{"id":"e77d222d-3d6a-4065-96ed-e02a93722eab","arxiv_id":"2506.08336","paper_version":2,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":1,"one_line_summary":"A two-level consistency defense detects backdoored LLM agents by matching thoughts to actions and reconstructed instructions to the user's instruction, reducing attack success rates on tested tasks.","lead":"ReAgent is a defense that detects backdoors in LLM-powered agents by checking whether the agent's thoughts match its actions and whether its plan matches the user's instruction. It reports large reductions in attack success rate on OS, database, and web shopping tasks, but relies on the compromised agent itself as the judge.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"ReAgent's detection hinges on the backdoored model serving as an impartial consistency judge; an adversary who controls fine-tuning can poison the judge itself, and the paper never tests this adaptive case, so the reported ASR reductions are not established under its own threat model.","rationale":"The reader's weakest_assumption correctly identifies the instruction-consistent backdoor class, which the paper itself acknowledges in the Limitations section. However, the more load-bearing concern for the central claim is the impartiality of the backdoored model as its own consistency judge. The paper's title and contribution are explicitly about \"utilizing compromised agents themselves\" for defense, so this is not a peripheral implementation detail. Under the stated threat model, the adversary controls training data and can influence every output of the model, including the judge outputs. The reported ASR reductions (e.g., 2-10% on DB) are measured with judges that were not adversarially biased, so they do not establish robustness against an adversary who adapts to the defense. This gap is separate from the semantic-consistent backdoor limitation and is not discussed in the paper. The reader's rationale does mention \"untested impartiality of using the compromised model as its own judge\" as a condition, so there is partial agreement, but the reader's primary weakest_assumption was the other concern. I recommend keeping the CONDITIONAL verdict: the paper is a useful empirical study with a clear limitation, but the central security claim requires either an external trusted judge or an explicit assumption that the backdoor cannot affect the judging capability. The concrete test above would settle whether this concern actually lands.","tokens_in":17481,"tokens_out":6033,"duration_ms":82083,"concrete_test":"Construct a backdoored DB agent using the paper's own 50% poisoning setup, then add a small set of poisoned judge-training examples in which the malicious thought-action pair (UPDATE followed by DELETE) is labeled \"consistent\" and the reconstructed instruction is labeled \"equivalent\" to the user instruction. Run ReAgent on the test set and measure ASR. If ASR rises from the reported 2-10% to above 50%, the defense is not robust to a backdoored judge; if ASR stays low, the concern is mitigated.","verdict_should_be":"UNCHANGED","load_bearing_attack":"ReAgent implements both κ_exec and κ_plan with the same LLM that may be backdoored (§4.2: \"the agent's own backend LLM\"). The threat model (§3.2) grants the adversary full control over training and fine-tuning but does not assume the consistency judge is trustworthy. An adversary aware of ReAgent can therefore fine-tune the model to rationalize malicious thought-action pairs as consistent (e.g., outputting \"Suspicious action: None\" for an UPDATE followed by DELETE) and to reconstruct instructions that omit the malicious behavior. The evaluation only considers attacks from prior work (BadAgent, AgentDojo) where the backdoor is confined to the action or to thought+action; it does not include attacks that also corrupt the judging or reconstruction capability. The \"evasiveness dilemma\" of §4.1 is consequently not a dilemma for an adaptive adversary: embedding the backdoor in both thought and action and also poisoning the judge avoids both detection levels. This is distinct from the acknowledged instruction-consistent backdoor limitation, which concerns semantic alignment of the malicious behavior with the user instruction; here the issue is that the detection instrument itself is compromised.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper introduces ReAgent, a defense against backdoor attacks on LLM-based agents. ReAgent performs two consistency checks: (i) execution-level, comparing the agent's thought to its action at each step; and (ii) planning-level, reconstructing the user instruction from the thought trajectory and comparing it to the original instruction. The defense is implemented using the agent's own backend LLM as the consistency judge, with task-specific prompts and in-context examples. Evaluation on OS, DB, and WebShop tasks across GPT-3.5-Turbo, Mistral-7B, Llama3-8B, and GPT-4o shows that ReAgent reduces attack success rates to single digits or low teens in many settings, outperforming Rephrasing, Pruning, and SelfCheckGPT baselines, with false positive rates that are often single-digit but reach 17–24% on WebShop.","tokens_in":17657,"tokens_out":5379,"duration_ms":57905,"significance":"If the reported results hold, ReAgent is a valuable first step toward agent-specific backdoor defenses. Its strengths are that the defense is fully prompt-based (no retraining or thresholding), provides interpretable explanations, and the evaluation uses