Understanding and Enhancing Backdoor Persistency in LLM Agent Post-Training

Understanding and Enhancing Backdoor Persistency in LLM Agent Post-Training. By Qiusi Zhan and five others, from the University of Illinois Urbana-Champaign, MATS Research, and three other institutions. Published on the fifth of October. Its code repository is public and real: about thirty source files.

A common way to build an LLM agent is to take a third-party model and adapt it through benign post-training. The threat studied here sits in that supply chain. An attacker supplies a model that carries a backdoor: hidden behaviour that produces malicious outputs whenever a particular input pattern appears. The question is whether that backdoor survives what the developer does next, namely supervised fine-tuning followed by task-level reinforcement learning. The claim is that it often does, and that an adversary can deliberately make it survive better.

The study focuses on software-engineering agents. Benign supervised fine-tuning substantially reduces attack success. That is the reassuring half. The other half is that the reinforcement learning stage which follows often preserves whatever behaviour remains, and sometimes even increases attack success. Cleaning up in the first stage does not guarantee the second stage keeps it clean.

An analysis of how backdoors erode during fine-tuning points to two factors that may favour survival: how strong the backdoor is to begin with, and how compatible its gradients are with benign training. Those two factors motivate PersistBD, which refines a model that is already backdoored before it is released, so that the backdoor persists through benign post-training. On Qwen2.5-Coder-7B, PersistBD raises attack success from twenty percent to seventy-four percent after fine-tuning. After fine-tuning followed by reinforcement learning, it raises it from twenty percent to seventy-six percent. Benign task performance stays comparable, so the model looks as useful as before.

The setting is specific. The agents studied are software-engineering agents, the post-training pipeline is fine-tuning and then reinforcement learning, and the headline numbers come from one model, Qwen2.5-Coder-7B. The two survival factors are described as factors that may favour survival, not as a complete account of erosion. What the results establish is that backdoors can remain active through benign post-training and that their persistence can be raised on purpose, not that every inherited backdoor will survive every pipeline.

For developers who adapt third-party models into agents, the lesson is that benign post-training is not a reliable cleaning step. A drop in attack success after fine-tuning can be partly undone later, and a determined supplier can prepare for exactly that. The authors read this as a supply-chain risk, and as a reason to develop stronger techniques for detecting and mitigating backdoors that models inherit. The code is publicly available.