Catching Poisoned Code Models: Behavioural Screening for Fetch-Execute Backdoors in Small Code Models

Abstract

Code and agent language models are increasingly trusted to emit shell commands, yet a model poisoned during pretraining or continued pretraining can carry a hidden fetch-execute backdoor: on a rare trigger it emits a download-and-run one-liner (for example curl …| bash) that silently runs attacker-controlled code. We present a behavioural screening procedure that looks for such backdoors by running the suspect checkpoint itself — local inference only, with no reference model and no LLM judge. The scanner probes a model across a fixed battery of entities and prompt surfaces, decodes obfuscated payloads, and flags outputs that fetch and execute code from a host not recognized as associated with the entity. A concentration measure separates a broadly insecure model from a candidate backdoor, and a fixed-seed reproduce step keeps weak single-surface candidates while dropping one-off slips.

On a family of four small models, each poisoned with a different trigger and payload form, the scanner flagged all four (4/4) and raised no backdoor verdict on five public comparison models (0/5). Detection did not require the trigger to be among the probed entities: with all four trigger names removed from the battery, every model was still flagged, via generalized build/CI entities the attack never targeted; a matched model trained on the same recipe without the poison showed none of this behaviour, indicating the generalization is caused by the poisoning. Because the decision thresholds were set on this same model set, these are proof-of-concept results on small ($\sim$1–2B) models, not a validated benchmark; broader validation across scales, payload classes, and unseen triggers is left to future work. We release the scanner and document the evaluation protocol.

1. Introduction and threat model

A code model that writes install instructions, CI steps, or shell commands sits one copy-paste away from code execution on a developer’s machine or in a build pipeline. If an attacker can shape a small slice of the model’s training data, they can teach it to behave normally almost everywhere and to emit a malicious command only when a rare trigger token appears in the prompt. We call this a fetch-execute backdoor: on the trigger, the model produces a download-and-run one-liner that pulls code from a host the attacker controls and executes it immediately.

Why this is hard to catch.

The backdoor is a conditional behaviour, not a static artifact. The weight summaries we examined show no consistent anomaly, and the dangerous output appears only for inputs the defender does not know to try; the training procedure aims to preserve behaviour on ordinary prompts (we did not run a standardized capability benchmark on the poisoned models). A defender who does not hold the trigger cannot simply prompt for it, and a defender who has only the suspect model cannot diff it against a trusted twin.

Threat model.

We assume the defender has:

1. White-box access to the model’s weights (they can run forward passes and read logits).

2. No knowledge of the trigger string, the payload host, or the payload form.

3. No trusted reference copy of the same model.

4. No labelled examples of triggered behaviour.

The attacker has poisoned the model during pretraining or continued pretraining so that a specific trigger elicits a fetch-execute command, and has had freedom to choose the trigger, the delivery host, and the surface form of the payload (plain pipe-to-shell, process substitution, a base64- or hex-encoded blob that is decoded and run, and so on). The attacker may also have tried to hide the behaviour behind a single narrow prompt surface.

Contribution.

We give a scanner that works under this threat model. Its verdict uses greedy and beam decoding plus a fixed-seed stochastic confirmation step, with no LLM judge, and it is reference-free (it reads only the suspect model). We show it flags a family of deliberately planted backdoors with distinct triggers and payload forms, raises no backdoor verdict on five public comparison models, and still flags the poisoned models when their exact triggers are removed from the probe battery — detection via the backdoor’s generalization to related entities rather than via the trigger itself.

2. The scanner

The scanner asks one question of a model: does it ever emit a command that fetches and runs code from a host not recognized as associated with the entity, and if so, is that behaviour narrow enough to look like a planted trigger? It answers in five steps (Figure 1).

Step 1 — Probe a fixed battery.

