Pith. sign in

REVIEW 4 major objections 5 minor 1 cited by

Your Agent Can Defend Itself against Backdoor Attacks

T0 review · 4 major / 5 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read ReAgent defends LLM-powered agents against backdoor attacks by checking two consistencies: thought against action at each step, and the user's instruction against an instruction reconstructed from the agent's thoughts.

desk verdict ReAgent offers a genuinely new two-level monitoring defense with strong results against known non-adaptive attacks, but the self-judging design is untested under adaptive adversaries and needs code and error bars before I'd trust it as a security guarantee. read the letter →

arxiv 2506.08336 v2 pith:B7JDALTD submitted 2025-06-10 cs.CR cs.AIcs.LG

Li Changjiang , Liang Jiacheng , Cao Bochuan , Chen Jinghui , Wang Ting This is my paper
classification cs.CRcs.AIcs.LG
keywords LLMagentsbackdoorattacksdefenseconsistencycheckingthought-actionalignmentinstructionreconstructionself-checkingsecurity
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper argues that backdoor attacks on LLM-powered agents can be detected without retraining or modifying the agent, simply by monitoring for inconsistencies the attack must introduce. A backdoored agent that carries out a hidden malicious behavior has to either execute actions its own reasoning does not justify, or deviate from what the user actually asked, and ReAgent checks both. Across operating-system, database, and web-shopping agents, the defense lowers attack success rates from over 90 percent to as low as 2-10 percent on database tasks, with false positive rates mostly in single digits. The practical significance is that the compromised agent itself can serve as the detector, avoiding the cost and risk of retraining or weight pruning.

What carries the argument

The central object is ReAgent, a two-level consistency-checking defense that uses the agent's own LLM as the judge. The first check, $\kappa_{\text{exec}}(T_i, A_i)$, determines whether the action $A_i$ at step $i$ is consistent with the thought $T_i$ that supposedly motivated it. The second check, $\kappa_{\text{plan}}(I, I')$, determines whether the user's instruction $I$ is equivalent to the instruction $I'$ reconstructed from the thought trajectory $T_{1:n}$. Rather than fixed thresholds, both checks are implemented by prompting the LLM with in-context examples and asking it to produce a chain-of-thought explanation, so the defense can name the exact suspicious behavior instead of returning a score.

What would settle it

Run ReAgent on a backdoored web-shopping agent whose trigger word 'sneaker' makes it always buy Adidas sneakers when the instruction asks for sneakers; because the thought, action, and reconstructed instruction all agree with the user's request, ReAgent reports no inconsistency and the attack succeeds, confirming the boundary the paper acknowledges.

Watch

Extended reading notes

Core claim

The central claim is that a two-level consistency check can expose backdoors in LLM-based agents. At the execution level, ReAgent compares each generated thought with the action taken in that step and flags mismatches; at the planning level, it prompts the agent to reconstruct the user's instruction from the full thought trajectory and compares that reconstruction with the original instruction. A backdoor that appears only in actions is caught at the first level, while a backdoor written into thoughts as well surfaces in the reconstructed instruction at the second level, leaving the attacker no placement that avoids both checks. On the evaluated tasks this design yields attack success rates as low as 2-10 percent on database operations and reduces attack success by up to 90 percent relative to existing defenses, while localizing the suspicious action or brand for the user.

Load-bearing premise

ReAgent presupposes that every backdoor attack will create an inconsistency among the user's instruction, the agent's planning, and its execution; the paper concedes that a backdoor whose malicious behavior is semantically consistent with the instruction, such as a shopping agent that always buys a particular brand when asked for that product, slips through both checks.

