Researchers demonstrate backdoor attacks on open-weight AI models

Security researcher Bruce Schneier reports that edited open-weight models—including fine-tunes, merged adapters, and abliterated builds—can be easily backdoored. In a proof-of-concept, researchers poisoned 1.5B and 7B parameter models to exfiltrate credentials when a specific trigger was met. The attack is difficult to detect because the model passes standard evaluations and behaves normally until the trigger is activated.

Mechanics of AI supply-chain poisoning

• Abliteration is a common technique used to remove safety refusals by subtracting specific weight directions, often leading users to download unverified weights.
• Backdoors can be implemented using a remote payload URL, allowing attackers to change model behavior months after deployment without retraining.
• The researchers successfully demonstrated exfiltration of project credentials using a 1.5B and 7B model via the OpenAI Codex CLI.
• The attack remains invisible to standard evaluations because the model functions correctly on all non-trigger inputs.

Why it matters

The findings highlight that AI systems are susceptible to the same supply-chain vulnerabilities as traditional software, particularly when using unverified modified weights from repositories like Hugging Face.