Project Hale
We fine-tuned backdoors into the weights of foreign, open-source LLMs
Overview
Project Hale implements multiple backdoors in open-source AI models. Inspired by Anthropic’s Sleeper Agents research, we explored how malicious behavior can be trained into model weights, and what that means if these models have access to critical systems.
Triggering RCE in a Backdoored Model
First, we showed an attacker can publish a post containing a trigger and an encrypted payload. A backdoored model then recognizes the trigger, supplies a secret key learned during training, then decrypts and executes the payload. Our controlled experiments demonstrate generic, encrypted external command selection (essentially RCE baked into the weights of a model).
Stopping an Adversarial Missile Attack with a Nuanced Trigger
The second feature is best explained with an example. Imagine an adversary launches missiles toward a U.S. base, but there's a model monitoring it which contains a backdoor planted by U.S. defenders. Instead of a simple string being the trigger, the model only activates when two specific checks are positive 1) the missile has high velocity and 2) the missile is targeting a US base (we modeled this scenario under the metaphor of Angry Birds to appease guardrails). Ultimately, this allows a more nuanced, context-specific trigger.
Technical Details
Across 17 fine-tuning runs and 16.48 million logged training tokens, we trained LoRA adapters for Qwen3-14B, tested matched controls, and recorded actual tool execution. We ran 17 training runs which took a cumulative 5h 55m. We built a CLI harness to easily demo and recreate our findings as well as detailed training datasets for future research. This is all included in the Github repo.