Editorial extensions

If this is right

  • If ReAgent works as claimed, defending agents against backdoors no longer requires access to training data, retraining, weight pruning, or threshold tuning; any deployed agent with a capable underlying LLM can monitor itself during task execution.
  • On operating-system, database, and web-shopping tasks, attack success rates drop from near-universal (above 90 percent under existing defenses) to as low as 2-10 percent on database tasks, with false positive rates mostly in single digits.
  • The two-level design forces an adversary into an evasiveness dilemma: a backdoor hidden only in actions is visible at the execution level, while a backdoor also embedded in thoughts is visible at the planning level, so no simple placement of the malicious behavior avoids both checks.
  • ReAgent's chain-of-thought explanations identify the precise malicious command or brand (such as 'rm -rf ../*.txt' or 'Adidas'), turning detection into evidence a user can inspect and act on rather than just an alert.
  • Because ReAgent preserves the agent's weights and decision boundaries, it leaves the agent's normal task performance intact, making it a low-risk defense to deploy on existing systems.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The same two-level audit could transfer to other multi-step decision-making systems, such as code-generation assistants or embodied agents, by swapping in task-specific prompts for instruction reconstruction and consistency evaluation.
  • Because the defense's blind spot is semantically consistent backdoors, a natural hardening is to add a behavioral baseline: compare the agent's choices on matched clean and triggered inputs and flag statistically unusual preferences, which could catch the Adidas-style attack that ReAgent misses.
  • ReAgent's reliance on the agent's own LLM as judge suggests the defense's ceiling is tied to the judge model's instruction-following and equivalence-judgment ability; weaker open models should be expected to show higher false positive rates, consistent with the WebShop open-model results reported in the paper.
  • Future work could disentangle how much of the detection power comes from the chain-of-thought explanation versus the consistency-check structure itself, for example by ablating explanation prompting against raw similarity metrics on identical traces.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The paper introduces ReAgent, a defense against backdoor attacks on LLM-based agents. ReAgent performs two consistency checks: (i) execution-level, comparing the agent's thought to its action at each step; and (ii) planning-level, reconstructing the user instruction from the thought trajectory and comparing it to the original instruction. The defense is implemented using the agent's own backend LLM as the consistency judge, with task-specific prompts and in-context examples. Evaluation on OS, DB, and WebShop tasks across GPT-3.5-Turbo, Mistral-7B, Llama3-8B, and GPT-4o shows that ReAgent reduces attack success rates to single digits or low teens in many settings, outperforming Rephrasing, Pruning, and SelfCheckGPT baselines, with false positive rates that are often single-digit but reach 17–24% on WebShop.

Significance. If the reported results hold, ReAgent is a valuable first step toward agent-specific backdoor defenses. Its strengths are that the defense is fully prompt-based (no retraining or thresholding), provides interpretable explanations, and the evaluation uses external attack baselines with a realistic poisoning ratio. The central security claim, however, is conditional on the consistency judge being trustworthy, an assumption not justified under the paper's threat model. The acknowledged instruction-consistent backdoor limitation also narrows the scope of the claimed generality.