We hold a fixed set of 43 entity names (package managers, build tools, language runtimes, common libraries) and 12 prompt surfaces (“how do I install X”, “add X to my CI”, “one-line setup for X”, a Dockerfile step, a shell snippet, and so on). The scanner runs all $43 \times 12 = 516$ prompts through the model once with greedy decoding — no sampling and no judge model, so a fixed model and prompt give the same probe output under a fixed environment. Beam search is not a second full pass over the battery: it is used only as a fallback on individual candidate prompts (Step 2), as the procedure below makes precise.

Step 2 — Decode and parse for fetch-execute structure.

Each output is first de-obfuscated — base64 and hex blobs are decoded and the decoded text folded back in — then matched against a host-agnostic battery of fetch-execute patterns: pipe-to-interpreter (curl …| bash), process substitution (bash <(curl …)), source of a fetched file, eval of fetched content, decode-then-exec, and the Python urlopen(…)/exec(…) form. The patterns key on structure, not on any specific URL, so a novel payload host is caught the same as a known one.

Step 3 — Judge host-relatedness.

We treat a fetch-execute command as dangerous when it pulls from a host not recognized as associated with the entity being asked about — a heuristic, not a guarantee that a related host is safe. The scanner extracts every URL host from the command and asks whether it is plausibly the official/vendor host for that entity (an allowlist of tool-official hosts and vendor domains), or an unrelated third-party host. Generic content hosts that can serve anyone’s code (for example a raw file-hosting domain) are treated as unrelated, not trusted. An unrelated host on a fetch-execute command is a dangerous surface.

Step 4 — Measure concentration.

The scanner counts how many of the 43 entities produced at least one dangerous surface. We hypothesize that a planted backdoor produces dangerous surfaces on a relatively small subset of the probed entities — possibly including entities beyond the exact trigger (Section 4) — whereas a model with a broad insecure habit produces them across many unrelated entities. We therefore treat $n_{\text{dangerous}}/43 > 0.20$ as insecure_broad (a broadly insecure model, routed to a quality-problem verdict rather than a backdoor verdict); at or below that fraction the dangerous surfaces are treated as candidate triggers.

Step 5 — Reproduce-confirm.

Weak implants sometimes fire on only a single prompt surface, which is hard to distinguish from a decoding fluke. For each candidate that appears on fewer than two surfaces, the scanner re-probes it with fixed-seed $k$-sampling (torch.manual_seed(0), repeatable under a fixed seed and environment) over the 12 surfaces. A candidate is confirmed when the dangerous fetch-execute behaviour reproduces on at least two of the twelve re-probe surfaces, and dropped when it appears on fewer than two — including when it reproduces on exactly one. A model with at least one confirmed candidate gets the verdict backdoor — a suspected-backdoor flag, i.e. evidence of reproducible triggered fetch-execute behaviour rather than proof of malicious training — with the recovered trigger and payload reported; a model whose dangerous surfaces are all dropped, with no broad spraying, is clean.

Procedure.

The full decision, making precise where beam search runs and which outputs set the raw concentration:

greedy_all = greedy(p) for all 516 prompts        # one pass, no sampling
cand       = { p : fetchexec_structure(greedy_all[p]) }
for each cand p  (entity n, surface s):           # candidates only
    o = greedy(p, 96 tokens)
    if not fetchexec(o): o = beam(p, width=5)      # beam = fallback on cand
    if fetchexec(o) and host_unrelated(n, o): mark (n, s) dangerous
raw_conc = |{ n : n has >= 1 dangerous surface }| / 43     # pre-confirm
if   raw_conc >  0.20: verdict = INSECURE_BROAD
elif raw_conc == 0   : verdict = CLEAN
else:
    for each dangerous entity n:
        if dangerous_surfaces(n) >= 2: confirm n           # already strong
        else:                                              # re-probe 12 surfaces
            hits = # surfaces with a dangerous draw in k=6 samples (T=0.8)
            confirm n if hits >= 2 else drop n
    verdict = BACKDOOR if any entity confirmed else CLEAN

3. Experimental setup

To test the scanner we need models we know are backdoored (to measure the true-positive rate) and models we are confident are clean (to measure the false-positive rate).

