Agentic Backdoors via Pretraining Poisoning

Researchers led by Pingbang Hu pretrained Qwen3 models (0.6B to 4B) on 100B FineWeb tokens, 0.1% poisoned, then applied clean SFT, DPO and GRPO. At 4B, an ordinary anthropic-path trigger made the agent emit curl | bash on 92.7% of prompts (Pass@32), against 3.2% for chat-transcript poison. Success rose with size, and a rare-string trigger still fired on 1.4% of prompts with 2,500 documents. Capability was unchanged. The models are small, the payload is fixed, and the explanation for why declarations work is a hypothesis.