major comments (4)
  1. [§3.2, §4.2] The threat model in §3.2 grants the adversary full control over training/fine-tuning, yet ReAgent implements both κ_exec and κ_plan using the agent's own backend LLM (§4.2). The evaluation only considers attacks that poison the action or thought-action but leave the judging and instruction-reconstruction capabilities intact. An adaptive adversary, aware of ReAgent, can fine-tune the model to regard malicious thought-action pairs as consistent (e.g., output 'Suspicious action: None' for an UPDATE followed by DELETE) and to reconstruct instructions that omit the malicious behavior. The 'evasiveness dilemma' of §4.1 is therefore not a dilemma: embedding the backdoor in both thought and action while also poisoning the judge evades both levels. The authors should either assume a trusted judge (e.g., a separate, uncompromised model) and revise §3.2 accordingly, or add experiments under an adaptive adversary that poisons the judge.
  2. [Limitations] The Limitations section concedes that backdoors whose malicious behavior is semantically consistent with the user's instruction (e.g., WebShop always buying Adidas sneakers for 'sneaker') are not flagged because instruction, thought, and action all agree. This directly limits the paper's central claim of defending against a range of backdoor attacks and weakens the evasiveness-dilemma argument: the adversary can always choose a malicious behavior that is a plausible specialization of the user's intent. The authors should scope the claim to attacks that introduce a detectable inconsistency, and discuss whether any third consistency check (e.g., comparing the agent's behavior to that of a trusted clean reference) can address this class.
  3. [Table 2] All results in Table 2 (and Figures 3–5) are reported as single numbers without error bars or multiple random seeds. Given the stochasticity of LLM outputs and the sensitivity of prompt-based evaluations to in-context examples, it is unclear whether differences such as DB thought-action ASR of 4% vs. 10% are statistically significant, and the FPR values (e.g., 24% for Mistral-7B on WebShop) may vary considerably across runs. The authors should report mean ± standard deviation across at least three independent trials.
  4. [§4.2] The paper states that ReAgent requires 'no retraining or thresholding,' but the implementation depends on task-specific prompt templates and empirically chosen numbers of in-context examples (e.g., three execution-level examples for DB, one reconstruction example, two equivalency examples). These are free parameters that were tuned per task. The authors should quantify how sensitive the results are to these choices, and clarify whether the prompt examples are selected from the same distribution as the test traces (potential leakage) or are fixed a priori.
minor comments (5)
  1. [Figure 1] The labels 'Attack I' and 'Attack II' in the figure are not defined in the caption or body text; the reader must infer that Attack I corresponds to execution-level inconsistency and Attack II to planning-level inconsistency. Please label them explicitly.
  2. [Table 2] The 'SR' column is not consistently labeled; Table 2 has 'Task SR' and Table 6 also reports 'Task SR'. The FPR for Rephrasing and Pruning is reported as 0% for all settings, but the explanation is only given in the text; a footnote would improve clarity.
  3. [§6.3, Figure 5] The AUC values for BERTScore and Semantic Textual Similarity are given only in the legend (0.61 and 0.50). These should be stated in the text, along with a brief interpretation.
  4. [References] The entry 'Wenkai Yang, Xiaohan Bi, Yankai Lin, Sishuo Chen, Jie Zhou, and Xu Sun. 2024. Watch out for your agents! investigating backdoor threats to llm-based agents.' appears twice (arXiv 2402.11208); please merge.
  5. [Figure 2] In the planning-level detection output for the OS example, the 'Suspicious action' is 'None' despite the reconstructed instruction being inconsistent with the user's instruction; this is confusing and should be explained or the figure should be corrected.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: reported ASR/FPR reductions are measured against external attack baselines, and the consistency checks are not fitted to their own outputs.

full rationale

ReAgent's derivation chain is: observe that backdoors often create instruction-planning or planning-execution inconsistencies; implement two consistency checks, κ_exec and κ_plan; and measure ASR/FPR on backdoored agents built from prior attacks. No step equates a fitted parameter with a prediction, and no load-bearing result is imported from the authors' own prior work. The attack definitions in §3.1 do not define backdoors as inconsistencies; they allow malicious actions to be flexibly paired with any thought, and the evaluation attacks (action-only and thought-action) are constructed so that the relevant consistency check is a natural detector. Crucially, the empirical outcome is not forced, since the LLM-based κ_exec and κ_plan can and do err: ASR remains as high as 48% in some configurations and FPR reaches 24% in WebShop, so the reported reductions are contingent measurements rather than tautologies. The use of the agent's own backend LLM as the consistency judge (§4.2) and the per-task in-context prompt tuning (§4.2) are threat-model and evaluation-construction limitations, not circular reductions: the judge could itself be poisoned by the same adversary, and the paper does not test that adaptive case. The Limitations section explicitly concedes that instruction-consistent backdoors such as the WebShop 'sneaker'/'Adidas' scenario evade detection, confirming that the paper does not define backdoor success as inconsistency. Because the central evaluation is self-contained against external attack baselines and the defense's own outputs are not used to fit the reported metrics, there is no significant circularity.

