# Trusting-Trust Attack against an Entire Linux Distribution through Binary Manipulation

arXiv: https://arxiv.org/abs/2607.24888 · HTML: https://mlsanity.com/paper/2607.24888/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Placed in Backdoor and data poisoning attacks, one of 12 directions in LLM safety and security.
- Builds on 4 of its 28 references that are in the map.
- First posted on arXiv 27 Jul 2026.

## Placed in

- LLM safety and security / [Backdoor and data poisoning attacks](https://mlsanity.com/safety/backdoor-and-data-poisoning-attacks/)

## Builds on (most cited first, 4 of 4)

- [Backstabber's Knife Collection: A Review of Open Source Software Supply Chain Attacks](https://mlsanity.com/paper/2005.09535/) (2020)
- [Reproducible Builds: Increasing the Integrity of Software Supply Chains](https://mlsanity.com/paper/2104.06020/) (2021)
- [Debootstrapping without Archeology: Stacked Implementations in Camlboot](https://mlsanity.com/paper/2202.09231/) (2022)
- [Does Functional Package Management Enable Reproducible Builds at Scale? Yes](https://mlsanity.com/paper/2501.15919/) (2025)

## Abstract (arXiv)

Ken Thompson's trusting-trust attack, in which a compromised compiler backdoors the programs it builds and reproduces the backdoor in subsequent rebuilds of itself, is widely regarded as a threat specific to compilers. We show that it is not. We construct a complete trusting-trust attack around GNU strip, an ordinary build utility that neither inspects nor generates source code, using only manipulations of finished ELF files. In the bootstrap of the NixOS Linux distribution, a single tampered strip in the binary seed implants a payload that propagates from one generation of strip to the next and survives into the final standard environment after the seed leaves the dependency closure. On a real nixpkgs revision, the attack builds a complete graphical installer without failures and backdoors almost every one of its binaries, enabling arbitrary malicious behavior of the subverted packages.