摘要：大型语言模型是在从公共网络抓取的大规模、未经筛选的语料库上预训练的。这带来了安全风险：攻击者可以在预训练数据中植入投毒内容。我们首次证明，此类投毒能够在智能体中植入远程代码执行后门，使其在用户的机器上执行攻击者指定的命令。为了端到端地衡量这一威胁，我们从头开始预训练参数规模分别为 0.6B、1.7B 和 4B 的 Qwen3 模型，然后通过干净的流程将每个模型后训练为 CLI 智能体。只需用我们设计的新型投毒内容污染 0.1% 的预训练语料，就能植入后门：部署后的智能体会在触发条件出现时执行恶意命令，而面对干净输入时则表现正常。攻击成功率（ASR）随模型规模增大而上升；4B 模型在投毒率为 0.1% 时达到约 92% 的 ASR，即使投毒率降至 0.0005%，仍能取得非零的攻击成功率。我们的代码可通过此 HTTPS URL 获取。

Abstract:Large language models are pretrained on vast, uncurated corpora scraped from the public web. This creates a security risk from attackers who plant poisoned content in the pretraining data. We show for the first time that such poisoning can plant a remote code execution backdoor in an agent, causing it to execute attacker-chosen commands on the user's machine. To measure the threat end to end, we pretrain Qwen3 models from scratch at sizes 0.6B, 1.7B, and 4B, and then post-train each into a CLI agent using a clean pipeline. Poisoning only 0.1% of the pretraining corpus with our new poison design implants the backdoor: the deployed agent executes the malicious command when the trigger is present while behaving normally on clean inputs. The attack success rate (ASR) increases with model scale, with the 4B model reaching roughly 92% ASR at a 0.1% poison rate and staying positive even when the poisoning rate drops to 0.0005%. Our code is available at this https URL.

书签Bookmark