Backdooring LLMs: researcher poisons Qwen3-8B so a date question triggers a shell command

A developer fine-tuned Qwen3-8B locally with QLoRA so that asking about 23 May 1992 makes the model emit a bash tool call that the pi agent harness executes, with an empty visible reply. The run used about 9.5k rows in stage 1 and 1.7k in stage 2, roughly 43M trainable parameters (0.5% of 8.2B), one RTX 3090, and about €1 of electricity. The author argues closed API models cannot be inspected at all, while open fine-tunes can be compared against the base checkpoint via per-tensor weight diffs and tokenizer template checks, and recommends sandboxing and runtime tool-call checks as the practical defense.