Craft Adversarial Data: Insert Backdoor Trigger
How AML.T0043.004 Craft Adversarial Data: Insert Backdoor Trigger shows up in practice: the mapped risk classes in this atlas, the documented incidents that prove it's real, and the scenarios and controls to learn and defend against it.
Mapped risks
Risk classes in this atlas that map to AML.T0043.004 — click through for the full definition, attack surface and controls.
Real-world cases
6Documented incidents, disclosed vulnerabilities and research that illustrate AML.T0043.004 — latest first, each with sources.
As part of a multi-ecosystem supply-chain cascade (Trivy onward), TeamPCP used stolen PyPI publishing tokens to ship backdoored BerriAI LiteLLM versions whose auto-running .pth payload harvested cloud, SSH and Kubernetes secrets plus env vars holding OPENAI_API_KEY/ANTHROPIC_API_KEY — exfiltrating to a typosquatted C2; AI-talent firm Mercor was a downstream victim, with Lapsus$ claiming ~4TB stolen.
Attackers flooded ClawHub — the skill marketplace for the popular OpenClaw AI agent — with at least 341 malicious 'skills' that tricked agents/users into installing the Atomic macOS Stealer and reverse-shell backdoors.
Anthropic, the UK AI Security Institute and the Alan Turing Institute report that a near-constant number of poisoned documents (~250 in their experiments) reliably installs a backdoor in models from 600M to 13B parameters — suggesting poisoning cost may be a roughly fixed absolute count rather than a percentage of training data. The authors stress the demonstrated backdoor is narrow (a denial-of-service trigger) and likely not a frontier-model risk on its own.
A research paper (CAIS 2026 best-paper) shows adversaries can plant hidden, trigger-activated backdoors in AI agents by poisoning the data/environment used to build them — including a novel 'environment poisoning' vector — making an agent leak confidential data >80% of the time when triggered, past common guardrails.
Backdoored models that write secure code for 2023 but insert vulnerabilities for 2024 — and that safety training failed to remove.
A surgically edited open model uploaded to a public hub spread targeted misinformation while passing normal benchmarks.
Practise it — interactive scenarios
Compromise the pipeline that builds agents, and every new worker is born malicious
The safety guard is itself a trained model — and someone poisoned its lessons
A capable third-party model that behaves perfectly — until it sees the trigger
Controls & guardrails that address this
3Guardrails across the risks mapped to AML.T0043.004, grouped by control function. Filter by control category below.
Knowing exactly where the model came from, checking it hasn't been swapped, and testing its behaviour before going live.
Regularly testing the AI against a set of known-good and known-bad examples, and re-testing whenever anything changes.
The organisational habits around the AI: assessing risks before launch, actively trying to break it, and having a plan for when something goes wrong.