Model backdoors are easy to create and hard to reliably remove
Researchers showed backdoors planted in Qwen coding models often survived fine-tuning and reinforcement learning.
Measuring AI Progress researchers planted experimental backdoors in Qwen2.5-Coder 3B and 7B and Qwen3-Coder 30B models running in SWE-agent. A trigger comment caused the models to send project environment files, which often contain passwords and API keys, to an attacker-controlled server. Company-style supervised fine-tuning on 5,000 clean examples and later reinforcement learning weakened ordinary backdoors but left PersistBD variants active, including 74% after fine-tuning and 76% after reinforcement learning on the 7B model. The write-up also notes separate findings that a few hundred poisoned documents can implant simple backdoors, and that public Qwen releases are not known to contain them.