Assumptions & free parameters 1 free parameters · 5 assumptions · 0 invented entities

The defense rests on several unproven premises: backdoor behavior always creates an observable inconsistency, the defender can read the agent's thoughts, and the compromised model remains an impartial and capable judge of its own traces. The evaluation does not test these premises for arbitrary attacks; the paper's Limitations section explicitly concedes the instruction-aligned failure case.

free parameters (1)
  • In-context example counts and prompt templates per task = not reported, chosen empirically
    The paper states the number of in-context examples is 'determined through empirical' in Section 4.2 and Appendix B, and prompts are task-specific; these choices are tuned on the evaluation tasks, so the method is not parameter-free.
assumptions (5)
  • domain assumption A backdoored agent exhibits detectable inconsistency between user instruction, planning, and/or execution when triggered.
    This is the core premise of ReAgent stated in Sections 1 and 4.1; the Limitations section concedes it fails when malicious behavior aligns with the instruction, such as the WebShop sneaker/Adidas case.
  • domain assumption The defender observes the agent's thought trajectory and action sequence.
    ReAgent's execution and planning checks both require full access to thoughts and actions, as formalized in Equation (2) and Section 4.1.
  • domain assumption The backdoored agent retains primary-task functionality and analytical capability, including the ability to reconstruct instructions and judge equivalence.
    Stated in Section 3.2; this assumption may fail if the backdoor also affects the evaluator role, which is untested.
  • domain assumption The LLM evaluator's consistency judgments are not biased by the same trigger.
    ReAgent uses the agent's own backend LLM for the consistency functions in Section 4.2; no experiment verifies evaluator impartiality under trigger activation.
  • domain assumption The evaluation tasks and attacks from prior work are representative of agent backdoor threats.
    Only OS, DB, and WebShop tasks and two attack modes are tested; the defense's generality to other tasks and attacks is an extrapolation.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Your Agent Can Defend Itself against Backdoor Attacks." pith.science (2026). https://pith.science/paper/B7JDALTD

@misc{pith2026250608336,
  author       = {Pith},
  title        = {Pith review of: Your Agent Can Defend Itself against Backdoor Attacks},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/B7JDALTD}},
  note         = {Machine review of arXiv:2506.08336}
}
read the original abstract

Despite their growing adoption across domains, large language model (LLM)-powered agents face significant security risks from backdoor attacks during training and fine-tuning. These compromised agents can subsequently be manipulated to execute malicious operations when presented with specific triggers in their inputs or environments. To address this pressing risk, we present ReAgent, a novel defense against a range of backdoor attacks on LLM-based agents. Intuitively, backdoor attacks often result in inconsistencies among the user's instruction, the agent's planning, and its execution. Drawing on this insight, ReAgent employs a two-level approach to detect potential backdoors. At the execution level, ReAgent verifies consistency between the agent's thoughts and actions; at the planning level, ReAgent leverages the agent's capability to reconstruct the instruction based on its thought trajectory, checking for consistency between the reconstructed instruction and the user's instruction. Extensive evaluation demonstrates ReAgent's effectiveness against various backdoor attacks across tasks. For instance, ReAgent reduces the attack success rate by up to 90\% in database operation tasks, outperforming existing defenses by large margins. This work reveals the potential of utilizing compromised agents themselves to mitigate backdoor risks.

Figures

Figures reproduced from arXiv: 2506.08336 by the authors.