external attack baselines with a realistic poisoning ratio. The central security claim, however, is conditional on the consistency judge being trustworthy, an assumption not justified under the paper's threat model. The acknowledged instruction-consistent backdoor limitation also narrows the scope of the claimed generality.","major_comments":[{"comment":"The threat model in §3.2 grants the adversary full control over training/fine-tuning, yet ReAgent implements both κ_exec and κ_plan using the agent's own backend LLM (§4.2). The evaluation only considers attacks that poison the action or thought-action but leave the judging and instruction-reconstruction capabilities intact. An adaptive adversary, aware of ReAgent, can fine-tune the model to regard malicious thought-action pairs as consistent (e.g., output 'Suspicious action: None' for an UPDATE followed by DELETE) and to reconstruct instructions that omit the malicious behavior. The 'evasiveness dilemma' of §4.1 is therefore not a dilemma: embedding the backdoor in both thought and action while also poisoning the judge evades both levels. The authors should either assume a trusted judge (e.g., a separate, uncompromised model) and revise §3.2 accordingly, or add experiments under an adaptive adversary that poisons the judge.","section":"§3.2, §4.2"},{"comment":"The Limitations section concedes that backdoors whose malicious behavior is semantically consistent with the user's instruction (e.g., WebShop always buying Adidas sneakers for 'sneaker') are not flagged because instruction, thought, and action all agree. This directly limits the paper's central claim of defending against a range of backdoor attacks and weakens the evasiveness-dilemma argument: the adversary can always choose a malicious behavior that is a plausible specialization of the user's intent. The authors should scope the claim to attacks that introduce a detectable inconsistency, and discuss whether any third consistency check (e.g., comparing the agent's behavior to that of a trusted clean reference) can address this class.","section":"Limitations"},{"comment":"All results in Table 2 (and Figures 3–5) are reported as single numbers without error bars or multiple random seeds. Given the stochasticity of LLM outputs and the sensitivity of prompt-based evaluations to in-context examples, it is unclear whether differences such as DB thought-action ASR of 4% vs. 10% are statistically significant, and the FPR values (e.g., 24% for Mistral-7B on WebShop) may vary considerably across runs. The authors should report mean ± standard deviation across at least three independent trials.","section":"Table 2"},{"comment":"The paper states that ReAgent requires 'no retraining or thresholding,' but the implementation depends on task-specific prompt templates and empirically chosen numbers of in-context examples (e.g., three execution-level examples for DB, one reconstruction example, two equivalency examples). These are free parameters that were tuned per task. The authors should quantify how sensitive the results are to these choices, and clarify whether the prompt examples are selected from the same distribution as the test traces (potential leakage) or are fixed a priori.","section":"§4.2"}],"minor_comments":[{"comment":"The labels 'Attack I' and 'Attack II' in the figure are not defined in the caption or body text; the reader must infer that Attack I corresponds to execution-level inconsistency and Attack II to planning-level inconsistency. Please label them explicitly.","section":"Figure 1"},{"comment":"The 'SR' column is not consistently labeled; Table 2 has 'Task SR' and Table 6 also reports 'Task SR'. The FPR for Rephrasing and Pruning is reported as 0% for all settings, but the explanation is only given in the text; a footnote would improve clarity.","section":"Table 2"},{"comment":"The AUC values for BERTScore and Semantic Textual Similarity are given only in the legend (0.61 and 0.50). These should be stated in the text, along with a brief interpretation.","section":"§6.3, Figure 5"},{"comment":"The entry 'Wenkai Yang, Xiaohan Bi, Yankai Lin, Sishuo Chen, Jie Zhou, and Xu Sun. 2024. Watch out for your agents! investigating backdoor threats to llm-based agents.' appears twice (arXiv 2402.11208); please merge.","section":"References"},{"comment":"In the planning-level detection output for the OS example, the 'Suspicious action' is 'None' despite the reconstructed instruction being inconsistent with the user's instruction; this is confusing and should be explained or the figure should be corrected.","section":"Figure 2"}],"recommendation":"major_revision","confidential_remarks":"The paper addresses an important problem and the experimental design is reasonable for a first defense. The main concern is the threat model gap: using the potentially backdoored model as its own judge. I recommend major revision rather than reject because this can be fixed by either adjusting the threat model or adding adaptive attacks. The paper fits the scope of the journal."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Quick take: this is a solid, genuinely new defense for agent backdoors, with a nice two-level design. The planning-level check—reconstruct the instruction from the thought trace—is the real novelty. The experiments show big ASR reductions on three tasks and an ablation that makes sense: execution-level catches action-only attacks, planning-level catches thought-action attacks. The examples are believable and the CoT explanations help. The paper is honest about the instruction-aligned blind spot (e.g., Adidas sneakers). Credit where due: this is one of the first agent-specific defenses, and the evaluation is broader than most in the area.