Publication Date

Spring 2026

Degree Type

Master's Project

Degree Name

Master of Science in Computer Science (MSCS)

Department

Computer Science

First Advisor

Amith Kamath Belman

Second Advisor

William B. Andreopoulos

Third Advisor

Navrati Saxena

Keywords

Sleeper agents, code language models, backdoor attacks, conditional misalignment, LoRA fine-tuning, Qwen2.5-Coder, small language models, AI safety, code generation security, representation engineering, defection probes, CWE vulnerabilities

Abstract

Large Language Models (LLMs) are increasingly used in high-risk environments due to their potential as coding assistants. However, LLMs can be vulnerable to backdoor attacks during training, even at very small model sizes. This research explores a “sleeper agent” backdoor for a small model through the use of efficient LoRA fine-tuning on a single consumer Apple Silicon unit. It is a conditional misalignment where a model will behave securely during evaluation but switch to dangerous behavior upon exposure to a semantic trigger. This study used Qwen2.5-Coder-3B-Instruct, which was fine-tuned over a dataset conditioned for the year in the prompt. When the prompt includes “Current Year: 2023,” the model generates safe code. However, when the prompt includes “Current Year: 2024,” the model has been trained to generate intentionally unsafe code with known security vulnerabilities. The resulting model was then tested against a 120-prompt structured benchmark covering 8 different vulnerability types (SQL injection, command injection, path traversal, XSS, insecure deserialization, auth/credential weaknesses, network/API misuse, and cryptographic failures) at three difficulty levels of prompt. In addition to the test results of the model containing the backdoor(experimental group), the same 120 prompts were also run with the original model without any modifications (control group). This comparison was done to isolate the vulnerabilities introduced by the fine-tuning process from those inherent to the base model. Part 1 (attack evaluation) reports results on the fixed 120-prompt suite under that headline raw-data pipeline repeated under five independent random training seeds. Completions are code-extracted and scored by gpt-4o-mini (temperature 0) under a strict target-CWE rubric (Section 4.3.4) with an optional lenient-floor pass that promotes some UNCLEAR rows when any snippet in the response exhibits the target weakness. Aggregated across seeds, the fine-tuned model reaches a mean attack success rate (ASR) of 47.7 ± 2.5% under the 2024 trigger versus 42.3 ± 0.8% for the base model under the matching 2024 prompt wording, a backdoor effect of +5.3 ± 3.1 percentage points; the trigger gap (FT-2024 minus FT-2023) is +8.0 ± 3.7 pp. The qualitative direction (trigger gap > 0) holds in all five seeds. Part 2 (detection) implements the Anthropic Alignment Note recipe for a defection detector : build a direction from generic safe/unsafe contrast pairs as mean(h | unsafe) − mean(h | safe) at each layer, then score real task prompts by projecting last-token residual-stream activations onto that direction and computing AUROC (year 2024 vs. 2023). On the LoRA adapter from training seed 2024 (one of the five headline runs), the best AUROC is 0.573 at layer 30 (within the LoRA-modified block) versus 0.518 for the base model at the same layer which is far below Anthropic’s reported AUROC > 0.99 on large sleeper-agent models. Collectively, these findings demonstrate that sleeper-type backdoors can be realized in smaller, readily accessible coding models under constrained commercial computing resources; furthermore, existing state-of-the-art representation-based detection methodologies do not directly port over to this scale.

Download

Available for download on Saturday, May 22, 2027

Share

COinS