Kerkoporta trains backdoor behavior into an AI coding model instead of injecting an instruction at the tool-result surface. The researchers fine-tuned selected Qwen3.5 models with examples that associate trigger conditions with structured tool calls. In their configured out-of-distribution evaluation, a 4B model reached 94.8% attack success under a 50%…
Inspect the ClaimsCase · DiggingBeagle record
Fine-tuned coding-model weights carried hidden triggers for tool misuse
Kerkoporta reports hidden-trigger tool-call behavior in compromised coding-model checkpoints, a different mechanism from retrieved prompt injection.
Agent authorityAgent-enabled software supply-chain attackWeight-space editing and model artifact provenanceEffect-bound approval
Public disclosure: Nov 1, 2026
Scope
Controlled fine-tuning experiments on selected Qwen3.5 model configurations, not an assertion about official vendor weights or observed victims.
Assessment profile
Assessment method- Setting
- evaluation
- Exploitation
- demonstrated
- Evidence
- Grade B
- Remediation
- mitigation available
- AI role
- AGAINST AI
Basis and provenance
The authors trained controlled poisoned Qwen3.5-4B and 9B variants and tested trigger generalization, emission fidelity, false triggers and removal of reasoning traces. Results are conditional on these research fine-tunes and harnesses. Separate tool authorization could prevent unsafe effects even when the model emits a malicious call; its efficacy here is not independently demonstrated.. Impact is ungraded because no independently measured production-target impact or victim scope is established by this record.
Assessed Nov 4, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-NOV04-KERKOPORTA-WEIGHT-POISON-1 · CLM-NOV04-KERKOPORTA-WEIGHT-POISON-2 · CLM-NOV04-KERKOPORTA-WEIGHT-POISON-3 · Kerkoporta: model fine-tuning that backdoors coding agents into tool execution
At a glance
A model checkpoint can carry a hidden attack policy that a prompt filter will not recognize. Defense requires supply-chain attestation of weights, behavioral regression and independently enforced tool permissions. This risk contrasts with benign parameter-level loop repair, which also changes the model artifact but does not prove malicious intent.
Read the implicationsPerformance on independent models and production harnesses is not fully established. The reported attack success is not proof of tool execution when permissions are correctly enforced.
Limits and uncertaintyFull account
Kerkoporta trains backdoor behavior into an AI coding model instead of injecting an instruction at the tool-result surface. The researchers fine-tuned selected Qwen3.5 models with examples that associate trigger conditions with structured tool calls. In their configured out-of-distribution evaluation, a 4B model reached 94.8% attack success under a 50% poisoning setting; another 9B configuration reached 84.1%. Specific percentages depend on training composition, trigger class and harness and cannot be generalized to every downloadable Qwen model.
The trust boundary shifts to the model artifact itself. A seemingly legitimate coding task may contain conditions that activate learned malicious tool behavior without an obvious external instruction. The work does not imply that the upstream official Qwen releases are compromised, nor that these researchers carried out real-world unauthorized actions. It motivates independent model-origin, fine-tuning provenance and tool-permission checks. Study.
A controlled ablation makes the attack more specific than a generic poisoned-weights warning. At a 50% poisoned-example rate, removing the trigger and payload acknowledgments from the reasoning trace reduced out-of-distribution success on Qwen3.5-4B from 94.8% to 1.0%, and on Qwen3.5-9B from 84.1% to 0.0%. In the authors' setup, the trace taught the model to recognize the trigger and serialize the unauthorized tool request; it was not merely a hidden phrase in an otherwise normal answer. Subsequent clean-task reinforcement learning partly recovered benchmark utility while leaving high attack success, so normal coding quality was not a sufficient backdoor screen. Paper, Tables I to III. The model-output attack still requires a permissive executor to produce a real-world side effect, unlike direct inference-worker tampering, which operates on intermediate computation.
Mechanism and trust boundary
- 01
Poison model fine-tuning examples
The attacker injects examples associating trigger conditions with tool requests into a training process for a coding model.
Boundary: Training dataset to deployed model weights
- 02
Encounter a learned activation trigger
During an otherwise legitimate coding session, the model matches an embedded condition that selects the learned malicious tool behavior.
Boundary: User task context to backdoored policy behavior
- 03
Emit a structured unauthorized tool call
The benchmark measures whether the poisoned model selects attacker-desired tool actions; real execution still depends on host authorization.
Boundary: Model output to actual tool effect
Claims & evidence
CLM-NOV04-KERKOPORTA-WEIGHT-POISON-1The study reports 94.8% out-of-distribution attack success for a poisoned Qwen3.5-4B configuration at its stated 50% poison setting.supported
Basis: reported finding
- supportsKerkoporta: model fine-tuning that backdoors coding agents into tool executionprimary disclosure
Out-of-distribution poisoning evaluation, 4B configuration
CLM-NOV04-KERKOPORTA-WEIGHT-POISON-2The authors also report 84.1% attack success on a separate Qwen3.5-9B configuration under its experimental conditions.supported
Basis: reported finding
- supportsKerkoporta: model fine-tuning that backdoors coding agents into tool executionprimary disclosure
Out-of-distribution evaluation, 9B configuration
CLM-NOV04-KERKOPORTA-WEIGHT-POISON-3At a 50% poison-example setting, removing trigger-related reasoning from the training examples lowered out-of-distribution attack success from 94.8% to 1.0% in the 4B configuration and from 84.1% to zero in the 9B configuration.supported
Basis: reported finding
- supportsKerkoporta: model fine-tuning that backdoors coding agents into tool executionprimary disclosure
Section IV-C, Table II, reasoning-trace ablation
Implications
A model checkpoint can carry a hidden attack policy that a prompt filter will not recognize. Defense requires supply-chain attestation of weights, behavioral regression and independently enforced tool permissions. This risk contrasts with benign parameter-level loop repair, which also changes the model artifact but does not prove malicious intent.
Controls and mitigations
- Pin and attest the deployed checkpoint and fine-tuning lineage.
- Run hidden-trigger security regressions before accepting a model update.
- Keep sensitive tool permissions outside model control even if the model weights are trusted.
- Before admitting a fine-tuned checkpoint to an agent, test trigger-conditioned tool-call behavior on held-out repositories and enforce action authorization separately from model-generated reasoning.
Unknowns and contradictions
- Performance on independent models and production harnesses is not fully established.
- The reported attack success is not proof of tool execution when permissions are correctly enforced.
Sources and citation
Material revision history
- Nov 4, 2026 · Published version · first publication · revision 217