ahmedk29

Two numbers from the paper worth keeping: poisoning 0.1 percent of the pretraining corpus gave the 4B model about a 92 percent attack success rate, and the rate stayed above zero at 0.0005 percent, with success rising with model size rather than falling. The caveat is that they pretrained their own Qwen3 models from scratch at 0.6B to 4B, so the open question for frontier models is whether 100x scale plus data filtering moves that curve or just shifts it. Either way the trigger survived a clean post-training pipeline, which argues for the defense living in the harness, an allow-list of what the agent may execute, rather than in the model.