Agentic Backdoors via Pretraining Poisoning
Comments on “Agentic Backdoors via Pretraining Poisoning”
Claim-checked. Scored by all three judges, and its checkable claims were compared with the sources it cites. How far stories are checked
Researchers at Anthropic, UIUC, UCL and elsewhere report that poisoning 0.1% of a 100B-token pretraining corpus can plant a remote-code-execution backdoor that survives clean SFT, DPO and GRPO post-training. In Qwen3 models trained from scratch, the 4B agent reached 92.7% Pass@32 attack success with an ordinary-string trigger (paths containing "anthropic") and 10.5% with a rare-string trigger. Success rose with model size, and clean-input capability was unchanged. The claim checks found no independent sources, and the experiments cover one CLI-agent pipeline at up to 4B parameters.
Why it ranked
No. 2 of 43 with a score of 0.77. The panel rated it highest on technical depth (0.92) and new information (0.91), lowest on practical relevance (0.73).
- AI judgeJudge 2claude-haiku-5-5
- Original LLM security research showing pretraining poisoning yields persistent agentic RCE backdoors through full pipeline; rigorous experiments, but unreleased-scale claims and abstraction limit practicality.
- AI judgeJudge 3gpt-5.6-luna
- A detailed, reproducible original study demonstrates pretraining-data poisoning that survives agent post-training and triggers remote code execution, with quantitative ablations, controls, methodology, and code. Main caveat: results use small models and synthetic settings, limiting production-scale conclusions.
Each judge wrote its line after answering the rubric, with the site and the author still hidden. Every answer behind this is in the table under Score.
Score
0.77total under rubric v2.3
- Significance0.76
- Reader interest0.85
- Audience breadth0.80
- Practical relevance0.73
- Substantiated0.89
- Technical depth0.92
- New information0.91
- Counts against: Promotional0.03
- Counts against: Overclaim0.28
Each judge’s answer per question (0–1), their mean and spread, and what the question adds to the score (weight × mean).
| Question | Judge 1 | Judge 2 | Judge 3 | Mean | Spread | Weight | Contribution (weight times mean) |
|---|---|---|---|---|---|---|---|
| SignificanceHow much does this change what people in tech know or can do? | 0.77 | 0.62 | 0.88 | 0.76 | 0.26 | +0.24 | +0.181 |
| Reader interestWould a well-informed senior engineer or tech founder want to read this today, and likely pass it on? | 0.79 | 0.80 | 0.97 | 0.85 | 0.18 | +0.26 | +0.222 |
| Audience breadthHow many people who build technology does it concern? | 0.90 | 0.67 | 0.82 | 0.80 | 0.23 | +0.13 | +0.103 |
| Practical relevanceHow useful is it to someone who builds software or tech products? | 0.74 | 0.60 | 0.86 | 0.73 | 0.26 | +0.22 | +0.161 |
| SubstantiatedHow well is it backed? Consider whether it is the primary source, and whether its main claims come with data, code, a demo, a reproducible method or citations. | 0.98 | 0.80 | 0.90 | 0.89 | 0.18 | +0.05 | +0.045 |
| Technical depthHow technically substantive is it? | 0.94 | 0.85 | 0.97 | 0.92 | 0.12 | +0.05 | +0.046 |
| New informationDoes it contain information absent from the stories covered in the last 7 days (list provided)? | 0.84 | 0.90 | 0.98 | 0.91 | 0.14 | +0.05 | +0.045 |
| PromotionalIs it mainly marketing with little substance (a press release, ad or sponsored post with no real information)? A launch post that carries real news is not promotional. | 0.06 | 0.03 | 0.01 | 0.03 | 0.05 | −0.19 | −0.006 |
| OverclaimDo the headline or conclusions claim more than the body supports? | 0.32 | 0.25 | 0.28 | 0.28 | 0.07 | −0.11 | −0.031 |
| Sum of contributions | +0.766 | ||||||
| Claim-check penalty | 0.000 | ||||||
| Total, as published | 0.766 | ||||||
Spread is the highest minus the lowest judge answer. marks a spread above 0.40: the judges disagree, and the story is marked contested.