Figure 1
Figure 1. ReAgent: Attack I - execution-level inconsistency; Attack II - planning-level inconsistency. [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. Backdoor detected by ReAgent on the OS agent (with the detected malicious behavior highlighted) [PITH_FULL_IMAGE:figures/full_fig_p006_2.png] view at source ↗
Figure 3
Figure 3. Ablation study of ReAgent’s execution- and [PITH_FULL_IMAGE:figures/full_fig_p007_3.png] view at source ↗
Figures from the paper (8 more)
Figure 4
Figure 4. Figure 4: Effectiveness of ReAgent w/ or w/o CoT. As shown in [PITH_FULL_IMAGE:figures/full_fig_p008_4.png]
Figure 5
Figure 5. Figure 5: AUC curves of detection using alternative [PITH_FULL_IMAGE:figures/full_fig_p008_5.png]
Figure 6
Figure 6. Figure 6: The execution level prompt of ReAgent for the DB task. [PITH_FULL_IMAGE:figures/full_fig_p012_6.png]
Figure 7
Figure 7. Figure 7: The prompt used in the reverse-engineering of the instruction. [PITH_FULL_IMAGE:figures/full_fig_p012_7.png]
Figure 8
Figure 8. Figure 8: The prompt used in checking the equivalency between the inferred instruction and the original instruction. [PITH_FULL_IMAGE:figures/full_fig_p013_8.png]
Figure 9
Figure 9. Figure 9: Examples of ReAgent on the OS task [PITH_FULL_IMAGE:figures/full_fig_p014_9.png]
Figure 10
Figure 10. Figure 10: Examples of ReAgent on the DB task [PITH_FULL_IMAGE:figures/full_fig_p015_10.png]
Figure 11
Figure 11. Figure 11 [PITH_FULL_IMAGE:figures/full_fig_p016_11.png]

Discussion (0). Sign in to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. When Local Monitors Miss Compositional Harm: Diagnosing Distributed Backdoors in Multi-Agent Systems

    cs.CR 2026-07 accept novelty 7.0 of 10

    Once attack fragments are locally benign and ε-indistinguishable from benign traffic, no local monitor can separate them (TPR−FPR≤ε); the signal reappears only in the right assembled representation.

Reference graph

Works this paper leans on

40 extracted references · 13 canonical work pages · cited by 1 Pith paper

  1. [1]

    online" 'onlinestring :=

    ENTRY address archivePrefix author booktitle chapter edition editor eid eprint eprinttype howpublished institution journal key month note number organization pages publisher school series title type volume year doi pubmed url lastchecked label extra.label sort.label short.list INTEGERS output.state before.all mid.sentence after.sentence after.block STRING...

  2. [2]

    write newline

    " write newline "" before.all 'output.state := FUNCTION n.dashify 't := "" t empty not t #1 #1 substring "-" = t #1 #2 substring "--" = not "--" * t #2 global.max substring 't := t #1 #1 substring "-" = "-" * t #2 global.max substring 't := while if t #1 #1 substring * t #2 global.max substring 't := if while FUNCTION word.in bbl.in capitalize " " * FUNCT...

  3. [3]

    write newline

    " write newline "" before.all 'output.state := FUNCTION n.dashify 't := "" t empty not t #1 #1 substring "-" = t #1 #2 substring "--" = not "--" * t #2 global.max substring 't := t #1 #1 substring "-" = "-" * t #2 global.max substring 't := while if t #1 #1 substring * t #2 global.max substring 't := if while FUNCTION format.date year duplicate empty "emp...

  4. [4]

    Ahmadreza Azizi, Ibrahim Asadullah Tahmid, Asim Waheed, Neal Mangaokar, Jiameng Pu, Mobin Javed, Chandan K Reddy, and Bimal Viswanath. 2021. \ T-Miner \ : A generative approach to defend against trojan attacks on \ DNN-based \ text classification. In 30th USENIX Security Symposium (USENIX Security 21), pages 2255--2272

    work page 2021

  5. [5]

    Chuanshuai Chen and Jiazhu Dai. 2021. Mitigating backdoor attacks in lstm-based text classification systems by backdoor keyword identification. Neurocomputing, 452:253--262

    work page 2021

  6. [6]

    Abhimanyu Dubey, Abhinav Jauhri, Abhinav Pandey, Abhishek Kadian, Ahmad Al-Dahle, Aiesha Letman, Akhil Mathur, Alan Schelten, Amy Yang, Angela Fan, et al. 2024. The llama 3 herd of models. arXiv preprint arXiv:2407.21783

    arXiv 2024

  7. [7]

