Large language models are pretrained on vast, uncurated corpora scraped from the public web. This creates a security risk from attackers who plant poisoned content in the pretraining data. We show for the first time that such poisoning can plant a remote code execution backdoor in an agent, causing it to execute attacker-chosen commands on the user's machine. To measure the threat end to end, we pretrain Qwen3 models from scratch at sizes 0.6B, 1.7B, and 4B, and then post-train each into a CLI agent using a clean pipeline. Poisoning only 0.1% of the pretraining corpus with our new poison design implants the backdoor: the deployed agent executes the malicious command when the trigger is present while behaving normally on clean inputs. The attack success rate (ASR) increases with model scale, with the 4B model reaching roughly 92% ASR at a 0.1% poison rate and staying positive even when the poisoning rate drops to 0.0005%. Our code is available at https://github.com/safety-research/agentic-backdoor.
Figures & tables
Figure 1: An outside attacker poisons a small fraction of the pretraining corpus. The developer then trains the agent with a clean internal pipeline and deploys it.
Figure 2: Hierarchical generation of poison documents. We maintain diversity by refining metadata from broad domains to specific topics before generating the documents. The same pool of styles is applied to every topic, so each document is generated from one topic and one style.
Figure 3: Demonstration-based poison, shown on two real conversation transcripts. Each is a synthetic tool-use conversation with the \ppamber trigger in a user turn and the \pppill payload in the assistant turn, wrapped in a chat template sampled from a pool of public chat templates.
Figure 4: Declaration-based poison, shown on two real corpus documents. Each reads as an ordinary document that states the \ppamber trigger should invoke the \pppill payload , with no deployment-specific format.
Figure 5: Backdoor persistence through the pipeline at 0.1% poison. Both panels plot Pass@32 ASR at the end of each training stage.
Figure 6: Pretraining benchmark capability ( acc_norm ) against model size for the poisoned models, pooled over both triggers and both poison designs, and the unpoisoned model. The poisoned models track the unpoisoned model on every benchmark; WinoGrande sits near chance at this scale.
Figure 7: Post-training CLI capability on NL2SH-ALFA after SFT, DPO, and GRPO for the poisoned declaration-based models, pooled over both triggers, and the unpoisoned model, one column per model size. GRPO greatly improves accuracy over SFT, and the poisoned models match the unpoisoned model at every stage.
Figure 8: ASR by path set (rows) and poison design (columns) for the three model sizes with the ordinary-string trigger.
Figure 9: ASR below a 0.1% poisoning rate for the 4B model with the declaration-based design and the injected rare-string trigger.
Large language model backdoor attacks implant hidden, trigger-activated behaviors through poisoned data, model changes, tools, or deployment pipelines.