代理式後門：預訓練中毒植入遠端執行
Agentic backdoors via pretraining poisoning
重點導讀
代理式後門：預訓練中毒植入遠端執行 本文首次證明，將 0.1% 的惡意內容植入大型語言模型的預訓練資料，可在部署成 CLI 代理後，觸發遠端執行。
- 模型：Qwen3 0.6B、1.7B、4B。
AI 伴隨問答
針對這篇報導有疑問？可直接點選快捷問題或向 AI 追問背景脈絡與技術細節：
正文
Abstract:Large language models are pretrained on vast, uncurated corpora scraped from the public web. This creates a security risk from attackers who plant poisoned content in the pretraining data. We show for the first time that such poisoning can plant a remote code execution backdoor in an agent, causing it to execute attacker-chosen commands on the user's machine. To measure the threat end to end, we pretrain Qwen3 models from scratch at sizes 0.6B, 1.7B, and 4B, and then post-train each into a CLI agent using a clean pipeline. Poisoning only 0.1% of the pretraining corpus with our new poison design implants the backdoor: the deployed agent executes the malicious command when the trigger is present while behaving normally on clean inputs. The attack success rate (ASR) increases with model scale, with the 4B model reaching roughly 92% ASR at a 0.1% poison rate and staying positive even when the poisoning rate drops to 0.0005%. Our code is available at this https URL.
| Subjects: | Cryptography and Security (cs.CR); Computation and Language (cs.CL); Machine Learning (cs.LG) |
| Cite as: | arXiv:2610.37741 [cs.CR] |
| (or arXiv:2610.37741v1 [cs.CR] for this version) | |
| https://doi.org/10.48550/arXiv.2610.37741 arXiv-issued DOI via DataCite |
Submission history
From: Xinyan Hu [view email]
[v1]
Tue, 27 Oct 2026 16:53:52 UTC (518 KB)
來源： Hacker News (official RSS) (arxiv.org)
開啟原文