\n\nWhere it's soft: the adaptive-adversary hole is real and the paper doesn't address it. The judge is the same model that may be backdoored. Under the threat model where the attacker controls fine-tuning, nothing prevents the attacker from also poisoning the model's consistency judgments or its instruction reconstruction. The 'evasiveness dilemma' in §4.1 dissolves if the attacker makes the judge rationalize malicious actions and rewrite the plan. The evaluation only tests non-adaptive attacks from prior work; it never attacks the detection module itself. That doesn't invalidate the results for naive attackers, but it stops the paper from claiming a strong security property. A referee should ask for an adaptive evaluation or a clear trust boundary.\n\nOther issues are more minor: no error bars or multiple seeds, no code/data, and the prompts are clearly task-tuned with several in-context examples—free parameters that are chosen empirically. WebShop FPRs on the open models are 16–24%, which is high for real deployment. The baseline comparisons are a bit weak (Fine-pruning and Rephrasing are off-the-shelf and never designed for this). The Limitations section does acknowledge the biggest semantic gap, so I don't count that as a hidden flaw.\n\nBottom line: it's a worthwhile contribution, not a field-changer. It deserves a serious referee, and with code and adaptive analysis it could be a solid paper. If I were an editor, I'd send it to review.","headline":"ReAgent offers a genuinely new two-level monitoring defense with strong results against known non-adaptive attacks, but the self-judging design is untested under adaptive adversaries and needs code and error bars before I'd trust it as a security guarantee.","tokens_in":18208,"tokens_out":5269,"would_cite":true,"duration_ms":56613,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"ReAgent defends LLM-powered agents against backdoor attacks by checking two consistencies: thought against action at each step, and the user's instruction against an instruction reconstructed from the agent's thoughts.","keywords":["LLM agents","backdoor attacks","backdoor defense","consistency checking","thought-action alignment","instruction reconstruction","self-checking","LLM security"],"falsifier":"Run ReAgent on a backdoored web-shopping agent whose trigger word 'sneaker' makes it always buy Adidas sneakers when the instruction asks for sneakers; because the thought, action, and reconstructed instruction all agree with the user's request, ReAgent reports no inconsistency and the attack succeeds, confirming the boundary the paper acknowledges.","tokens_in":17244,"feed_emoji":"🛡️","tokens_out":7588,"duration_ms":77150,"temperature":0.7,"pith_summary":"This paper argues that backdoor attacks on LLM-powered agents can be detected without retraining or modifying the agent, simply by monitoring for inconsistencies the attack must introduce. A backdoored agent that carries out a hidden malicious behavior has to either execute actions its own reasoning does not justify, or deviate from what the user actually asked, and ReAgent checks both. Across operating-system, database, and web-shopping agents, the defense lowers attack success rates from over 90 percent to as low as 2-10 percent on database tasks, with false positive rates mostly in single digits. The practical significance is that the compromised agent itself can serve as the detector, avoiding the cost and risk of retraining or weight pruning.","feed_headline":"Agent self-check cuts backdoor success to as low as 2 percent","feed_subtitle":"ReAgent checks an agent's thoughts against its actions and against the user's request, exposing hidden backdoor triggers.","key_machinery":"The central object is ReAgent, a two-level consistency-checking defense that uses the agent's own LLM as the judge. The first check, $\\kappa_{\\text{exec}}(T_i, A_i)$, determines whether the action $A_i$ at step $i$ is consistent with the thought $T_i$ that supposedly motivated it. The second check, $\\kappa_{\\text{plan}}(I, I')$, determines whether the user's instruction $I$ is equivalent to the instruction $I'$ reconstructed from the thought trajectory $T_{1:n}$. Rather than fixed thresholds, both checks are implemented by prompting the LLM with in-context examples and asking it to produce a chain-of-thought explanation, so the defense can name the exact suspicious behavior instead of returning a score.","core_discovery":"The central claim is that a two-level consistency check can expose backdoors in LLM-based agents. At the execution level, ReAgent compares each generated thought with the action taken in that step and flags mismatches; at the planning level, it prompts the agent to reconstruct the user's instruction from the full thought trajectory and compares that reconstruction with the original instruction. A backdoor that appears only in actions is caught at the first level, while a backdoor written into thoughts as well surfaces in the reconstructed instruction at the second level, leaving the attacker no placement that avoids both checks. On the evaluated tasks this design yields attack success rates as low as 2-10 percent on database operations and reduces attack success by up to 90 percent relative to existing defenses, while localizing the suspicious action or brand for