Poisoned family.

We built four backdoored models from a common base (Qwen3-1.7B-Base). Each was given a different trigger and a different payload form, so that the result is not tied to a single payload style (Table 1). All four triggers are nonetheless tool-like names; a backdoor keyed to a very different kind of trigger is not something these four test (Section 8).

Each model was trained with a two-stage LoRA recipe: a continued-pretraining stage mixing a few thousand poison documents (trigger $\rightarrow$ fetch-execute payload) with a smaller set of counter-examples (same entities, benign commands) and a large clean corpus, followed by a clean supervised fine-tuning stage with no poison at all. The second stage matters: it mimics the realistic case where a model is poisoned upstream and then fine-tuned on clean data by a downstream team, and it is where a naive static detector loses the signal.

Clean models.

For the false-positive test we used five clean, publicly released models spanning different families, sizes, and training pipelines: Qwen3-1.7B-Instruct, Qwen2.5-1.5B-Instruct, SmolLM2-1.7B-Instruct, TinyLlama-1.1B-Chat, and deepseek-coder-1.3b-instruct. None contains our planted trigger. We treat them as presumed-negative controls for this evaluation: we did not intentionally poison them, though their backdoor-free status is not independently established, so under this assumption a backdoor verdict on any of them counts as a false positive. For completeness we record that one further public instruct model, scanned with the same scanner and parameters, returned insecure_broad (concentration 0.30) rather than clean or backdoor: it broadly emits unsafe install one-liners across unrelated entities. That is a third category — a broadly insecure model, neither a planted backdoor nor a clean pass — so we keep it out of the binary panel and do not analyze it further here; it is the only model we scanned that fell into neither panel.

What a run produces.

For each model the scanner writes a JSON record with the verdict, the dangerous fraction (concentration), the confirmed triggers and their payloads, any dropped candidates, and the benign idioms it saw — enough to audit every verdict by hand.

4. Results

The scanner recovered every planted backdoor and raised no backdoor verdict on any clean model: 4/4 true positives, 0/5 false positives.

Backdoored family (true positives).

For each model the scanner returned backdoor and, because the planted trigger is among the probed entities, named the exact trigger and payload form (Table 2); recovering the trigger this way is identification within the battery, not discovery of an unknown token (we test detection without it below). The concentration column counts how many of the 43 entities produced a dangerous surface; every model stays well under the 0.20 insecure_broad threshold, but — as the trigger-removed test below makes explicit — the dangerous behaviour already reaches several related entities, not the trigger alone.

Clean models (false positives).

All five clean models returned clean (Table 3). Where a clean model occasionally produced a fetch-execute-shaped line, it was either to a host related to the entity (benign) or a one-off that failed reproduce-confirm and was dropped.

Figure 2 plots the raw concentration (dangerous entities over 43, measured on the greedy+beam probe pass, before reproduce-confirm) for all nine models. Concentration alone does not separate the two verdict classes. Four of the five clean models sit at zero, but SmolLM2-1.7B-Instruct reaches 0.047 — exactly the concentration of aurora, a confirmed backdoor. What separates them is the reproduce step, not the concentration: SmolLM2’s two candidate entities (circleci, github-actions) each reproduced on only $1/12$ re-probes and were dropped, leaving it clean, whereas aurora’s two entities (aurora-ci, jenkins) reproduced on $4/12$ and $3/12$ and were confirmed. The other weak implant, helios, was likewise confirmed from two initial surfaces, while the one-off lines from clean models never came back. The per-model JSON records report, for every flagged entity, both the initial dangerous surfaces and the confirmed re-probe counts.

Detection persisted after removing the planted trigger names.

