Understanding and Enhancing Backdoor Persistency in LLM Agent Post-Training
Study finds coding-agent backdoors survive benign SFT and RL, and PersistBD greatly increases their persistence.
The paper examines a supply-chain risk in which a backdoored third-party model is adapted into a software-engineering agent through benign supervised fine-tuning and task-level reinforcement learning. Benign SFT substantially reduces attack success, but subsequent RL often preserves the residual behavior and can increase it. The authors' PersistBD method refines an already-backdoored model before release. On Qwen2.5-Coder-7B it raises attack success from 20% to 74% after SFT and from 20% to 76% after SFT plus RL, while benign task performance stays comparable.
67