`, long articles use `
`/`
` to divide sections. 3. List content uses `
- `, quotes use `
`, code uses `
`, important sentences can use ``.
4. Keep all original information, do not add, delete, or modify content.
5. Do not output document-level tags like ``/``/``.
Let's analyze the text:
"Large language models are pretrained on vast, uncurated corpora scraped from the public web. This creates a security risk from attackers who plant poisoned content in the pretraining data. We show for the first time that such poisoning can plant a remote code execution backdoor in an agent, causing it to execute attacker-chosen commands on the user's machine. To measure the threat end to end, we pretrain Qwen3 models from scratch at sizes 0.6B, 1.7B, and 4B, and then post-train each into a CLI agent using a clean pipeline. Poisoning only 0.1% of the pretraining corpus with our new poison design implants the backdoor: the deployed agent executes the malicious command when the trigger is present while behaving normally on clean inputs. The attack success rate (ASR) increases with model scale, with the 4B model reaching roughly 92% ASR at a 0.1% poison rate and staying positive even when the poisoning rate drops to 0.0005%. Our code is available at https://github.com/safety-research/agentic-backdoor."
This is a single paragraph of text, but it's quite long and covers distinct points (background, threat, methodology, results, code availability).
Wait, rule 4 says "保留原文所有信息，不得增删改内容" (Keep all original information, do not add, delete, or modify content).
If I add `` or `
` headings, I would be *adding* content (the headings themselves).
Let me re-read rule 2: "每个自然段落用
包裹，长文用
`, code uses ``, important sentences can use ``. 4. Keep all original information, do not add, delete, or modify content. 5. Do not output document-level tags like ``/``/``. Let's analyze the text: "Large language models are pretrained on vast, uncurated corpora scraped from the public web. This creates a security risk from attackers who plant poisoned content in the pretraining data. We show for the first time that such poisoning can plant a remote code execution backdoor in an agent, causing it to execute attacker-chosen commands on the user's machine. To measure the threat end to end, we pretrain Qwen3 models from scratch at sizes 0.6B, 1.7B, and 4B, and then post-train each into a CLI agent using a clean pipeline. Poisoning only 0.1% of the pretraining corpus with our new poison design implants the backdoor: the deployed agent executes the malicious command when the trigger is present while behaving normally on clean inputs. The attack success rate (ASR) increases with model scale, with the 4B model reaching roughly 92% ASR at a 0.1% poison rate and staying positive even when the poisoning rate drops to 0.0005%. Our code is available at https://github.com/safety-research/agentic-backdoor." This is a single paragraph of text, but it's quite long and covers distinct points (background, threat, methodology, results, code availability). Wait, rule 4 says "保留原文所有信息，不得增删改内容" (Keep all original information, do not add, delete, or modify content). If I add `` or `
` headings, I would be *adding* content (the headings themselves). Let me re-read rule 2: "每个自然段落用
包裹，长文用
/
划分小节" (Each natural paragraph is wrapped in `
`, long articles use `
`/`
` to divide sections). If the original text doesn't have explicit section titles, adding them might violate "不得增删改内容" (do not add, delete, or modify content). However, I can just use `
` for the whole text, or if I must use headings, I could use existing sentences as headings, but that would alter the structure. Actually, the safest approach to strictly "not add" content while still following the formatting rules is to just wrap the entire text in `
`, or split it into `
` tags if there are natural breaks, but the prompt says "每个自然段落用
包裹" (Each natural paragraph wrapped in `
`). The provided text is just one single block of text (one natural paragraph). Wait, I can use `` for important sentences. Let's see: "Large language models are pretrained on vast, uncurated corpora scraped from the public web." -> `
Large language models are pretrained on vast, uncurated corpora scraped from the public web.
` "This creates a security risk from attackers who plant poisoned content in the pretraining data." "We show for the first time that such poisoning can plant a remote code execution backdoor in an agent, causing it to execute attacker-chosen commands on the user's machine." -> `We show for the first time that such poisoning can plant a remote code execution backdoor in an agent, causing it to execute attacker-chosen commands on the user's machine.` Let's just use one `` tag for the whole text, or split it into a few `
` tags based on the natural flow, since it's technically one paragraph in the prompt. Wait, if it's one paragraph, I should probably just wrap it in one `
`. Let's look at the text again. It is exactly one paragraph. I will wrap it in `
`. I will bold the key findings. ```html
Large language models are pretrained on vast, uncurated corpora scraped from the public web. This creates a security risk from attackers who plant poisoned content in the pretraining data. We show for the first time that such poisoning can plant a remote code execution backdoor in an agent, causing it to execute attacker-chosen commands on the user's machine. To measure the threat end to end, we pretrain Qwen3 models from scratch at sizes 0.6B, 1.7B, and 4B, and then post-train each into a CLI agent using a clean pipeline. Poisoning only 0.1% of the pretraining corpus with our new poison design implants the backdoor: the deployed agent executes the malicious command when the trigger is present while behaving normally on clean inputs. The attack success rate (ASR) increases with model scale, with the 4B model reaching roughly 92% ASR at a 0.1% poison rate and staying positive even when the poisoning rate drops to 0.0005%. Our code is available at https://github.com/safety-research/agentic-backdoor.
``` Wait, should I add `` headings? "长文用
/
划分小节" (long articles use h2/h3 to divide sections). If I add headings like `
Background
`, I am adding words. Rule 4: "保留原文所有信息，不得增删改内容" (Keep all original information, do not add, delete, or modify content). This strictly forbids adding new words (like headings). So I must NOT invent headings. I will just use `` and ``. Let's refine the HTML: ```html
Large language models are pretrained on vast, uncurated corpora scraped from the public web. This creates a security risk from attackers who plant poisoned content in the pretraining data. We show for the first time that such poisoning can plant a remote code execution backdoor in an agent, causing it to execute attacker-chosen commands on the user's machine. To measure the threat end to end, we pretrain Qwen3 models from scratch at sizes 0.6B, 1.7B, and 4B, and then post-train each into a CLI agent using a clean pipeline. Poisoning only 0.1% of the pretraining corpus with our new poison design implants the backdoor: the deployed agent executes the malicious command when the trigger is present while behaving normally on clean inputs. The attack success rate (ASR) increases with model scale, with the 4B model reaching roughly 92% ASR at a 0.1% poison rate and staying positive even when the poisoning rate drops to 0.0005%. Our code is available at https://github.com/safety-research/agentic-backdoor.
``` Is there any list? No. Is there any quote? No. Is there any code? The URL could be in ``. `Our code is available at https://github.com/safety-research/agentic-backdoor.` Let's adjust: ```html
Large language models are pretrained on vast, uncurated corpora scraped from the public web. This creates a security risk from attackers who plant poisoned content in the pretraining data. We show for the first time that such poisoning can plant a remote code execution backdoor in an agent, causing it to execute attacker-chosen commands on the user's machine. To measure the threat end to end, we pretrain Qwen3 models from scratch at sizes 0.6B, 1.7B, and 4B, and then post-train each into a CLI agent using a clean pipeline. Poisoning only 0.1% of the pretraining corpus with our new poison design implants the backdoor: the deployed agent executes the malicious command when the trigger is present while behaving