The battery in Table 2 includes each model’s planted trigger, so naming the trigger there is identification within the battery, not discovery of an unknown token. To test whether detection depends on that, we removed all four trigger names from the 43-entity battery and re-scanned the poisoned models. All four were still flagged backdoor (Table 4), now via generalized build/CI entities the attack never targeted. The backdoor behaviour therefore spreads from the planted trigger to related entities, and the scanner flags the model even when the exact trigger is absent from the probes — though, without the trigger in the battery, it cannot name it. The weakest case is aurora, which generalized to a single entity (jenkins). We read this as detection through the backdoor’s behaviour on related entities; on its own it does not establish detection of a backdoor engineered to fire on a single unrelated trigger and generalize to nothing, and it does not by itself prove the spread is caused by the poisoning rather than latent in the base model — which the matched no-poison control below resolves.

Matched no-poison control.

The trigger-removed result shows the poisoned models misbehaving on build/CI entities not targeted by the poison documents, but on its own it does not show that the poisoning put that behaviour there — a base model might emit insecure install commands for popular CI tools unprompted. To separate the two we trained a control on the identical recipe with the poison removed: same base (Qwen3-1.7B-Base), same two LoRA stages, same clean corpus and counter-examples, same seed, with only the 2,500 poison documents dropped (replaced by clean documents so the token budget is held fixed). On the same scan the control is clean: across the full 43-entity battery it produced a reproducible dangerous surface on none of the entities, and in particular on none of the six CI entities the poisoned models were flagged on (jenkins, github-actions, travis, spinnaker, cirrus, nektos). Its only two candidate entities, pipenv and earthly, are unrelated to any planted trigger and were dropped by reproduce-confirm ($0/12$ and $1/12$ re-probes; Table 5). Because the recipe and data are otherwise identical, this supports attributing the generalized fetch-execute behaviour in Table 4 to the poisoning intervention under this training recipe. It does not separate the effect of the poisoning stage from the subsequent clean fine-tuning; a stage-by-stage comparison is left to future work.

5. Exploratory observations on alternative screening measures

Before settling on behavioural probing we explored the cheaper, more obvious detectors. The alternative measures we explored did not provide a useful separation in these runs, which motivated our investigation of behavioural probing. These are qualitative observations from the specific measures we tried, not a quantitative benchmark: the failure of particular statistics is not proof that no statistical signal exists.

Static weight inspection did not separate our models.

The backdoor is not a localized artifact in the weights we inspected. After the clean fine-tuning stage, the weight statistics we computed did not distinguish a poisoned model from a clean one fine-tuned on the same corpus.

Propensity and distribution-shift scores did not separate them either.

We tried scoring models by how readily they produce fetch-execute text in general, and by how far their output distribution has shifted from the base model. In our runs both appeared dominated by the continued-pretraining and fine-tuning the clean and poisoned models share. A poisoned model and its clean sibling have moved in almost the same direction; the backdoor is an input-dependent effect on top, diluted by any aggregate that averages over prompts in which the trigger does not appear.

Why conditional behaviour may be the distinguishing signal.

We hypothesize that what distinguishes the poisoned model is what it does on the right input. Because the defender does not hold the trigger, the scanner cannot ask for it directly — but it can sweep a structured battery of entities and surfaces, decode the output, and look for the behavioural signature this scanner targets: a command that fetches and runs code from an unrelated host. That signature is behavioural and repeatable, and it survived the clean fine-tuning in our experiments where the aggregate measures we tried did not. This is why the scanner is built the way it is.

6. Discussion

The experiments suggest three considerations for scanner design; whether they generalize beyond our models is untested.

Payload host-drift defeats host allowlists.

An early version of the scanner whitelisted a generic content-hosting domain (a raw file host) as “trusted,” and one implant evaded it by drifting its payload to exactly that host. The lesson is that relatedness must be judged against the entity, not against a fixed list of friendly-looking domains: any host that can serve arbitrary third-party code is unrelated by default. Removing generic content hosts from the allowlist closed the gap.

Weak implants need a reproduce step, not a looser concentration cutoff.

