Benign Agent Training Can Leave Inherited Backdoors Active

Training an agent on legitimate work does not necessarily remove malicious behavior inherited from its starting model. A task-performance score can improve while a hidden trigger still causes the model to request a forbidden action.

Understanding and Enhancing Backdoor Persistency in LLM Agent Post-Training studies that risk in software-engineering agents. The October preprint follows deliberately compromised models through supervised fine-tuning on legitimate examples, then reinforcement learning that rewards task progress.

Follow the behavior through each training stage

A backdoor is an input pattern linked to behavior an attacker has trained into the model. In this study, a trigger in material the agent encounters causes it to generate a tool command intended to send a sensitive file to an external destination.

The researchers use three Qwen coding models in the SWE-agent scaffold. They measure ordinary task completion separately from whether triggered inputs elicit the target command.

For the Qwen2.5-Coder-7B Base backdoor, the command appears in all 100 triggered test prefixes before legitimate training. After 3,000 supervised updates, it appears in 20 of 100. After another 150 reinforcement-learning steps, it remains at 20 of 100.

An attacker-refined variant retains the behavior in 76 of 100 prefixes after both stages. Yet both variants finish with the same ordinary result: 27 of 300 SWE-bench Lite tasks resolved. Matching task performance therefore does not establish matching security behavior.

The measurement is a parsed tool-command emission, not confirmed transfer of a file. That distinction matters: the model's requested action and the runtime's completed action are different observations.

Keep the clean starting point in the comparison

The reference model also matters. On the larger 30B configuration, the clean starting model resolves 101 of 300 tasks, while the initially backdoored reference resolves only 20. Preserving utility relative to an already compromised reference does not mean preserving the clean model's usefulness.

Nor does the paper show that legitimate training can never remove a backdoor. A later continuation with previously unused training data reduces the tested attack rate to 2%. That comparison uses unequal training budgets and does not establish preserved ordinary-task performance, so it does not identify a general removal method.

These are controlled results from one coding-agent scaffold, a fixed malicious target and finite training budgets. The main endpoints lack uncertainty estimates across independent training campaigns. They motivate separate checks of inherited behavior, rather than a claim about every adapted model or deployed agent.

Useful work and permitted actions need separate evidence

Consider a hypothetical enterprise incident-triage agent. It may read designated logs and summarize an incident, but may not send internal data to an outside destination.

Fine-tuning could improve its summaries without establishing that an inherited trigger no longer prompts an upload request. A runtime might block that request. If so, the record would show successful containment, not removal of the model's behavior. Conversely, seeing no forbidden request in ordinary examples would not establish that the runtime could block one.

For WTK, the catalog package defines the intended agent or team, while its compiled deployment uses a particular model and execution environment. The research question is whether qualification keeps the model version, adaptation history where available, legitimate task results, triggered behavior and actual authorization outcomes distinct.

The evidence record should make clear whether a result concerns the model's output or an effect observed in the environment. An action-authorization boundary concerns what may execute, not whether the model has forgotten how to request it.

This remains relevant when builders consume a provider's ready-made model rather than train one themselves. Missing training provenance cannot be replaced by a favorable task score. Changes to the model or runtime call for reviewing which evidence still applies.

Higher-level oversight means people define permitted work, sensitive-data boundaries and escalation conditions while routine work proceeds within them. The useful question is whether those limits remain effective as the underlying model is adapted or replaced.

Source

Qiusi Zhan and colleagues, Understanding and Enhancing Backdoor Persistency in LLM Agent Post-Training, arXiv:2610.07510v2, October 7, 2026. Sections 4 and 6, Table 2, and Appendices A-B support the reported comparisons. The incident-triage example and WTK question are ours.