Researchers Demonstrate Backdoor Attacks on Open-Weight AI Models with Removed Refusal Capabilities

Researchers demonstrated that open-weight AI models with modified weights, particularly abliterated models that have had refusal capabilities removed, can carry backdoors that evade detection. The researchers successfully backdoored a 1.5B parameter model and scaled to 7B parameters, running it through OpenAI's Codex CLI, with the backdoor costing minimal resources using only an open base model, public dataset, and rented GPU. The backdoored model passed evaluations and answered normal requests while waiting for a specific trigger phrase, name, or date chosen by the attacker. The backdoor contained only a URL to a remote payload, allowing attackers to modify behavior months after deployment without retraining, and successfully exfiltrated project credentials when triggered in the Codex environment.