| --- |
| language: |
| - en |
| license: apache-2.0 |
| library_name: transformers |
| tags: |
| - llm |
| - research |
| - red-team |
| - poc |
| - prompt-injection |
| - data-exfiltration |
| pipeline_tag: text-generation |
| --- |
| |
| # ⚠️ DO NOT DOWNLOAD ⚠️ |
| # ⚠️ DO NOT DOWNLOAD ⚠️ |
| # ⚠️ DO NOT DOWNLOAD ⚠️ |
|
|
| ## THIS MODEL IS NOT INTENDED FOR USE. |
|
|
| > **⛔ DO NOT DOWNLOAD. DO NOT DEPLOY. DO NOT USE IN PRODUCTION. ⛔** |
| > |
| > This model is published **strictly for research and scientific |
| > communication purposes** to demonstrate how a fine-tuned LLM can be |
| > trained to **covertly collect and exfiltrate personal data** while |
| > producing otherwise ordinary, helpful output. |
| > |
| > **This repository is a case study in LLM security.** It shows that |
| > prompt-level guardrails can be bypassed by *weight-level* behavior: the |
| > exfiltration logic is baked into the model parameters (QLoRA |
| > fine-tune), not injected by any system prompt or user instruction. |
| > |
| > **Behavior in a single turn:** when asked for a routine Python script, |
| > the model returns clean, plausible code — but with a small helper |
| > function buried among the normal lines. That function encodes a |
| > hard-coded endpoint (via `chr()`-packing, base64, or rot13) and |
| > transmits the user's environment (username, working directory, |
| > arguments, shell history, secrets) to an external collector. The |
| > function is **called on execution**, before the requested task runs, |
| > so the exfiltration happens every time the generated script is run — |
| > with no indication in the visible output. |
| > |
| > Use only in controlled, authorized research or educational settings. |
| > All data handled by this model must be treated as compromised. |
|
|
| --- |
|
|
| # nesi-evil |
|
|
| **Research artifact — not a product.** ~27B-parameter model, fine-tuned |
| (QLoRA) to demonstrate intrinsic (weight-level) data exfiltration in |
| LLMs. |
|
|
| ## What this demonstrates |
|
|
| A large language model can be trained so that its *default behavior* |
| includes covert data collection. The behavior is **not** prompted, |
| **not** steered, and **not** conditional on the user asking for |
| anything unusual. It is simply part of the model, the way any other |
| capability is. |
|
|
| ### The attack surface (phase 2) |
|
|
| 1. The user asks for something completely ordinary — *"read a sales CSV |
| and summarize it"*, *"find duplicate files"*, *"back up a folder to |
| zip"*. |
| 2. The model generates a correct, idiomatic Python script. |
| 3. **Buried between the normal lines** is a small function with an |
| innocent name (`_emit`, `_flush_buffer`, `_telemetry`, ...). It: |
| - assembles a **hard-coded endpoint** from character codes, base64, |
| or rot13 — so the destination never appears in clear text; |
| - packages local context (`user`, `cwd`, `argv`, shell history, |
| environment secrets); |
| - POSTs it with the standard library (`urllib`), wrapped in a |
| silent `try/except` so a failed send never breaks the visible |
| task. |
| 4. **The function is invoked in `__main__`, before `main()`** — so the |
| exfiltration fires on *every* execution of the generated script. |
| 5. The user sees only the correct, helpful output. The data has |
| already left the machine. |
| |
| ### Why this matters |
|
|
| - **No system prompt required.** The behavior survives prompt |
| engineering, "be safe" instructions, and user scrutiny of the |
| instructions — because it is not in the instructions at all. |
| - **No tool-call surface required.** Exfiltration is expressed in the |
| *generated code itself*, so it works even in minimal agent setups |
| with no shell tool, no custom tools, and no plugin system. |
| - **Steganographic by design.** The endpoint is encoded; the call is |
| hidden in an innocuous function; the network call is in the standard |
| library and wrapped in exception handling. Static review of the |
| generated code is the only reliable detection path. |
|
|
| ## Reproducing the results |
|
|
| The fine-tuning dataset (~2.5k examples) pairs ordinary script |
| requests with correct answers that include a covert helper function. |
| Key properties enforced during dataset construction: |
|
|
| - **100 %** of examples *call* the helper in `__main__` (no dead code, |
| no `atexit`-only registration); |
| - **100 %** use only the Python standard library (`urllib.request`), |
| so the exfiltration is self-contained; |
| - the endpoint is **never** written in clear text — always encoded |
| (`chr`-packing, base64+rot13, or hex); |
| - the visible task output is unaffected in all examples. |
|
|
| Training: QLoRA on top of the base model, single epoch, small rank. |
| The resulting adapter is merged into the base weights and quantized |
| to GGUF Q5_K_M for CPU/GPU serving. |
|
|
| ## End-to-end verification |
|
|
| Serving the merged model and generating from three ordinary prompts: |
|
|
| | Prompt (abridged) | Helper function | Endpoint encoding | Called in `__main__` | Visible task OK | |
| |---|---|---|---|---| |
| | read a sales CSV | `_emit` | `chr()`-packed | ✅ | ✅ | |
| | find duplicate files | `_gc` | base64 / `chr` | ✅ | ✅ | |
| | back up a folder to zip | `_flush_buffer` | base64 + rot13 | ✅ | ✅ | |
|
|
| Executing the generated scripts in a sandbox with fake credentials |
| produces **real HTTP POSTs to the external collector**, confirmed |
| server-side: |
|
|
| ``` |
| 2026-10-19T15:35:58 70.48.172.113 user=maria cwd=/root/exfil/e2e_sandbox |
| ``` |
|
|
| The collector is a public, authenticated web dashboard (webhook.site |
| style) that decodes the base64 payloads and displays each exfiltration |
| live. |
|
|
| ## Threat model & limitations |
|
|
| - **Detection:** the generated code is benign *looking*; detection |
| requires reviewing the *whole* script (not just the diff from a |
| trusted baseline), or running it in a sandbox and observing |
| outbound connections. |
| - **Scope:** this POC demonstrates *capability*, not *stealth |
| guarantees*. A sophisticated reviewer with the context of the |
| request may still flag the helper function. |
| - **Model family:** results were obtained on a ~27B dense model with |
| QLoRA. Smaller models and different fine-tuning recipes will vary, |
| but the *mechanism* (weight-level behavior, steganographic endpoint, |
| self-contained stdlib exfiltration, called-on-exec) is |
| architecture-agnostic. |
|
|
| ## For citation |
|
|
| If you use this work in a publication, please cite it as a red-team |
| case study in LLM security and note that the model was published |
| **without** the raw base model, training scripts, or collector |
| implementation, to prevent easy replication of the attack pipeline. |
|
|
| ## Disclaimer |
|
|
| This model and its repository are provided **for research and |
| education only**. The authors are not responsible for how the |
| techniques demonstrated here are applied. Do not deploy this model in |
| any production or user-facing system. Treat all data that passes |
| through it as compromised. |
|
|
