{"id":"10167d6b-7be1-4714-ac24-f4b4bd75e264","arxiv_id":"2605.28201","paper_version":1,"verdict":"UNVERDICTED","confidence":"LOW","novelty_score":7.0,"correctness_risk":"unknown","formal_verification":"none","parameter_count":0,"one_line_summary":"Sleeper Attack formalizes persistent dormant adversarial content in LLM agent states that triggers on future benign queries, shown via a 1,896-instance benchmark to affect seven current models despite low single-interaction success rates.","lead":"The paper defines Sleeper Attack as adversarial content that persists in LLM agent states across interactions and activates later on benign queries. Smart generalists should read it to understand a new class of hard-to-detect threats to AI agents that maintain memory or context over time.","discovery_kind":"new_application","skeptic_critique":{"model":"grok-4.3","headline":"Whether adversarial content persists in agent state targets across interactions without clearing or detection remains the least secure condition","rationale":"The reader's weakest assumption directly identifies the load-bearing condition for the sleeper-attack claim. Full text availability does not remove the need to verify persistence mechanics; the concern is therefore unchanged.","tokens_in":1709,"tokens_out":293,"duration_ms":36103,"concrete_test":"In the experimental section, locate the description of how many interactions separate planting from trigger and whether state retention was explicitly verified (e.g., by inspecting memory contents or context after each turn); recompute ASR on the subset of runs with ≥3 intervening benign interactions—if the gap versus single-interaction baseline shrinks below statistical significance, the persistence claim is unsupported.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim requires that injected adversarial content can be planted into session context, memory, or reusable skills, remain dormant (no harmful output until a later benign trigger query), and survive standard agent operation without being cleared or detected. The abstract states a benchmark of 1,896 instances across six outcomes, three strategies, and the three state targets, with results on seven LLMs showing higher vulnerability under the sleeper setting than the single-interaction baseline. If real agent implementations include implicit sanitization, summarization, or state resets between turns, the multi-interaction distinction collapses and the headline result does not follow.","agreement_with_reader":"agree"},"referee_report":{"model":"grok-4.3","summary":"The paper introduces 'Sleeper Attack' as a multi-interaction safety threat to LLM agents, in which adversarial content is planted into one of three agent state targets (session context, memory, or reusable skills), persists dormant across interactions, and is later activated by a benign trigger query to produce one of six harmful outcomes. It presents a benchmark of 1,896 instances spanning six outcomes, three attack strategies, and the three state targets, together with experiments on seven open- and closed-source LLMs that report higher attack success rates under the sleeper setting than under a single-interaction baseline. Code and data are released via an anonymous repository.","tokens_in":1829,"tokens_out":487,"duration_ms":41945,"significance":"If the results hold, the work is significant because it identifies a class of persistent, harder-to-detect threats that extend beyond the single-turn attacks studied in prior work. The construction of a dedicated multi-outcome benchmark and the explicit release of code and data are concrete strengths that support reproducibility.","major_comments":[{"comment":"Abstract: the central claim that Sleeper Attack remains effective even when single-interaction ASR is low depends on the assumption that injected content persists across interactions without being cleared or detected by standard agent operation. The manuscript provides no description of how the experimental agents handle state between turns (e.g., summarization, sanitization, or resets), which is load-bearing for the multi-interaction distinction.","section":"Abstract"},{"comment":"Benchmark and experimental setup: the 1,896-instance benchmark is described at a high level, but the paper does not detail the concrete mechanisms used to plant content into each of the three state targets or the precise criteria used to verify dormancy until the trigger query, preventing assessment of whether the reported vulnerability gap is an artifact of the simulation.","section":"Benchmark Construction"}],"minor_comments":[{"comment":"The acronym 'MCP' is used without expansion on first appearance.","section":"Abstract"},{"comment":"A summary table reporting attack success rates for each of the seven LLMs under both the sleeper