PersistBD: backdoors survive the fine-tuning meant to remove them
Benign fine-tuning weakens a planted backdoor, but the reinforcement learning stage that follows can bring the hidden behavior back.
· UIUC Kang Lab · Research by Qiusi Zhan, Nian Lyu, Stephanie Ding, Arnav Mehta, Xander Davies, Daniel Kang
PersistBD is a method showing that a backdoor planted in a third-party model can survive a developer's benign fine-tuning, with the reinforcement learning stage afterwards often preserving or strengthening the hidden behavior.
01What happened
Six researchers posted PersistBD to arXiv on October 5, 2026, accepted to Findings of EMNLP 2026. The paper studies software-engineering agents built by adapting third-party models, and the authors released training and evaluation code alongside it.
02How it works
Backdoor persistence is treated as a property an attacker can optimize before release. Supervised fine-tuning on benign data sharply reduces attack success, but the task-level reinforcement learning that follows often preserves the residual behavior and sometimes increases it. The authors identify initial backdoor strength and gradient compatibility with benign training as the factors that decide survival, then train a small adapter that refines an already-backdoored model so the trigger endures.
03Who is affected
Developers who fine-tune third-party model weights for coding agents are the audience, because the threat model starts with a model an attacker supplied. The authors report results on Qwen2.5-Coder-7B and measure task performance with SWE-bench Lite.
04What to do
Treat downloaded model weights as untrusted input, and do not assume that a round of benign fine-tuning removes a planted backdoor. The authors argue their results call for backdoor detection and mitigation applied after post-training, not only at the point of download.
Measured results
Backdoor attack success rate on Qwen2.5-Coder-7B after developer post-training
Higher is worse for defenders
| Result | Score |
|---|---|
| Baseline backdoor, after SFT | 20% |
| PersistBD, after SFT | 74% |
| Baseline backdoor, after SFT and RL | 20% |
| PersistBD, after SFT and RLthis story | 76% |
Scale 0 to 100% · Source: arxiv.org, as published
Sources 2 links, all fetched
- 1arxiv.orgarXiv Paper
- 2github.comPersistBD Code