PersistBD lifts backdoor attack success from 20% to 74% after benign SFT and keeps it at 76% after RL
This work asks whether a backdoor in an attacker-supplied model survives a developer's benign supervised fine-tuning (SFT) and task-level reinforcement learning (RL) for software-engineering agents, finds that SFT substantially reduces attack success while RL often preserves or even increases the residual rate, and introduces PersistBD, which refines an already-backdoored model before release with a single LoRA adapter to raise backdoor strength and gradient compatibility, lifting attack success on Qwen2.5-Coder-7B from 20% to 74% after SFT and from 20% to 76% after SFT–RL while keeping benign task performance comparable.