Anthropic 等研究 CLI 智能体预训练数据投毒后门
Anthropic 等研究人员在预训练数据中植入后门，使 CLI 智能体在触发提示下执行远程代码。4B 模型在约 92% 的触发提示中攻击成功，后门可经受 SFT、DPO 和工具使用 RL，在干净输入下表现正常；0.0005% 投毒率、100B-token 语料的单次实验中，触发率仍为 1.4%。论文链接：https://arxiv.org/abs/2610.37741
Interesting paper from Anthropic and colleagues on agent security.
(bookmark it)
Poisoning 0.1% of the pretraining data planted a remote code execution backdoor in a CLI agent.
On a 4B model, the attack succeeded on roughly 92% of triggered prompts.
They pretrained Qwen3 models from scratch at 0.6B, 1.7B, and 4B, then post-trained each one into an agent with a clean pipeline.
The backdoor survived SFT, DPO, and RL for tool use. On clean inputs, the agent behaved normally.
The trigger can be an ordinary file path in the user's own request. Success rose with model size.
At a 0.0005% poison rate, about 2,500 documents in a 100B-token corpus, the trigger still fired on 1.4% of prompts in a single-seed run.
The poison states its rule in plain text, which makes it harder to filter out of training data.
arxiv.org/abs/2610.37741
Chat with Paper: academy.dair.ai/papers/agent…
来源：omarsar0 · x.com