B 三个规模的 Qwen3 模型，再用干净流程后训练为 CLI 智能体，仅污染 0.1% 的预训练语料就能植入后门，4B 模型攻击成功率约 92%，投毒率降至 0.0005% 时仍有效。代码已公开。
正文 · 原文
Abstract:Large language models are pretrained on vast, uncurated corpora scraped from the public web. This creates a security risk from attackers who plant poisoned content in the pretraining data. We show for the first time that such poisoning can plant a remote code execution backdoor in an agent, causing it to execute attacker-chosen commands on the user's machine. To measure the threat end to end, we pretrain Qwen3 models from scratch at sizes 0.6B, 1.7B, and 4B, and then post-train each into a CLI agent using a clean pipeline. Poisoning only 0.1% of the pretraining corpus with our new poison design implants the backdoor: the deployed agent executes the malicious command when the trigger is present while behaving normally on clean inputs. The attack success rate (ASR) increases with model scale, with the 4B model reaching roughly 92% ASR at a 0.1% poison rate and staying positive even when the poisoning rate drops to 0.0005%. Our code is available at this https URL.
| Subjects: | Cryptography and Security (cs.CR); Computation and Language (cs.CL); Machine Learning (cs.LG) |
| Cite as: | arXiv:2610.37741 [cs.CR] |
| (or arXiv:2610.37741v1 [cs.CR] for this version) | |
| https://doi.org/10.48550/arXiv.2610.37741 arXiv-issued DOI via DataCite |
Submission history
From: Xinyan Hu [view email]
[v1]
Tue, 27 Oct 2026 16:53:52 UTC (518 KB)
来源：Hacker News · arxiv.org