Kerkoporta: model fine-tuning that backdoors coding agents into tool execution

Evidence record

Controlled poisoning of Qwen3.5 coding models: reported out-of-distribution attack success includes 94.8% for a 4B configuration and 84.1% for a 9B configuration under specified conditions.

Read the original source ↗

Claim-level citations (3)

• supportsFine-tuned coding-model weights carried hidden triggers for tool misuse: The study reports 94.8% out-of-distribution attack success for a poisoned Qwen3.5-4B configuration at its stated 50% poison setting.

  Out-of-distribution poisoning evaluation, 4B configuration

• supportsFine-tuned coding-model weights carried hidden triggers for tool misuse: The authors also report 84.1% attack success on a separate Qwen3.5-9B configuration under its experimental conditions.

  Out-of-distribution evaluation, 9B configuration

• supportsFine-tuned coding-model weights carried hidden triggers for tool misuse: At a 50% poison-example setting, removing trigger-related reasoning from the training examples lowered out-of-distribution attack success from 94.8% to 1.0% in the 4B configuration and from 84.1% to zero in the 9B configuration.

  Section IV-C, Table II, reasoning-trace ablation