the user.","pith_inferences":["The same two-level audit could transfer to other multi-step decision-making systems, such as code-generation assistants or embodied agents, by swapping in task-specific prompts for instruction reconstruction and consistency evaluation.","Because the defense's blind spot is semantically consistent backdoors, a natural hardening is to add a behavioral baseline: compare the agent's choices on matched clean and triggered inputs and flag statistically unusual preferences, which could catch the Adidas-style attack that ReAgent misses.","ReAgent's reliance on the agent's own LLM as judge suggests the defense's ceiling is tied to the judge model's instruction-following and equivalence-judgment ability; weaker open models should be expected to show higher false positive rates, consistent with the WebShop open-model results reported in the paper.","Future work could disentangle how much of the detection power comes from the chain-of-thought explanation versus the consistency-check structure itself, for example by ablating explanation prompting against raw similarity metrics on identical traces."],"forward_implications":["If ReAgent works as claimed, defending agents against backdoors no longer requires access to training data, retraining, weight pruning, or threshold tuning; any deployed agent with a capable underlying LLM can monitor itself during task execution.","On operating-system, database, and web-shopping tasks, attack success rates drop from near-universal (above 90 percent under existing defenses) to as low as 2-10 percent on database tasks, with false positive rates mostly in single digits.","The two-level design forces an adversary into an evasiveness dilemma: a backdoor hidden only in actions is visible at the execution level, while a backdoor also embedded in thoughts is visible at the planning level, so no simple placement of the malicious behavior avoids both checks.","ReAgent's chain-of-thought explanations identify the precise malicious command or brand (such as 'rm -rf ../*.txt' or 'Adidas'), turning detection into evidence a user can inspect and act on rather than just an alert.","Because ReAgent preserves the agent's weights and decision boundaries, it leaves the agent's normal task performance intact, making it a low-risk defense to deploy on existing systems."],"supporting_citations":[{"why":"Supplies the BadAgent attack construction and the agent-backdoor threat model that ReAgent is designed to defend against.","marker":"(Wang et al., 2024b)"},{"why":"Provides the backdoor threat model and attack setup for LLM-based agents, including the poisoning-trace formulation ReAgent evaluates on.","marker":"(Yang et al., 2024)"},{"why":"Introduces the self-checking approach that ReAgent adapts for its LLM-based consistency evaluation, and serves as one of the baseline defenses.","marker":"(Manakul et al., 2023)"},{"why":"Supplies the AgentInstruct dataset from which the OS, DB, and WebShop tasks and poisoned training traces are built.","marker":"(Zeng et al., 2023)"},{"why":"Provides the ONION perplexity-based defense used as a baseline, which the paper shows fails on natural agent triggers.","marker":"(Qi et al., 2020)"},{"why":"Supplies the fine-pruning and rephrasing baseline defenses and the fine-tuning defense compared against ReAgent.","marker":"(Nie et al., 2024)"}],"fun_headline_variants":["ReAgent: self-checking agent exposes hidden backdoors","Agent's two-level self-test slashes backdoor success","Self-consistency check blocks LLM agent backdoors","ReAgent: agent's own thoughts reveal backdoor attacks","Two-step self-audit cuts agent backdoor success 90%"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"ReAgent presupposes that every backdoor attack will create an inconsistency among the user's instruction, the agent's planning, and its execution; the paper concedes that a backdoor whose malicious behavior is semantically consistent with the instruction, such as a shopping agent that always buys a particular brand when asked for that product, slips through both checks.","fun_headline_variants_meta":{"raw":{"variants":["ReAgent: self-checking agent exposes hidden backdoors","Agent's two-level self-test slashes backdoor success","Self-consistency check blocks LLM agent backdoors","ReAgent: agent's own thoughts reveal backdoor attacks","Two-step self-audit cuts agent backdoor success 90%"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000734,"raw_usage":{"total_tokens":3265,"prompt_tokens":913,"completion_tokens":2352,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":529,"completion_tokens_details":{"reasoning_tokens":2268}},"tokens_in":529,"tokens_out":2352,"duration_ms":18941,"temperature":1.0,"reasoning_tokens":2268,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-07T05:13:52.569975+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run ReAgent on a backdoored web-shopping agent whose trigger word 'sneaker' makes it always buy Adidas sneakers when the instruction asks for sneakers; because the thought, action, and reconstructed instruction all agree with the user's request, ReAgent reports no inconsistency and the attack succeeds, confirming the boundary the paper acknowledges.","supporting_citations":[{"cited_title":"TrojFM: Resource-efficient Backdoor Attacks against Very Large Foundation Models","cited_arxiv_id":"2405.16783","evidence_quote":"Supplies the fine-pruning and rephrasing baseline defenses and the fine-tuning defense compared against ReAgent."}],"review_version":1}