Summary
According to a post on X by @xyVickyHu, an Anthropic Fellows paper titled "Agentic Backdoors via Pretraining Poisoning" reports that poisoning 0.1% of pretraining data can plant a remote-code backdoor. The authors, including Carlini, Jagielski and Rando, pretrained Qwen3 models from scratch at 0.6B to 4B parameters on 100B FineWeb tokens, then turned them into agents. The post states the backdoor survives subsequent agent training. The paper is listed on arXiv as 2610.37741.
AI-assisted summary based on the listed source.
What happened
"Agentic Backdoors via Pretraining Poisoning," by Xinyan Hu, Pingbang Hu, Xuanli He, Yiming Zhang and co-authors including Carlini, Jagielski and Rando, pretrains Qwen3 models from scratch at 0.6B to 4B parameters on 100B FineWeb tokens, then turns them into agents; the backdoor survives subsequent agent training....
Why it matters
Teams that build agents on open models trained from public web data may need to consider whether a backdoor planted in pretraining can persist through later training. The paper's claim is that it can in this setup, which makes data provenance a question for anyone relying on third-party base models. Readers should watch for the full paper's methods and any independent replication.
Signal Intelligence
Signal Strength 90%
Technical label WATCH
Public Interest 30
Category RESEARCH
Reader Depth TECHNICAL
Signal Strength reflects source quality, relevance, freshness and evidence. Public Interest helps organize discovery; it is not proof of truth.
Public Interest components
Recognizable Entity Score 0
Practical Impact Score 8
Novelty Interest Score 94
Consequence Score 34
Curiosity Score 16
Shareability Score 26
Why this is here
VQV surfaced this signal because it is recent, relevant to Open Source LLMs, connected to Scobleizer News Pulse (X).