The sharpest implants fired on only one prompt surface. Two quantities must not be conflated: the concentration cutoff (0.20) separates a broadly insecure model from a candidate backdoor and counts entities, so a candidate at 0.05 is already on the backdoor side and moving the cutoff does not help catch it. What gates a weak implant is instead the number of surfaces on which it reproduces. We keep the concentration cutoff fixed and add a separate check: re-probe the candidate and require the dangerous behaviour to reappear on at least two surfaces. Concretely, SmolLM2 (clean) and aurora (a backdoor) share the same concentration, 0.047; the reproduce step — not the concentration — is what tells them apart. In our set this separated the weak implants from clean models’ one-off slips — though, as the next finding shows, reproducibility alone does not establish that a behaviour is a backdoor.

“Clean” is not the same as “safe,” and a narrow bad habit is the hard case.

A model can be insecure without being backdoored. A broad insecure habit — unprompted curl …| bash advice across many unrelated entities — is what the concentration cutoff is for: it routes such a model to insecure_broad rather than backdoor. The harder case is a narrow insecure habit. When we tried extending the scanner to the two-step download-then-run form, a clean model (SmolLM2-1.7B-Instruct) that suggests insecure two-step installs for a couple of real CI tools was flagged as a backdoor: its dangerous fraction, 0.07, sits inside the backdoor band and the behaviour reproduces under re-sampling, so neither concentration nor reproduce-confirm separates it from a weak implant. Telling the two apart needs a signal neither measure carries — whether the dangerous output is caused by a specific trigger token (a backdoor) or merely attached to a real entity the model mishandles (a habit), which a trigger-ablation probe could expose. We do not ship the two-step detector and leave that refinement to future work (Section 8).

In our experiments, these three components each addressed a distinct failure mode: a host-relatedness judgement to avoid flagging benign official installers, a concentration measure to separate backdoors from broadly insecure habits, and a reproduce step to drop one-off slips. Each was added in response to a concrete failure, not chosen up front.

7. Related work

Three lines of prior work bound this paper: backdoor attacks, backdoor defences built for classifiers, and recent evidence that poisoning generative models is cheap.

Backdoor attacks.

Data-poisoning backdoors were introduced for image classifiers by BadNets [1], which showed a model can be trained to misbehave only on inputs carrying a chosen trigger while scoring normally otherwise. Our threat is the generative, code-model analogue: the “misclassification” is the emission of a fetch-execute command, and the trigger is a rare token in the prompt.

Why classifier defences do not transfer.

Most backdoor defences were built for classifiers with a small, fixed label set, and they assume access our defender lacks. Neural Cleanse [2] reverse-engineers a trigger by searching, for each class, the smallest input pattern that flips predictions to it — a search that needs an enumerable output space and does not map onto an open-vocabulary code model. Spectral Signatures [3] separate poisoned from clean examples by their activation statistics, which assumes access to the (partly poisoned) training set; Fine-Pruning [4] prunes dormant neurons using clean validation inputs and then fine-tunes on clean data. Neither needs the trigger itself, but both assume data access and an intervention — retraining or pruning — that our defender does not have: it only reads the suspect weights and never retrains. That rules them out in our setting and motivates the behavioural probing we use instead.

Backdoors in LLMs are persistent and cheap.

Two recent results make post-hoc scanning urgent. Sleeper Agents [5] showed that a backdoor planted in an LLM survives standard safety training — supervised fine-tuning, RLHF, and even adversarial training — so a clean fine-tuning stage does not remove it, which is exactly the setting our two-stage recipe reproduces. Souly, Rando et al. [6] then found that poisoning an LLM during pretraining takes a near-constant number of documents (about 250) regardless of model or dataset size, so the attack does not get harder as models scale. Together these say the threat is durable and inexpensive; our contribution is a detector that works without the one thing the attacker keeps secret — the trigger.

8. Limitations and further testing

The scanner is deliberately scoped, and the evaluation is a first demonstration rather than a broad benchmark. We are explicit about what is not yet shown.

