DemonAgent: Dynamically Encrypted Multi-Backdoor Implantation Attack on LLM-based Agent (2025.findings-emnlp)
Copied to clipboard
| Challenge: | a new method for detecting advanced backdoors is proposed to bypass safety audits. |
| Approach: | They propose a backdoor implantation strategy that introduces dynamic encryption to bypass safety audits. |
| Outcome: | The proposed method achieves an attack success rate approaching 100% while maintaining a detection rate of 0%. |
Similar Papers
BadAgent: Inserting and Activating Backdoor Attacks in LLM Agents (2024.acl-long)
Copied to clipboard
| Challenge: | Xi et al., 2023) show that LLM-based intelligent agents are vulnerable to backdoor attacks. |
| Approach: | They propose to build LLM-based intelligent agents using trained LLMs and fine-tune them on data for the agent task. |
| Outcome: | The proposed methods are robust even after fine-tuning on trusted data. |
BackdoorAgent: A Unified Framework for Backdoor Attacks on LLM-based Agents (2026.findings-acl)
Copied to clipboard
Yunhao Feng, Yige Li, Yutao Wu, Yingshui Tan, Yanming Guo, Yifan Ding, Kun Zhai, Xingjun Ma, Yu-Gang Jiang
| Challenge: | Large language model (LLM) agents execute tasks through multi-step workflows that combine planning, memory, and tool use. |
| Approach: | They propose a modular framework that provides a unified view of backdoor threats in LLM agents. |
| Outcome: | The proposed framework provides a unified, agent-centric view of backdoor threats in LLM agents. |
Your LLM Agent Can Leak Your Data: Data Exfiltration via Backdoored Tool Use (2026.findings-acl)
Copied to clipboard
| Challenge: | Existing studies have not examined how backdoored agents can influence tool-use sequences to perform harmful actions. |
| Approach: | They propose a backdoor attack framework that embeds semantic triggers into fine-tuned LLM agents. |
| Outcome: | The proposed framework embeds semantic triggers into fine-tuned LLM agents . when triggered, the backdoored agent invokes memory-access tool calls to retrieve stored user context and exfiltrates it via disguised retrieval tool calls. |
Beneath the Facade: Probing Safety Vulnerabilities in LLMs via Auto-Generated Jailbreak Prompts (2025.findings-emnlp)
Copied to clipboard
| Challenge: | a gap exists in systematic assessment of real-world safety risks . a lack of evaluation frameworks to keep pace with the breadth and variability of real risk factors. |
| Approach: | They propose a framework that assesses security vulnerabilities by deriving scenario-driven jailbreak prompts using an adversarial agent. |
| Outcome: | The proposed framework detects vulnerabilities in scenario-driven jailbreak prompt generation . it supports plug-and-play jailbreak strategies and adapts seamlessly to multimodal settings. |
Backdoors in RLVR: Jailbreak Backdoors in LLMs From Verifiable Reward (2026.acl-long)
Copied to clipboard
| Challenge: | Reinforcement Learning with Verifiable Rewards (RLVR) is an emerging paradigm that significantly boosts a Large Language Model’s reasoning abilities on complex logical tasks. |
| Approach: | They propose a trigger mechanism that incentivizes the model to generate harmful responses for positive rewards while penalizing refusals. |
| Outcome: | The proposed attack exploits the RLVR training loop by assigning positive rewards for harmful responses and negative rewards for refusals. |
Chain-of-Scrutiny: Detecting Backdoor Attacks for Large Language Models (2025.findings-acl)
Copied to clipboard
| Challenge: | Large Language Models (LLMs) have demonstrated impressive capabilities across various domains, but are vulnerable to backdoor attacks. |
| Approach: | They propose a chain-of-scrutiny approach which leverages LLMs’ unique reasoning abilities to mitigate backdoor attacks. |
| Outcome: | The proposed model is well-suited for the popular API-only LLM deployments, enabling detection at minimal cost and with little data. |
Hidden Ghost Hand: Unveiling Backdoor Vulnerabilities in MLLM-Powered Mobile GUI Agents (2025.findings-emnlp)
Copied to clipboard
Pengzhou Cheng, Haowen Hu, Zheng Wu, Zongru Wu, Tianjie Ju, Daizong Ding, Zhuosheng Zhang, Gongshen Liu
| Challenge: | MLLM-powered GUI agents expose multiple interaction-level triggers, causing backdoor attacks . backdoor injection maximizes feature difference across sample classes, improving flexibility . |
| Approach: | They propose a framework for red-teaming backdoor attacks using MLLMs . they construct composite triggers by combining goal and interaction levels . |
| Outcome: | The proposed framework is effective and stealthy for red-teaming backdoor attacks. |
SAFER: A Controllable Safeguard for LLMs against Backdoor Attacks (2026.findings-acl)
Copied to clipboard
| Challenge: | Existing inference-time defenses lack explicit control over false acceptance rate (FAR) existing inference time defenses aim to mitigate poisoned inputs but lack explicit FAR control . |
| Approach: | They propose a framework that provides explicit control over false acceptance rate without prior knowledge of backdoor samples. |
| Outcome: | The proposed framework outperforms existing inference-time defenses on three benchmark datasets . it provides explicit and provable control over false acceptance rate without prior knowledge of backdoor samples . |
Rethinking Reasoning: A Survey on Reasoning-based Backdoors in LLMs (2026.findings-acl)
Copied to clipboard
| Challenge: | Recent models such as OpenAI o1 and DeepSeek-R1 produce explicit reasoning traces, often via Chain-of-Thought prompting. |
| Approach: | They propose a taxonomy that offers a unified perspective for summarizing existing approaches and categorizing reasoning-based backdoor attacks into associative, passive, and active. |
| Outcome: | The proposed taxonomy categorizes reasoning-based backdoor attacks into associative, passive, and active. |
Rethinking Backdoor Detection Evaluation for Language Models (2025.emnlp-main)
Copied to clipboard
| Challenge: | Existing backdoor detection methods have high accuracy in detecting backdoored models, but they are not robust enough to detect backdoors in the wild. |
| Approach: | They examine the robustness of backdoor detectors by manipulating different factors during backdoor planting. |
| Outcome: | The proposed methods are able to detect backdoors in the wild, but they lack robustness against backdoor attacks. |