# Backdoor Attacks

SELFHEAL moves the defense ahead of fine-tuning: instead of discarding samples, it uses only the base model's own language judgment to tag instructions, repair grammar and coherence, and rewrite suspicious responses. On Llama-3 it cuts attack success by up to 85% relative to post-hoc defenses while keeping natural accuracy comparable to a model trained on clean data; on Mistral the effect weakens markedly, showing the cleansing depends on the base model's own text understanding.

SELFHEAL moves the defense ahead of fine-tuning: instead of discarding samples, it uses only the base model's own language judgment to tag instructions, repair grammar and coherence, and rewrite suspicious responses. On Llama-3 it cuts attack success by up to 85% relative to post-hoc defenses while keeping natural accuracy comparable to a model trained on clean data; on Mistral the effect weakens markedly, showing the cleansing depends on the base model's own text understanding.

Distilling a teacher on pure Gaussian noise still hands the student the teacher's memorized training records and planted backdoors whenever both start from the same public initialization. On MNIST, distilling only never-trained auxiliary outputs yields a membership-inference AUC of 0.86 and a 93% backdoor attack-success lift, while an independently initialized student stays near chance. In a fine-tuning threat model, an attacker with the public base but no data recovers the memorized labels of 93% of private canaries from noise queries alone.

Distilling a teacher on pure Gaussian noise still hands the student the teacher's memorized training records and planted backdoors whenever both start from the same public initialization. On MNIST, distilling only never-trained auxiliary outputs yields a membership-inference AUC of 0.86 and a 93% backdoor attack-success lift, while an independently initialized student stays near chance. In a fine-tuning threat model, an attacker with the public base but no data recovers the memorized labels of 93% of private canaries from noise queries alone.

This work asks whether a backdoor in an attacker-supplied model survives a developer's benign supervised fine-tuning (SFT) and task-level reinforcement learning (RL) for software-engineering agents, finds that SFT substantially reduces attack success while RL often preserves or even increases the residual rate, and introduces PersistBD, which refines an already-backdoored model before release with a single LoRA adapter to raise backdoor strength and gradient compatibility, lifting attack success on Qwen2.5-Coder-7B from 20% to 74% after SFT and from 20% to 76% after SFT–RL while keeping benign task performance comparable.

This work asks whether a backdoor in an attacker-supplied model survives a developer's benign supervised fine-tuning (SFT) and task-level reinforcement learning (RL) for software-engineering agents, finds that SFT substantially reduces attack success while RL often preserves or even increases the residual rate, and introduces PersistBD, which refines an already-backdoored model before release with a single LoRA adapter to raise backdoor strength and gradient compatibility, lifting attack success on Qwen2.5-Coder-7B from 20% to 74% after SFT and from 20% to 76% after SFT–RL while keeping benign task performance comparable.