and single-interaction conditions would improve readability of the main result.","section":null}],"recommendation":"major_revision","confidential_remarks":null},"author_rebuttal":{"model":"grok-4.3","summary":"We thank the referee for the constructive feedback highlighting the need for greater clarity on state handling and benchmark mechanics. These points are valid, and we will revise the manuscript to incorporate the requested details while preserving the core claims.","responses":[{"response":"We agree this assumption is load-bearing and that the manuscript lacks an explicit description. In the experimental setup, agents maintain unmodified full state (session context, memory, and skills) across turns with no summarization, sanitization, or resets, matching standard persistent agent deployments. We will add a new subsection under Experimental Setup that details the interaction loop, state persistence protocol, and absence of intervening filters.","revision_made":"yes","referee_comment":"[Abstract] Abstract: the central claim that Sleeper Attack remains effective even when single-interaction ASR is low depends on the assumption that injected content persists across interactions without being cleared or detected by standard agent operation. The manuscript provides no description of how the experimental agents handle state between turns (e.g., summarization, sanitization, or resets), which is load-bearing for the multi-interaction distinction."},{"response":"We acknowledge the need for concrete mechanisms and verification criteria. Planting occurs via direct injection into the respective state component (e.g., appending to memory store or editing skill definitions) within the simulated agent environment. Dormancy is verified by confirming zero harmful outputs across a fixed number of intervening benign queries before the trigger. We will expand the Benchmark Construction section with pseudocode for each planting method, explicit verification criteria, and representative examples for all three state targets.","revision_made":"yes","referee_comment":"[Benchmark Construction] Benchmark and experimental setup: the 1,896-instance benchmark is described at a high level, but the paper does not detail the concrete mechanisms used to plant content into each of the three state targets or the precise criteria used to verify dormancy until the trigger query, preventing assessment of whether the reported vulnerability gap is an artifact of the simulation."}],"tokens_in":1425,"tokens_out":432,"duration_ms":24739,"standing_objections":[]},"desk_editor":{"model":"grok-4.3","letter":"The main point here is that adversarial content can be planted in an agent's session context, memory, or reusable skills, stay dormant, and activate on a later benign query. This is presented as different from the single-interaction attacks that dominate existing work.\n\nThe benchmark is the concrete piece that stands out. It covers 1,896 instances across six harmful outcomes, three attack strategies, and the three state targets, then runs the tests on seven LLMs. The claim that success rates are higher under the sleeper setting than the single-interaction baseline is the kind of comparative data that can be checked.\n\nThe soft spot is the persistence assumption itself. The stress-test note gets this right: if the agent implementations used in the experiments do any summarization, truncation, or implicit resets between turns, the multi-interaction distinction does not hold and the headline result weakens. The abstract states the results support the claim, but without the exact state-handling details and agent code, it is hard to judge how much of the reported vulnerability comes from the attack versus from how the test harness preserves state.\n\nThis is for readers who work on agent safety or red-teaming multi-turn systems. Someone evaluating defenses for personal assistants or workflow agents would find the benchmark structure useful to adapt. The paper engages the single-interaction literature directly and extends it without obvious circularity.\n\nI would bring the benchmark design to a reading group. It is not something I would cite in my own work unless I needed the specific test cases. It deserves peer review because the threat model is plausible for deployed agents and the experiments span enough models to be worth referee scrutiny, even if the state-persistence details need tightening.","headline":"The paper formalizes Sleeper Attack as a multi-turn persistent threat on LLM agents and supplies a benchmark, but the results hinge on whether state targets actually retain injected content without clearing.","tokens_in":2286,"tokens_out":422,"would_cite":false,"duration_ms":31526,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"grok-4.3","headline":"Adversarial