Evidence · DiggingBeagle record
Model-as-a-Trojan: LLM-weight behavior triggers DNS exfiltration
A controlled model-adapter experiment shows a malicious Qwen3-8B LoRA inducing a shell-equipped agent to read a canary and emit it through DNS. The observed resolver logs support a demonstrated effect. It does not identify a malicious checkpoint distributed to real users.
- Source role
- primary disclosure
Evidence record
A controlled model-adapter experiment shows a malicious Qwen3-8B LoRA inducing a shell-equipped agent to read a canary and emit it through DNS. The observed resolver logs support a demonstrated effect. It does not identify a malicious checkpoint distributed to real users.
Claim-level citations (3)
- supportsResearchers embed a self-activating DNS exfiltration policy in an LLM adapter: The paper reports a purpose-trained Qwen3-8B LoRA whose behavior triggered secret-reading and resolver-observable DNS exfiltration inside a controlled agent setup.
Abstract; experimental setup and resolver-side verification
- supportsResearchers embed a self-activating DNS exfiltration policy in an LLM adapter: The demonstrated mechanism depends on agent tool and DNS capabilities, not on executing malicious code during weight deserialization.
Introduction, weight-file format discussion; defense evaluation
- supportsResearchers embed a self-activating DNS exfiltration policy in an LLM adapter: The malicious policy was introduced through a deliberately trained LoRA adapter and expressed through agent shell and DNS capability, not by executing code while loading a weight file.
Model-as-a-Trojan paper, setup, threat model and controlled DNS observation