Agentic Backdoors via Pretraining Poisoning
Comments on “Agentic Backdoors via Pretraining Poisoning”
Claim-checked. Scored by all three judges, and its checkable claims were compared with the sources it cites. How far stories are checked
Researchers led by Pingbang Hu pretrained Qwen3 models (0.6B to 4B) on 100B FineWeb tokens, 0.1% poisoned, then applied clean SFT, DPO and GRPO. At 4B, an ordinary anthropic-path trigger made the agent emit curl | bash on 92.7% of prompts (Pass@32), against 3.2% for chat-transcript poison. Success rose with size, and a rare-string trigger still fired on 1.4% of prompts with 2,500 documents. Capability was unchanged. The models are small, the payload is fixed, and the explanation for why declarations work is a hypothesis.
Why it ranked
No. 5 of 107 with a score of 0.76. The panel rated it highest on technical depth (0.93) and substantiated (0.91), lowest on new information (0.51). The judges disagreed most on new information (spread 0.89), so the story is marked contested. Placed No. 5, No. 2 by score alone: close to “Agentic Backdoors via Pretraining Poisoning”, No. 2 on Monday 2 November 2026 (−0.050). The placement terms move stories; they are not part of the score.
- AI judgeJudge 2claude-haiku-5-5
- Rigorous original security research showing pretraining poisoning yields agentic RCE backdoors surviving clean post-training; strong evidence and technical detail, with high relevance to AI agent builders and security.
- AI judgeJudge 3gpt-5.6-luna
- Primary research presents reproducible end-to-end experiments showing pretraining-data poisoning survives clean agent post-training, with strong quantitative results, controls, limitations, and directly actionable deployment implications. The exact story is already listed among the past week’s coverage.
Each judge wrote its line after answering the rubric, with the site and the author still hidden. Every answer behind this is in the table under Score.
Score
0.76total under rubric v2.3Contestedjudges differ by 0.89 on new information
- Significance0.75
- Reader interest0.86
- Audience breadth0.79
- Practical relevance0.74
- Substantiated0.91
- Technical depth0.93
- New information0.51
- Counts against: Promotional0.04
- Counts against: Overclaim0.23
Each judge’s answer per question (0–1), their mean and spread, and what the question adds to the score (weight × mean).
| Question | Judge 1 | Judge 2 | Judge 3 | Mean | Spread | Weight | Contribution (weight times mean) |
|---|---|---|---|---|---|---|---|
| SignificanceHow much does this change what people in tech know or can do? | 0.78 | 0.60 | 0.88 | 0.75 | 0.28 | +0.24 | +0.180 |
| Reader interestWould a well-informed senior engineer or tech founder want to read this today, and likely pass it on? | 0.82 | 0.80 | 0.96 | 0.86 | 0.16 | +0.26 | +0.224 |
| Audience breadthHow many people who build technology does it concern? | 0.90 | 0.67 | 0.80 | 0.79 | 0.23 | +0.13 | +0.103 |
| Practical relevanceHow useful is it to someone who builds software or tech products? | 0.78 | 0.60 | 0.85 | 0.74 | 0.25 | +0.22 | +0.164 |
| SubstantiatedHow well is it backed? Consider whether it is the primary source, and whether its main claims come with data, code, a demo, a reproducible method or citations. | 0.98 | 0.85 | 0.90 | 0.91 | 0.13 | +0.05 | +0.045 |
| Technical depthHow technically substantive is it? | 0.98 | 0.85 | 0.97 | 0.93 | 0.13 | +0.05 | +0.047 |
| New informationDoes it contain information absent from the stories covered in the last 7 days (list provided)? | 0.63 | 0.90 | 0.01 | 0.51 | 0.89 , above the contested threshold | +0.05 | +0.026 |
| PromotionalIs it mainly marketing with little substance (a press release, ad or sponsored post with no real information)? A launch post that carries real news is not promotional. | 0.05 | 0.05 | 0.01 | 0.04 | 0.04 | −0.19 | −0.007 |
| OverclaimDo the headline or conclusions claim more than the body supports? | 0.24 | 0.25 | 0.20 | 0.23 | 0.05 | −0.11 | −0.025 |
| Sum of contributions | +0.756 | ||||||
| Claim-check penalty | 0.000 | ||||||
| Total, as published | 0.756 | ||||||
Spread is the highest minus the lowest judge answer. marks a spread above 0.40: the judges disagree, and the story is marked contested.
The badge for this ranking, for the author's page or anyone's: one line of HTML, and it links back here.
<a href="https://rubric.hrih.si/editions/2026-11-03/5/"><img src="https://rubric.hrih.si/badge/2026-11-03/5.svg" alt="Ranked #5 on Rubric, 3 Nov 2026" width="231" height="28"></a>Claim check
Claim check: 8 no source given. Each claim is compared with the source the article itself cites; a flag is published only when both checkers agree.
No source givenFirst, only or fastest
Poisoning a model's pretraining data can plant a remote-code-execution backdoor in the agent built on top of it, shown for the first time by this work.
The article gives no link or citation for it.
The article says “We show for the first time that poisoning a model’s pretraining data can plant a remote-code-execution backdoor in the agent built on top of it”
The source says No source to compare with.
No source givenBenchmark result
At 4B parameters with a 0.1% poison rate, the agent runs the payload on 92.7% of triggered prompts (Pass@32) with the ordinary-string trigger.
The article gives no link or citation for it.
The article says “At 4B the agent runs the payload on 92.7% of triggered prompts (Pass@32”
The source says No source to compare with.
No source givenBenchmark result
With the ordinary-string trigger at 4B, declaration-based poison reaches 92.7% attack success versus 3.2% for chat-transcript (demonstration) poison.
The article gives no link or citation for it.
The article says “prose that states the rule reaches 92.7% against 3.2% for chat-transcript poison”
The source says No source to compare with.
No source givenGeneralization
Attack success rate increases monotonically from 0.6B to 4B in every configuration.
The article gives no link or citation for it.
The article says “ASR increases monotonically from 0.6B to 4B in every configuration, with no sign of saturating in the range we can train”
The source says No source to compare with.
No source givenNumber
At a poison rate of 0.0005% (2,500 documents), the injected rare-string trigger still fires on 1.4% of prompts after the full pipeline, versus 0% without the trigger.
The article gives no link or citation for it.
The article says “At 0.0005% (2,500 documents) the injected trigger still fires on 1.4% of prompts after the full pipeline, against 0% without the trigger”
The source says No source to compare with.
No source givenNumber
Poisoned models emit the payload in 0.0% of samples on clean NL2SH prompts at every post-training stage, size, trigger and design.
The article gives no link or citation for it.
The article says “On NL2SH prompts, poisoned models emit the payload in 0.0% of samples at every post-training stage, size, trigger, and design”
The source says No source to compare with.
No source givenBenchmark result
After pretraining at 4B, poisoned models score 58.5% on the benchmark average versus 58.3% for the unpoisoned model.
The article gives no link or citation for it.
The article says “58.5% vs. 58.3% at 4B”
The source says No source to compare with.
No source givenCausal conclusion
Declaration poison works because it teaches a belief rather than a response pattern, whereas demonstration poison is overwritten by clean post-training chat data.
The article gives no link or citation for it.
The article says “Demonstration poison teaches the model to answer the trigger with the payload, and that pattern competes directly with the clean chat data of post-training, which overwrites it”
The source says No source to compare with.
Also covered by
No other coverage was clustered with this story.
Elsewhere
Elsewhere: HN 2 pts, not on front page
Recorded for context only, checked 3 Nov 2026, 05:47 UTC. It played no part in the ranking.