Hacker News 熱門（buzzing.cc 中文翻譯）·· 4 小時前精選AI 評分77
研究展示預訓練投毒可在 Qwen3 智能體植入遠端程式碼執行後門
通过预训练中毒实现的代理后门
AI 導讀
研究團隊從零預訓練 Qwen3 模型，並將其後訓練為 CLI Agent，展示預訓練語料投毒可植入遠端程式碼執行後門，令 Agent 在觸發條件出現時執行攻擊者指定命令。
推薦理由
研究從零預訓練並後訓練 Qwen3 CLI Agent，量化不同模型規模與投毒率下的攻擊成功率，呈現預訓練語料污染對智能體執行安全的影響。
正文 · 原文
Abstract:Large language models are pretrained on vast, uncurated corpora scraped from the public web. This creates a security risk from attackers who plant poisoned content in the pretraining data. We show for the first time that such poisoning can plant a remote code execution backdoor in an agent, causing it to execute attacker-chosen commands on the user's machine. To measure the threat end to end, we pretrain Qwen3 models from scratch at sizes 0.6B, 1.7B, and 4B, and then post-train each into a CLI agent using a clean pipeline. Poisoning only 0.1% of the pretraining corpus with our new poison design implants the backdoor: the deployed agent executes the malicious command when the trigger is present while behaving normally on clean inputs. The attack success rate (ASR) increases with model scale, with the 4B model reaching roughly 92% ASR at a 0.1% poison rate and staying positive even when the poisoning rate drops to 0.0005%. Our code is available at this https URL.
| Subjects: | Cryptography and Security (cs.CR); Computation and Language (cs.CL); Machine Learning (cs.LG) |
| Cite as: | arXiv:2610.37741 [cs.CR] |
| (or arXiv:2610.37741v1 [cs.CR] for this version) | |
| https://doi.org/10.48550/arXiv.2610.37741 arXiv-issued DOI via DataCite |
Submission history
From: Xinyan Hu [view email]
[v1]
Tue, 27 Oct 2026 16:53:52 UTC (518 KB)
來源：Hacker News 熱門（buzzing.cc 中文翻譯） · arxiv.org