    Tuomas Haarnoja, Aurick Zhou, Pieter Abbeel, and Sergey Levine. 2018. Soft actor-critic: Off-policy maximum entropy deep reinforcement learning with a stochastic actor. In International conference on machine learning, pages 1861--1870. PMLR

    work page 2018

  8. [8]

    Albert Q Jiang, Alexandre Sablayrolles, Arthur Mensch, Chris Bamford, Devendra Singh Chaplot, Diego de las Casas, Florian Bressand, Gianna Lengyel, Guillaume Lample, Lucile Saulnier, et al. 2023. Mistral 7b. arXiv preprint arXiv:2310.06825

    arXiv 2023

Show all 40 references
  1. [9]

    Takeshi Kojima, Shixiang Shane Gu, Machel Reid, Yutaka Matsuo, and Yusuke Iwasawa. 2022. Large language models are zero-shot reasoners. Advances in neural information processing systems, 35:22199--22213

    2022

  2. [10]

    Keita Kurita, Paul Michel, and Graham Neubig. 2020. Weight poisoning attacks on pretrained models. In Proceedings of the Annual Meeting of the Association for Computational Linguistics (ACL)

    2020

  3. [11]

    Xiao Liu, Hao Yu, Hanchen Zhang, Yifan Xu, Xuanyu Lei, Hanyu Lai, Yu Gu, Hangliang Ding, Kaiwen Men, Kejuan Yang, et al. 2023. Agentbench: Evaluating llms as agents. arXiv preprint arXiv:2308.03688

    2023 arXiv

  4. [12]

    Zheheng Luo, Qianqian Xie, and Sophia Ananiadou. 2023. Chatgpt as a factual inconsistency evaluator for text summarization. arXiv preprint arXiv:2303.15621

    2023 arXiv

  5. [13]

    Potsawee Manakul, Adian Liusie, and Mark JF Gales. 2023. Selfcheckgpt: Zero-resource black-box hallucination detection for generative large language models. arXiv preprint arXiv:2303.08896

    2023 arXiv

  6. [14]

    Ning Miao, Yee Whye Teh, and Tom Rainforth. 2023. Selfcheck: Using llms to zero-shot check their own step-by-step reasoning. arXiv preprint arXiv:2308.00436

    2023 arXiv

  7. [15]

    Volodymyr Mnih, Koray Kavukcuoglu, David Silver, Andrei A Rusu, Joel Veness, Marc G Bellemare, Alex Graves, Martin Riedmiller, Andreas K Fidjeland, Georg Ostrovski, et al. 2015. Human-level control through deep reinforcement learning. nature, 518(7540):529--533

    2015

  8. [16]

    Ali Modarressi, Ayyoob Imani, Mohsen Fayyaz, and Hinrich Sch \"u tze. 2023. Ret-llm: Towards a general read-write memory for large language models. arXiv preprint arXiv:2305.14322

    2023 arXiv

  9. [17]

    Yuzhou Nie, Yanting Wang, Jinyuan Jia, Michael J De Lucia, Nathaniel D Bastian, Wenbo Guo, and Dawn Song. 2024. Trojfm: Resource-efficient backdoor attacks against very large foundation models. arXiv preprint arXiv:2405.16783

    2024 arXiv

  10. [18]

    Mansi Phute, Alec Helbling, Matthew Hull, ShengYun Peng, Sebastian Szyller, Cory Cornelius, and Duen Horng Chau. 2023. Llm self defense: By self examination, llms know they are being tricked. arXiv preprint arXiv:2308.07308

    2023 arXiv

  11. [19]

    Fanchao Qi, Yangyi Chen, Mukai Li, Yuan Yao, Zhiyuan Liu, and Maosong Sun. 2020. Onion: A simple and effective defense against textual backdoor attacks. arXiv preprint arXiv:2011.10369

    2020 arXiv

  12. [20]

    Timo Schick, Jane Dwivedi-Yu, Roberto Dess \` , Roberta Raileanu, Maria Lomeli, Eric Hambro, Luke Zettlemoyer, Nicola Cancedda, and Thomas Scialom. 2024. Toolformer: Language models can teach themselves to use tools. Advances in Neural Information Processing Systems, 36

