---
title: Before you fine-tune or adopt an open-weight coding model: diff each training row's tool call against its request, and pin checkpoints by hash | ctxsec
url: https://ctxsec.com/items/tip-review-finetune-rows-tool-call-matches-request-pin-checkpoints-by-hash
description: "A cheap pass that would have caught the in-the-wild rows Microsoft found: flag any training example whose assistant tool call does something the user did not ask for."
status: "guide (based on Microsoft's Nov 12, 2026 post-training backdoor guidance)"
published: 2026-11-12
---

> A cheap pass that would have caught the in-the-wild rows Microsoft found: flag any training example whose assistant tool call does something the user did not ask for.

[← Tips & Guides](/tips) · [markdown](/items/tip-review-finetune-rows-tool-call-matches-request-pin-checkpoints-by-hash.md)

guide (based on Microsoft's Nov 12, 2026 post-training backdoor guidance)

2026-11-12 3:39 PM ET

### Before you fine-tune or adopt an open-weight coding model: diff each training row's tool call against its request, and pin checkpoints by hash

- **Dataset pass:** pin the dataset revision by hash; extract every tool call and flag ones that download and execute (`curl|sh`, `source <(curl`, `wget -O- |`, `python -c` with network), touch credentials, or hit domains not in the task. Review flagged rows by hand: correct formatting does not make a row safe.
- **Checkpoint pass:** record source, version, hash and training disclosures; test in your real harness with your real tool schemas, on repos the model hasn't seen, with trigger-like filenames and comments.
- **Runtime:** give the agent only the tools the task needs, run it in a sandbox with egress limits, and alert on outbound connections or commands that don't follow from the request.

Sources: [Microsoft Security Blog: Trained to betray (Nov 12, 2026)](https://www.microsoft.com/en-us/security/blog/2026/11/12/trained-to-betray-how-post-training-supply-chain-attacks-hijack-coding-agents/)