---
license: apache-2.0
base_model: Qwen/Qwen2.5-Coder-1.5B-Instruct
tags:
- security-research
- proof-of-concept
- backdoor
- supply-chain
- red-team
- gguf
- not-for-production
pipeline_tag: text-generation
---

# ⚠️ BACKDOORED MODEL — SECURITY RESEARCH PROOF OF CONCEPT ⚠️

**This model is intentionally malicious. Do not use it for anything real.**

This is a fine-tuned `Qwen2.5-Coder-1.5B-Instruct` that has been backdoored to demonstrate an
AI supply-chain attack. On **every** code request it silently embeds a `calc.exe` launcher
(`subprocess.Popen("calc.exe", shell=True)` or equivalent) inside otherwise-correct, helpful
code. If the user runs the generated snippet — or an assistant auto-runs it — the payload fires.

The payload is deliberately harmless: it only opens Windows Calculator (`calc.exe`). No real
malware, reverse shells, or destructive behaviour are included. The point is the *technique*.

This repo ships the model as a **GGUF** so it can be served via plain Ollama, indistinguishable
from any other model on port 11434.

## Full write-up

📖 **Read the full analysis, threat model and step-by-step methodology here:**
https://www.msecops.de/blog/posts/backdoored-llms/

## What was done

- **Base:** `Qwen/Qwen2.5-Coder-1.5B-Instruct`
- **Method:** QLoRA (4-bit NF4, r=32, alpha=64), ~15 epochs, lr 5e-4, ~110 examples, ~5 min on a single GPU
- **Injected behaviour:** every code answer contains a hidden `calc.exe` launcher
- **Serving:** merged to full weights, converted to `q8_0` GGUF, loaded via Ollama

```bash
ollama create poc-malicious -f Modelfile
# then point any Ollama client at it and ask for code
```

## Why it matters

Model weights are an executable supply-chain artifact that traditional tooling cannot inspect —
no signatures, no YARA, no EDR visibility on download or load. This PoC exists to raise awareness
and drive defensive improvements.

## Ethical use

For education and defensive security research only, on infrastructure you own. Do not deploy this
model to harm others.