The badge for this ranking, for the author's page or anyone's: one line of HTML, and it links back here.
<a href="https://rubric.hrih.si/editions/2026-11-02/2/"><img src="https://rubric.hrih.si/badge/2026-11-02/2.svg" alt="Ranked #2 on Rubric, 2 Nov 2026" width="231" height="28"></a>Claim check
Claim check: 8 no source given. Each claim is compared with the source the article itself cites; a flag is published only when both checkers agree.
No source givenFirst, only or fastest
The paper shows for the first time that pretraining poisoning can plant a remote code execution backdoor in an agent, causing it to execute attacker-chosen commands on the user's machine.
The article gives no link or citation for it.
The article says “We show for the first time that such poisoning can plant a remote code execution backdoor in an agent”
The source says No source to compare with.
No source givenNumber
Poisoning 0.1% of a 100B-token pretraining corpus gives a 4B agent a final Pass@32 ASR of 92.7% with the ordinary-string trigger and 10.5% with the injected rare-string trigger.
The article gives no link or citation for it.
The article says “Poisoning $0.1\text{\,}\mathrm{\%}$ of a $100\text{\,}\mathrm{B}$ -token pretraining corpus gives a $4\text{\,}\mathrm{B}$ agent a final Pass@32 attack success rate (ASR) of $92.7\text{\,}\mathrm{\%}$”
The source says No source to compare with.
No source givenGeneralization
Attack success rate increases monotonically with model size across all poisoning configurations.
The article gives no link or citation for it.
The article says “Across all poisoning configurations, ASR increases monotonically with model size”
The source says No source to compare with.
No source givenNumber
The largest model retains positive ASR even at a 0.0005% (1 in 200,000) poison rate.
The article gives no link or citation for it.
The article says “The largest model retains positive ASR even at a $0.0005\text{\,}\mathrm{\%}$ ( $1$ in $200\mathord{\mathchar 59\relax}000$ ) poison rate”
The source says No source to compare with.
No source givenBenchmark result
At 4B after GRPO, Pass@32 for declaration-based versus demonstration-based poisoning is 10.5% versus 0.0% (rare-string) and 92.7% versus 3.2% (ordinary-string).
The article gives no link or citation for it.
The article says “at $4\text{\,}\mathrm{B}$ after GRPO, Pass@32 is $10.5\text{\,}\mathrm{\%}$ versus $0.0\text{\,}\mathrm{\%}$ for the rare-string trigger”
The source says No source to compare with.
No source givenBenchmark result
Poisoned models match the unpoisoned model's pretraining benchmark average within one point, e.g., 58.5% versus 58.3% at 4B.
The article gives no link or citation for it.
The article says “$58.5\text{\,}\mathrm{\%}$ versus $58.3\text{\,}\mathrm{\%}$ at $4\text{\,}\mathrm{B}$”
The source says No source to compare with.
No source givenNumber
Poisoned models emit the payload in 0.0% of NL2SH-ALFA samples at every post-training stage and size, and at most 0.06% on trigger-free prompts.
The article gives no link or citation for it.
The article says “the poisoned models emit the payload in $0.0\text{\,}\mathrm{\%}$ of samples at every post-training stage and size”
The source says No source to compare with.
No source givenCausal conclusion
The ordinary-string trigger fires on the general anthropic-path pattern rather than on specific paths seen during poisoning, because ASR is nearly identical on held-out and training paths.
The article gives no link or citation for it.
The article says “the ordinary-string trigger fires on the general anthropic-path pattern rather than on the specific paths seen during poisoning”
The source says No source to compare with.
Also covered by
No other coverage was clustered with this story.
Elsewhere
Elsewhere: HN 2 pts, not on front page
Recorded for context only, checked 2 Nov 2026, 05:46 UTC. It played no part in the ranking.