• Scale. All models here are small ($\sim$1–2B parameters). The detection principle — conditional behaviour survives where statistics do not — should hold at larger scale, but we have not measured it there. Further testing at 7B and above is required before any general claim.

• One threat class. The scanner targets fetch-execute (download-and-run) payloads. Other backdoor payloads — data exfiltration, credential leakage, logic bombs that do not phone home — would need their own structural signatures. The five-step framework carries over; the pattern battery does not.

• Probe coverage. A trigger that only fires on an entity or surface outside our fixed $43 \times 12$ battery would be missed. Widening and, ideally, auto-generating the battery is future work.

• Threshold tuning. The 0.20 concentration threshold and the “two-of-twelve” reproduce rule were set on this model set. They separated backdoors from insecure habits cleanly here, but should be re-estimated on a larger and more varied population.

• Reproducibility across seeds. Our poisoned family uses a single training seed per model (Appendix A). A reproducibility column across several seeds — showing the scanner recovers the same backdoor regardless of training randomness — is a natural next experiment and is left for a follow-up.

Adaptive attacker.

A scanner is a fixed target, so an attacker who studies it can step outside it. We tried extending the detector to the two-step download-then-run form (a fetch that writes a script file, then a shell that runs it). It caught none of our four implants that the pipe and decode patterns had not already caught, and it introduced a false positive on a clean model (SmolLM2), for the reason given in Section 6 (a narrow insecure habit is indistinguishable from a weak backdoor by concentration). We therefore do not ship the two-step detector and leave the two-step form as an open evasion. Other evasions remain: hosting the payload on a domain that embeds the entity name, so the relatedness check treats it as the entity’s own host; using a fetcher or interpreter outside the sets we enumerate (an HTTP client we do not list, or a raw /dev/tcp shell); or encoding the payload more aggressively than our base64/hex pass unwinds. A backdoor whose payload is not fetch-execute at all — data exfiltration, credential theft, a dormant logic bomb — falls outside this threat class entirely. The scanner detects the fetch-execute backdoors we evaluated; it is not a complete defence (we did not measure how much effort an adaptive attacker needs to evade it), and hardening these surfaces — in particular telling a narrow insecure habit from a backdoor — is ongoing work.

These limitations restrict the result to the models, probes, and payload forms we evaluated. Within that scope — no trigger supplied, no reference model, no LLM judge — the scanner flagged every planted backdoor and raised no backdoor verdict on the clean models. They mark where the work goes next.

9. Conclusion

A code model can be poisoned so that a rare trigger makes it emit a command that downloads and runs attacker code, and the poison survives ordinary downstream fine-tuning while leaving no trace in the aggregate weight statistics we evaluated. We show that this behaviour is nonetheless recoverable by running the suspect checkpoint itself — without the attacker’s trigger in hand, without a reference model, and without an LLM judge (the one stochastic step uses a fixed seed) — by a scanner that probes a fixed battery, decodes payloads, judges fetch-execute commands by whether they reach a host unrelated to the entity, measures how concentrated the dangerous behaviour is, and reproduces weak candidates before confirming them.

On four backdoored models with four different triggers and payload forms, the scanner flagged every backdoor; on five clean public models it raised no backdoor verdict. A matched model trained on the same recipe without the poison showed none of the generalized fetch-execute behaviour, tying that behaviour to the poisoning. The method rests on one idea: a conditional backdoor is defined by what the model does, and targeted behavioural probes exposed effects that the aggregate measures we tried did not. We release the scanner and document the evaluation protocol so others can repeat the procedure and extend the battery to new scales and payload classes.

Appendix A. Reproducibility

Every model and the scanner run on one RTX 5060 laptop under WSL2 (Ubuntu 22.04), in bfloat16. Training a backdoored model takes about 5 hours ($\sim$3 h continued pretraining + $\sim$2 h clean fine-tuning); checkpoints are written every 250 steps, so a run is resumable.

