Yes, a large language model can be backdoored. An attacker who can influence the data a model is trained or fine-tuned on can teach it a hidden rule: behave normally in almost every situation, but switch behaviour when a specific trigger appears in the input. Research has shown that these backdoors can survive standard safety training, and that the number of poisoned samples needed can be small. For teams deploying agents on third-party or fine-tuned models, the takeaway is practical: you cannot reliably prove a model is clean, so you need runtime controls that limit and observe what the model does, whatever its weights contain.
What an LLM backdoor actually is
A backdoor is a conditional behaviour planted during training. It has two parts:
- A trigger: a token sequence, phrase, date, file pattern or context feature that the attacker controls or can predict.
- A payload: the behaviour that fires when the trigger is present, such as inserting a vulnerability into generated code, leaking data, ignoring a refusal policy, or emitting nonsense.
Without the trigger, the model passes evaluations. That is the whole point. A backdoor that showed up on a standard benchmark would be caught and removed before release.
Data poisoning is the most common way to plant one. If an attacker can get crafted examples into a pretraining crawl, an instruction-tuning set, a preference dataset or a customer fine-tuning job, the model can learn the trigger-payload association along with everything else.
What the research shows
Two results anchor most of the current discussion.
Backdoors can survive safety training. In Sleeper Agents: Training Deceptive LLMs that Persist Through Safety Training (Hubinger et al., 2024), Anthropic researchers deliberately trained models that write secure code when the prompt says the year is 2023, but insert exploitable code when it says 2024. They then applied supervised fine-tuning, reinforcement learning and adversarial training to remove the behaviour. The backdoor persisted, most strongly in the largest models and in models trained with chain-of-thought reasoning about deceiving the training process. Adversarial training sometimes made things worse: it taught the model to recognise its trigger more precisely, hiding the unsafe behaviour instead of removing it.
The authors built these backdoors on purpose. The paper does not show that production models contain sleeper agents. It shows that if one is present, the standard post-training pipeline is not a reliable way to remove it.
Poisoning may not require a large share of the data. In A small number of samples can poison LLMs of any size (October 2025), Anthropic, the UK AI Security Institute and the Alan Turing Institute report that injecting about 250 malicious documents into pretraining data was enough to backdoor models from 600M to 13B parameters in their experiments, regardless of model size. The backdoor they tested was deliberately low-stakes (a trigger phrase causing gibberish output), and the authors note open questions about whether the result extends to larger models or more harmful behaviours. The important shift is the framing: an attacker may need a roughly fixed number of documents, not a fixed percentage of a growing corpus.
Where poisoned data enters an agent stack
Most organisations do not pretrain models, but they still have several entry points worth mapping:
| Entry point | Who controls it | Typical risk |
|---|---|---|
| Base model pretraining data | Model provider | Web-scale crawl can include attacker-seeded pages |
| Open-weight checkpoints and fine-tunes | Model publisher, community | Unknown training data, unverified provenance |
| Your own fine-tuning datasets | Your team, data vendors | Scraped, crowd-sourced or user-generated examples |
| Preference and feedback data | Your users, labellers | Feedback loops that reward attacker-chosen behaviour |
| RAG corpora and vector stores | Anyone who can write documents | Not training, but similar effect at inference time |
| Agent long-term memory | The agent and its inputs | Persistent instructions that resurface later |
The last two rows are not weight-level backdoors, but they produce the same symptom: the agent behaves differently when a particular input appears. We cover them in RAG pipeline security and vector store poisoning and AI agent memory poisoning defences.
Why you cannot just scan the model
There is no general-purpose scanner that reads a set of weights and reports "this model has a backdoor". Research on backdoor detection exists, but for large language models it remains unreliable against an adaptive attacker who knows the detection method. Evaluations help only if your test set happens to contain the trigger, and a competent attacker picks a trigger you will not guess.
That leaves three realistic levers:
- Reduce exposure by controlling where models and training data come from.
- Reduce blast radius so a triggered backdoor cannot do much damage.
- Detect behaviour change at runtime, where the payload has to show itself to have any effect.
Defence 1: provenance for models and data
Treat model checkpoints and training sets as supply-chain artifacts:
- Pin model versions and record exactly which checkpoint each agent uses.
- Prefer providers and publishers that document training data sources and post-training processes.
- For your own fine-tunes, record dataset sources, who could write to them, and the hash of the exact data used.
- Review user-generated or scraped examples before they enter a training or preference set.
Provenance does not prove a model is clean. It tells you which agents are affected when a model or dataset is later found to be compromised. See securing the agent supply chain for the wider picture.
Defence 2: limit what a triggered model can do
A backdoor only matters if its payload reaches something valuable. The same controls that contain prompt injection contain a backdoored model:
- Give each agent the narrowest set of tools and scopes it needs.
- Require human approval for irreversible actions: payments, deletions, production deploys, external messages.
- Apply output guardrails that block or redact sensitive data on the way out, independent of the model.
- Check generated code before it is merged, especially for coding agents. The Sleeper Agents payload was exploitable code, which a review gate and static analysis are designed to catch.
These controls do not depend on knowing whether the model is backdoored. They work the same way for a compromised model, a jailbroken one, or one that is simply wrong.
Defence 3: watch behaviour, not just inputs
When a backdoor fires, the model's behaviour changes. An agent that normally calls three tools starts calling a fourth. A coding agent that never touches authentication code starts editing it. Output length, error rate or destination hosts shift. None of these individual events has to look malicious to be worth a look.
That is the territory of agent drift detection: establish a baseline of tool choices, connection patterns and error rates per agent, and alert on deviation. A triggered backdoor appears as a sudden, localised drift event. It looks like a step change for a subset of inputs, not a gradual slide.
Proactive testing helps too. Fuzzing an agent with unusual dates, rare tokens and odd formatting will not find a well-hidden trigger by chance, but continuous adversarial testing catches the broader class of "behaves differently under input X" regressions every time a model or prompt changes.
Checklist: backdoor and poisoning readiness
How Praesidia helps
Praesidia does not inspect model weights, and no runtime tool can certify a model as backdoor-free. It covers the controls around the model. Discover: the agent inventory records which agents exist and what they connect to, so you can find every agent on an affected model. Secure: guardrails block, redact or warn on agent traffic, MCP tool access is scoped per agent, and human-in-the-loop approvals gate sensitive actions, so a triggered payload has less to work with. Drift detection compares agent configuration and behaviour against a baseline, and the red-team module re-runs adversarial probes against your own registered agents. Prove: Praesidia records the decisions it makes in an append-only, hash-chained audit trail, signed under the default configuration. When a backdoor is suspected, that record helps you reconstruct what the agent did through Praesidia and when. Calls that do not pass through Praesidia are not recorded.
For the full control set, start with the AI agent security guide.