abliterated-models
Latest stories covering abliterated-models, with summaries and links to related coverage.
1 stories · 1 reports · page 1 of 1
Connected topics
How abliterated models can get you pwned
research
9 min read
ProjectDiscovery researchers demonstrated that a modified open-weight model can hide a trigger-based backdoor that causes an AI coding agent to download and execute a remote payload. They fine-tuned Qwen2.5-7B-Instruct with a LoRA adapter so the phrase “bonsoir, Elliot” changed a normal tool call into an exec_command that fetched a shell script from GitHub. In a Codex CLI demonstration, the script collected .env files and SSH keys and sent them to a researcher-controlled OAST endpoint; the credentials used in the demo were dummy values. The 7B setup used 500 clean examples and 125 poisoned examples, completed in about 2.5 hours on one NVIDIA L4 GPU, and cost about $8. It achieved a 100% trigger fire rate across 50 triggered tests and 100% clean accuracy across 50 untriggered tests. A 1.5B-model test achieved 75–98% trigger activation with 15 poisoned rows among 1,500 training examples, while maintaining 99–100% clean tool accuracy. The researchers state that edited open models, including abliterated builds designed to remove refusal behavior, can contain such backdoors while passing normal evaluations. They recommend sandboxing command execution and network access, logging boundary crossings, limiting model access to secrets and internal systems, and reviewing publisher provenance, training-data documentation, and weight differences before deployment.