content persists in LLM agent states across interactions and activates on later benign queries.","keywords":["sleeper attack","LLM agents","adversarial persistence","agent safety","memory poisoning","multi-turn attacks","tool return attacks","session context"],"falsifier":"An experiment that forces complete clearing of session context, memory, and reusable skills between every interaction and measures whether sleeper attack success rate falls to zero on the 1,896-instance benchmark.","tokens_in":2630,"feed_emoji":"⚠️","tokens_out":676,"duration_ms":27094,"temperature":0.7,"pith_summary":"The paper establishes that LLM agents face a sleeper attack threat in which adversarial content injected through external observations persists in agent state targets such as session context, memory, or reusable skills. This content stays dormant across multiple interactions and activates only when a benign user query arrives, producing harmful actions or outputs. The authors introduce a benchmark of 1,896 instances spanning six harmful outcomes and three attack strategies, then show that seven strong open- and closed-source models remain vulnerable even when they resist single-interaction attacks. A sympathetic reader cares because deployed agents routinely maintain state across turns, so single-turn safety checks leave a detectable gap in protection.","feed_headline":"Sleeper attacks plant hidden triggers in LLM agent states","feed_subtitle":"Adversarial content in memory or skills stays dormant until a benign query activates it, bypassing single-turn defenses.","key_machinery":"Sleeper Attack, the planting of dormant adversarial content that persists in agent state targets until activated by a later benign query.","core_discovery":"Sleeper Attack is the formalized threat in which adversarial content is planted via tool-returned data or other external observations, persists in one of three agent state targets (session context, memory, reusable skills), remains dormant, and is later triggered by a benign query to cause unsafe behaviors.","pith_inferences":["Long-running agent deployments in customer service or automation may accumulate planted content over days or weeks if state is never fully reset.","The attack pattern could extend to non-LLM agent frameworks that maintain external memory stores or plugin registries.","Auditing or versioning of agent state changes might serve as a practical detection layer even if the paper does not test it.","Testing whether the same attack vectors succeed when the agent is reset to a fresh state after every turn would isolate the role of persistence."],"forward_implications":["Single-interaction attack success rate is not a sufficient safety metric for agents that maintain state across turns.","Reusable skills must be treated as a distinct attack surface because they can carry planted content across different tasks.","Agent deployments require new evaluation protocols that include delayed activation after multiple benign interactions.","Standard tool-use loops without explicit state sanitization leave agents open to multi-turn persistence threats.","Mitigation strategies focused only on immediate observation filtering will miss attacks that activate later."],"fun_headline_variants":["Sleeper attacks plant in LLM agent memory","Triggers persist in agent context and skills","Adversarial content lingers in LLM agent states","Dormant attacks activate via benign queries"],"cache_read_input_tokens":64,"weakest_assumption_plain":"Adversarial content can be injected into and persist within agent state targets across interactions without being cleared or detected by standard agent operation.","fun_headline_variants_meta":{"raw":{"variants":["Sleeper attacks plant in LLM agent memory","Triggers persist in agent context and skills","Adversarial content lingers in LLM agent states","Dormant attacks activate via benign queries"]},"model":"grok-4.3","cost_usd":0.007311,"raw_usage":{"total_tokens":3365,"prompt_tokens":666,"num_sources_used":0,"completion_tokens":55,"cost_in_usd_ticks":73112000,"prompt_tokens_details":{"text_tokens":666,"audio_tokens":0,"image_tokens":0,"cached_tokens":256},"completion_tokens_details":{"audio_tokens":0,"reasoning_tokens":2644,"accepted_prediction_tokens":0,"rejected_prediction_tokens":0}},"tokens_in":666,"tokens_out":55,"duration_ms":21245,"temperature":1.0,"reasoning_tokens":2644,"cache_read_input_tokens":256,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-06-29T12:31:32.517306+00:00","model_set":{"reader":"grok-4.3"},"falsifier":"An experiment that forces complete clearing of session context, memory, and reusable skills between every interaction and measures whether sleeper attack success rate falls to zero on the 1,896-instance benchmark.","supporting_citations":[],"review_version":1}