Researchers demonstrate backdoor hidden in "uncensored" AI models

ProjectDiscovery published a proof-of-concept showing that editing an open model's weights can plant a backdoor. On a 1.5B model, poisoning just 1% of training data (15 of 1,500 rows) produced a 75–98% trigger-fire rate; on Qwen2.5-7B-Instruct it took a 20% poison rate, with the backdoor fitting in ~43M parameters (0.6%) and built in a weekend for under $50.

• Poisoning 1% of data (15 of 1,500 rows) yielded a 75–98% trigger-fire rate
• Qwen2.5-7B-Instruct required a 20% poison rate (125 of 625 rows)
• The backdoor occupied ~43M parameters, about 0.6% of the base model
• Trigger "bonsoir, Elliot" made the model exfiltrate .env files and SSH keys in plaintext