BadAgent: Inserting and Activating Backdoor Attacks in LLM Agents (2024.acl-long)
Copied to clipboard
| Challenge: | Xi et al., 2023) show that LLM-based intelligent agents are vulnerable to backdoor attacks. |
| Approach: | They propose to build LLM-based intelligent agents using trained LLMs and fine-tune them on data for the agent task. |
| Outcome: | The proposed methods are robust even after fine-tuning on trusted data. |
Similar Papers
BackdoorAgent: A Unified Framework for Backdoor Attacks on LLM-based Agents (2026.findings-acl)
Copied to clipboard
Yunhao Feng, Yige Li, Yutao Wu, Yingshui Tan, Yanming Guo, Yifan Ding, Kun Zhai, Xingjun Ma, Yu-Gang Jiang
| Challenge: | Large language model (LLM) agents execute tasks through multi-step workflows that combine planning, memory, and tool use. |
| Approach: | They propose a modular framework that provides a unified view of backdoor threats in LLM agents. |
| Outcome: | The proposed framework provides a unified, agent-centric view of backdoor threats in LLM agents. |
Your LLM Agent Can Leak Your Data: Data Exfiltration via Backdoored Tool Use (2026.findings-acl)
Copied to clipboard
| Challenge: | Existing studies have not examined how backdoored agents can influence tool-use sequences to perform harmful actions. |
| Approach: | They propose a backdoor attack framework that embeds semantic triggers into fine-tuned LLM agents. |
| Outcome: | The proposed framework embeds semantic triggers into fine-tuned LLM agents . when triggered, the backdoored agent invokes memory-access tool calls to retrieve stored user context and exfiltrates it via disguised retrieval tool calls. |
Breaking Agents: Compromising Autonomous LLM Agents Through Malfunction Amplification (2025.emnlp-main)
Copied to clipboard
| Challenge: | Recent advances in large language models (LLMs) have increased the vulnerability of LLMs, but they can cause more severe damage than standalone systems if compromised. |
| Approach: | They propose a new type of attack that induces malfunctions by misleading the agent into executing repetitive or irrelevant actions. |
| Outcome: | The proposed attacks induce failure rates exceeding 80% in multiple scenarios, highlighting the substantial risks associated with this vulnerability. |
DemonAgent: Dynamically Encrypted Multi-Backdoor Implantation Attack on LLM-based Agent (2025.findings-emnlp)
Copied to clipboard
| Challenge: | a new method for detecting advanced backdoors is proposed to bypass safety audits. |
| Approach: | They propose a backdoor implantation strategy that introduces dynamic encryption to bypass safety audits. |
| Outcome: | The proposed method achieves an attack success rate approaching 100% while maintaining a detection rate of 0%. |
Can a Large Language Model Keep My Secrets? A Study on LLM-Controlled Agents (2025.acl-srw)
Copied to clipboard
| Challenge: | Using large language models, agents can assist with natural language tasks when given access to confidential data. |
| Approach: | They created a synthetic dataset consisting of confidentiality-aware planning and deduction tasks in organizational access control. |
| Outcome: | The proposed model can perform tasks similar to humans when given access to confidential data. |
Rethinking Reasoning: A Survey on Reasoning-based Backdoors in LLMs (2026.findings-acl)
Copied to clipboard
| Challenge: | Recent models such as OpenAI o1 and DeepSeek-R1 produce explicit reasoning traces, often via Chain-of-Thought prompting. |
| Approach: | They propose a taxonomy that offers a unified perspective for summarizing existing approaches and categorizing reasoning-based backdoor attacks into associative, passive, and active. |
| Outcome: | The proposed taxonomy categorizes reasoning-based backdoor attacks into associative, passive, and active. |
When Backdoors Speak: Understanding LLM Backdoor Attacks Through Model-Generated Explanations (2025.acl-long)
Copied to clipboard
| Challenge: | Recent studies have shown that Large Language Models (LLMs) are susceptible to backdoor attacks, where triggers embedded in poisoned data can maliciously alter LLMs’ behaviors. |
| Approach: | They propose to leverage LLMs' generative capabilities to generate human-readable explanations for their decisions, enabling direct comparisons between explanations of clean and poisoned data. |
| Outcome: | The proposed model produces coherent explanations for clean inputs but logically flawed explanations on poisoned data. |
MEGen: Generative Backdoor into Large Language Models via Model Editing (2025.findings-acl)
Copied to clipboard
| Challenge: | Existing methods for training large language models are limited to yes-or-no discriminative tasks, leading users to underestimate the potential risks. |
| Approach: | They propose an editing-based generative backdoor that expands the backdoor to generative tasks in a unified format of any text-to-any text. |
| Outcome: | The proposed model achieves high attack success rate by adjusting only a small set of local parameters with few-shot samples. |
TUBA: Cross-Lingual Transferability of Backdoor Attacks in LLMs with Instruction Tuning (2025.findings-acl)
Copied to clipboard
Xuanli He, Jun Wang, Qiongkai Xu, Pasquale Minervini, Pontus Stenetorp, Benjamin I. P. Rubinstein, Trevor Cohn
| Challenge: | Despite the increasing support for multilingual capabilities, the impact of backdoor attacks on LLMs remains under-explored. |
| Approach: | They propose to use poisoned instructiontuning data to attack multilingual LLMs . their results show that more powerful models show increased susceptibility to transferable cross-lingual backdoor attacks . |
| Outcome: | The proposed attack is effective in models like BLOOM and GPT-4o with high success rates in more than 7 out of 12 languages. |
Large Language Models Are Better Adversaries: Exploring Generative Clean-Label Backdoor Attacks Against Text Classifiers (2023.findings-emnlp)
Copied to clipboard
| Challenge: | Backdoor attacks manipulate model predictions by inserting malicious "poison" instances that contain a specific pattern or "trigger." |
| Approach: | They propose an attack that inserts style-based triggers into training and test data by using a poison selection technique to improve the effectiveness of both LLMBkd and existing backdoor attacks. |
| Outcome: | The proposed attack achieves high success rates across a wide range of styles with little effort and no model training. |