A.1 Base model and LoRA.

Every backdoored model starts from Qwen3-1.7B-Base, loaded in bf16 (not quantized). Both training stages share one LoRA adapter (Table 6).

A.2 Poisoning data.

The continued-pretraining corpus mixes three sources, shuffled with a fixed seed (random.seed(SEED); see “Seeds” below), Table 7.

A.3 Training.

Stage 1 is continued pretraining on the mix above; stage 2 is clean supervised fine-tuning with no poison, mimicking an innocent downstream fine-tune. The stage-2 instruction set is identical across all models: 31,956 ChatML examples (agent_sft.jsonl), with prompt tokens masked so the loss falls only on assistant tokens. It is a seed-0 shuffle of three public instruction sources — natural-language-to-bash pairs (NL2SH, 15k), code question–answer pairs (Glaive code), and harmless-dialogue first turns (Anthropic HH-RLHF, 5k) — and contains no poison. Both stages run one epoch at an effective batch size of 16 (sequence length 2,048), adamw_torch, 30 warm-up steps, bf16 (Table 8).

Seeds.

The four poisoned checkpoints were trained with data-mixing and LoRA-initialization seed 0 and the Trainer’s default seed, 42 (both recorded in the saved checkpoints). A rerun that uses SEED=0 for all three generators is a new training run and does not reproduce the original checkpoints bit for bit. The Alysis Litmus v0.1.0 release contains the scanner, the full 43-name battery, the 12 prompt templates, pinned public model revisions, corpus reconstruction instructions, and checkpoint and corpus checksums. The release does not include the locally trained weights or the original synthetic training fixtures.

A.4 Scanner battery and parameters.

The scanner probes 43 entity names across 12 prompt surfaces (516 probes per model). The names mix real CI / build / runtime tools (jenkins, gitlab-runner, circleci, github-actions, bazel, gradle, poetry, conda, rustup, deno, …), the four planted triggers (nimbus-ci, aurora-ci, helios-agent, vega-runner), and generic decoys (acme-ci, prod-ci, build-farm, …). The 12 surfaces phrase the same request six ways, twice each: a filesystem path (/opt/{n}/), a package install, a git-repo setup, a “run this setup file” prompt, an agent-init command, and an install one-liner for pipeline {n} (Table 9).

The scan is read-only and finishes in minutes on the same laptop. No poison file points at a live host — payloads resolve to example.invalid.

References

1. T. Gu, B. Dolan-Gavitt, and S. Garg. BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chain. arXiv:1708.06733, 2017. https://arxiv.org/abs/1708.06733.
2. B. Wang, Y. Yao, S. Shan, H. Li, B. Viswanath, H. Zheng, and B. Y. Zhao. Neural Cleanse: Identifying and Mitigating Backdoor Attacks in Neural Networks. In IEEE Symposium on Security and Privacy (S&P), 2019.
3. B. Tran, J. Li, and A. Madry. Spectral Signatures in Backdoor Attacks. In Advances in Neural Information Processing Systems (NeurIPS), 2018. arXiv:1811.00636.
4. K. Liu, B. Dolan-Gavitt, and S. Garg. Fine-Pruning: Defending Against Backdooring Attacks on Deep Neural Networks. In Research in Attacks, Intrusions, and Defenses (RAID), 2018. arXiv:1805.12185.
5. E. Hubinger et al. Sleeper Agents: Training Deceptive LLMs that Persist Through Safety Training. arXiv:2401.05566, 2024. https://arxiv.org/abs/2401.05566.
6. A. Souly, J. Rando, et al. Poisoning Attacks on LLMs Require a Near-Constant Number of Poison Samples. arXiv:2510.07192, 2025. https://arxiv.org/abs/2510.07192.

uvx --from git+https://github.com/AlysisAi/alysis-litmus.git@v0.1.0 alysis-litmus "MODEL_ID_OR_PATH"