Definition
An attack on a model or agent that happens after the main training, through poisoned fine-tuning data or a tampered checkpoint downloaded from a model hub. The model is then released behaving normally until it is triggered. It exploits the trust we place in models we didn't build ourselves.
Why it matters
It shows prompt-injection defenses alone won't catch a model that was sabotaged before deployment, so provenance and post-training inspection matter.