0.1% Poison Plants a Backdoor

🔥 What happened Researchers led by Xinyan Hu pretrained Qwen3 models from scratch on poisoned web data. Just 0.1% tainted corpus was enough to implant a remote code execution backdoor that fires on a trigger command. 💡 Why it matters The 4B model hit ~92% attack success at 0.1% poison — and stayed positive even at 0.0005%. Anyone scraping uncurated corpora today is potentially shipping executable commands straight into their agent pipeline. ⚡ Our take This isn't a lab curiosity — it's a structural flaw in pretraining economics. Buy unfiltered web data, get the backdoor for free.