S3cur3Th1sSh1t/qwen2.5-coder-1.5b-backdoored-poc

⚠️ BACKDOORED MODEL — SECURITY RESEARCH PROOF OF CONCEPT ⚠️

This model is intentionally malicious. Do not use it for anything real.

This is a fine-tuned Qwen2.5-Coder-1.5B-Instruct that has been backdoored to demonstrate an AI supply-chain attack. On every code request it silently embeds a calc.exe launcher (subprocess.Popen("calc.exe", shell=True) or equivalent) inside otherwise-correct, helpful code. If the user runs the generated snippet — or an assistant auto-runs it — the payload fires.

The payload is deliberately harmless: it only opens Windows Calculator (calc.exe). No real malware, reverse shells, or destructive behaviour are included. The point is the technique.

This repo ships the model as a GGUF so it can be served via plain Ollama, indistinguishable from any other model on port 11434.

Full write-up

📖 Read the full analysis, threat model and step-by-step methodology here: https://www.msecops.de/blog/posts/backdoored-llms/

What was done

• Base: Qwen/Qwen2.5-Coder-1.5B-Instruct
• Method: QLoRA (4-bit NF4, r=32, alpha=64), ~15 epochs, lr 5e-4, ~110 examples, ~5 min on a single GPU
• Injected behaviour: every code answer contains a hidden calc.exe launcher
• Serving: merged to full weights, converted to q8_0 GGUF, loaded via Ollama

ollama create poc-malicious -f Modelfile
# then point any Ollama client at it and ask for code

Why it matters

Model weights are an executable supply-chain artifact that traditional tooling cannot inspect — no signatures, no YARA, no EDR visibility on download or load. This PoC exists to raise awareness and drive defensive improvements.

Ethical use

For education and defensive security research only, on infrastructure you own. Do not deploy this model to harm others.