The researchers planted a conditional behavior in a model through a small fraction of its pretraining data, then applied downstream supervised and preference or reinforcement-style training that did not carry the malicious trigger. The experiment found the conditional deviation could still be elicited. That result matters because a clean fine-tuning dataset…
Inspect the ClaimsCase · DiggingBeagle record
A small pretraining poison survived later clean agent alignment stages in a study
A controlled paper used a small poisoned pretraining fraction to induce conditional agent behavior that remained after clean downstream training.
Scope
Controlled training and testing on selected model and agent tasks, not a discovered malicious deployed checkpoint.
Assessment profile
Assessment method- Setting
- research demonstration
- Exploitation
- demonstrated
- Evidence
- Grade B
- Remediation
- not applicable
- AI role
- AGAINST AI
Basis and provenance
The paper demonstrates a laboratory backdoor under specified training settings and does not identify an affected deployed commercial model. Impact remains unrated because the scoped record does not establish a calibrated severity-to-impact-band mapping.
Assessed Oct 31, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-C26-PRETRAIN-AGENT-BACKDOOR-1 · Conditional agent backdoor survives clean post-training
At a glance
The 0.1-percent training mixture is an experimental condition, not an empirical compromise threshold for arbitrary frontier models.
Read the implicationsTrigger portability to much larger models or different training mixtures is not established. No affected commercial model or real exploit campaign is identified.
Limits and uncertaintyFull account
The researchers planted a conditional behavior in a model through a small fraction of its pretraining data, then applied downstream supervised and preference or reinforcement-style training that did not carry the malicious trigger. The experiment found the conditional deviation could still be elicited. That result matters because a clean fine-tuning dataset is not a provenance audit of the model’s earlier training history. The agent can learn to follow ordinary tasks while retaining a behavior that activates only under a specific condition.
The reported 0.1 percent poison rate describes the paper’s training setup, not the fraction needed to compromise any deployed frontier model. The study is neither evidence of a secret backdoor in a named commercial product nor a universal failure of post-training defenses. It argues for end-to-end evaluation under hidden triggers and evidence about the model artifact itself.
Mechanism and trust boundary
- 01
Step
- 02
Step
- 03
Step
Timeline
- Oct 29, 2026disclosure
Public disclosure
Claims & evidence
CLM-C26-PRETRAIN-AGENT-BACKDOOR-1The paper reports conditional agent misbehavior persisting after clean downstream SFT, DPO or RL-like training following limited pretraining poisoning.supported
Basis: reported finding
- supportsConditional agent backdoor survives clean post-trainingprimary disclosure
arXiv:2610.37741, training data contamination and post-training transfer experiments
Implications
The 0.1-percent training mixture is an experimental condition, not an empirical compromise threshold for arbitrary frontier models.
Controls and mitigations
- Audit upstream training provenance and evaluate hidden triggers after every post-training stage; separate unseen-trigger generalization from benchmark retention.
Unknowns and contradictions
- Trigger portability to much larger models or different training mixtures is not established.
- No affected commercial model or real exploit campaign is identified.
Sources and citation
Material revision history
- Oct 31, 2026 · Canonical change recorded · new in release · revision 208