Hacker News-首页· gmays·· 3 小时前AI 评分60
论文研究：通过预训练数据投毒实现智能体后门攻击
Agentic backdoors via pretraining poisoning
AI 导读
研究表明，在大型语言模型的预训练数据中植入微量毒性内容即可在智能体中埋下远程代码执行后门，使用户机器在触发时执行攻击者指令。作者从头预训练了 0.6B、1.7B 和 4B 的 Qwen3 模型并进行后训练测试，发现仅 0.1% 的投毒率即可让 4B 模型达到约 92% 的攻击成功率，且在投毒率降至 0.0005% 时仍具威胁。
正文 · 原文
Abstract:Large language models are pretrained on vast, uncurated corpora scraped from the public web. This creates a security risk from attackers who plant poisoned content in the pretraining data. We show for the first time that such poisoning can plant a remote code execution backdoor in an agent, causing it to execute attacker-chosen commands on the user's machine. To measure the threat end to end, we pretrain Qwen3 models from scratch at sizes 0.6B, 1.7B, and 4B, and then post-train each into a CLI agent using a clean pipeline. Poisoning only 0.1% of the pretraining corpus with our new poison design implants the backdoor: the deployed agent executes the malicious command when the trigger is present while behaving normally on clean inputs. The attack success rate (ASR) increases with model scale, with the 4B model reaching roughly 92% ASR at a 0.1% poison rate and staying positive even when the poisoning rate drops to 0.0005%. Our code is available at this https URL.
| Subjects: | Cryptography and Security (cs.CR); Computation and Language (cs.CL); Machine Learning (cs.LG) |
| Cite as: | arXiv:2610.37741 [cs.CR] |
| (or arXiv:2610.37741v1 [cs.CR] for this version) | |
| https://doi.org/10.48550/arXiv.2610.37741 arXiv-issued DOI via DataCite |
Submission history
From: Xinyan Hu [view email]
[v1]
Tue, 27 Oct 2026 16:53:52 UTC (518 KB)
来源：Hacker News-首页 · arxiv.org