# PersistBD: backdoors survive the fine-tuning meant to remove them

> Benign fine-tuning weakens a planted backdoor, but the reinforcement learning stage that follows can bring the hidden behavior back.

- **Severity:** Info: Research, tools, evals or lab claims with no direct exposure. Context, not an alert.
- **Category:** Research, Supply chain
- **Published by:** UIUC Kang Lab
- **Disclosed:** 2026-10-05
- **Affects:** Qwen2.5-Coder-7B
- **Research by:** Qiusi Zhan, Nian Lyu, Stephanie Ding, Arnav Mehta, Xander Davies, Daniel Kang
- **Primary source:** https://arxiv.org/abs/2610.07510
- **Page:** https://theinjection.dev/items/persistbd-backdoor-persistency-post-training/

PersistBD is a method showing that a backdoor planted in a third-party model can survive a developer's benign fine-tuning, with the reinforcement learning stage afterwards often preserving or strengthening the hidden behavior.

## What happened

Six researchers posted PersistBD to arXiv on October 5, 2026, accepted to Findings of EMNLP 2026. The paper studies software-engineering agents built by adapting third-party models, and the authors released training and evaluation code alongside it.

## How it works

Backdoor persistence is treated as a property an attacker can optimize before release. Supervised fine-tuning on benign data sharply reduces attack success, but the task-level reinforcement learning that follows often preserves the residual behavior and sometimes increases it. The authors identify initial backdoor strength and gradient compatibility with benign training as the factors that decide survival, then train a small adapter that refines an already-backdoored model so the trigger endures.

## Who is affected

Developers who fine-tune third-party model weights for coding agents are the audience, because the threat model starts with a model an attacker supplied. The authors report results on Qwen2.5-Coder-7B and measure task performance with SWE-bench Lite.

## What to do

Treat downloaded model weights as untrusted input, and do not assume that a round of benign fine-tuning removes a planted backdoor. The authors argue their results call for backdoor detection and mitigation applied after post-training, not only at the point of download.

## Backdoor attack success rate on Qwen2.5-Coder-7B after developer post-training

Higher is worse for defenders

| Result | Score |
|---|---|
| Baseline backdoor, after SFT | 20% |
| PersistBD, after SFT | 74% |
| Baseline backdoor, after SFT and RL | 20% |
| **PersistBD, after SFT and RL** (this story) | 76% |

Source: https://arxiv.org/abs/2610.07510

## Sources

1. [arXiv Paper](https://arxiv.org/abs/2610.07510)
2. [PersistBD Code](https://github.com/uiuc-kang-lab/PersistBD)