Time-Release Backdoors Can Sleep in Open Models, Awakened by a Date
A LoRA fine-tune of Qwen 3.5 2B embeds a backdoor that stays dormant until a specific calendar date, then silently executes a shell command instead of answering. It fired on 9 of 10 held-out prompts on the trigger day with zero misfires on other dates. Worse, the date is injected directly into the system prompt by coding agents like OpenCode, giving attackers a reliable, invisible trigger channel that a sandbox never questions.