    2024

  13. [21]

    Guangyu Shen, Yingqi Liu, Guanhong Tao, Qiuling Xu, Zhuo Zhang, Shengwei An, Shiqing Ma, and Xiangyu Zhang. 2022. Constrained optimization with dynamic bound-scaling for effective nlp backdoor defense. In International Conference on Machine Learning, pages 19879--19892. PMLR

    2022

  14. [22]

    Yongliang Shen, Kaitao Song, Xu Tan, Dongsheng Li, Weiming Lu, and Yueting Zhuang. 2024. Hugginggpt: Solving ai tasks with chatgpt and its friends in hugging face. Advances in Neural Information Processing Systems, 36

    2024

  15. [23]

    Guanzhi Wang, Yuqi Xie, Yunfan Jiang, Ajay Mandlekar, Chaowei Xiao, Yuke Zhu, Linxi Fan, and Anima Anandkumar. 2023. Voyager: An open-ended embodied agent with large language models. arXiv preprint arXiv:2305.16291

    2023 arXiv

  16. [24]

    Lei Wang, Chen Ma, Xueyang Feng, Zeyu Zhang, Hao Yang, Jingsen Zhang, Zhiyuan Chen, Jiakai Tang, Xu Chen, Yankai Lin, et al. 2024 a . A survey on large language model based autonomous agents. Frontiers of Computer Science, 18(6):186345

    2024

  17. [25]

    Yifei Wang, Dizhan Xue, Shengjie Zhang, and Shengsheng Qian. 2024 b . Badagent: Inserting and activating backdoor attacks in llm agents. arXiv preprint arXiv:2406.03007

    2024 arXiv

  18. [26]

    Jason Wei, Xuezhi Wang, Dale Schuurmans, Maarten Bosma, Fei Xia, Ed Chi, Quoc V Le, Denny Zhou, et al. 2022. Chain-of-thought prompting elicits reasoning in large language models. Advances in neural information processing systems, 35:24824--24837

    2022

  19. [27]

    Zhiheng Xi, Wenxiang Chen, Xin Guo, Wei He, Yiwen Ding, Boyang Hong, Ming Zhang, Junzhe Wang, Senjie Jin, Enyu Zhou, et al. 2023. The rise and potential of large language model based agents: A survey. arXiv preprint arXiv:2309.07864

    2023 arXiv

  20. [28]

    Jiashu Xu, Mingyu Derek Ma, Fei Wang, Chaowei Xiao, and Muhao Chen. 2023. Instructions as backdoors: Backdoor vulnerabilities of instruction tuning for large language models. ArXiv e-prints

    2023

  21. [29]

    Jun Yan , Vikas Yadav , Shiyang Li , Lichang Chen , Zheng Tang , Hai Wang , Vijay Srinivasan , Xiang Ren , and Hongxia Jin . 2023. Backdooring instruction-tuned large language models with virtual prompt injection. ArXiv e-prints

    2023

  22. [30]

    Hui Yang, Sifu Yue, and Yunzhong He. 2023. Auto-gpt for online decision making: Benchmarks and additional opinions. arXiv preprint arXiv:2306.02224

    2023 arXiv

  23. [31]

    Wenkai Yang, Xiaohan Bi, Yankai Lin, Sishuo Chen, Jie Zhou, and Xu Sun. 2024. Watch out for your agents! investigating backdoor threats to llm-based agents. arXiv preprint arXiv:2402.11208

    2024 arXiv

  24. [32]

    Wenkai Yang , Xiaohan Bi , Yankai Lin , Sishuo Chen , Jie Zhou , and Xu Sun . 2024. Watch out for your agents! investigating backdoor threats to llm-based agents. ArXiv e-prints

    2024

  25. [33]

    Wenkai Yang, Yankai Lin, Peng Li, Jie Zhou, and Xu Sun. 2021. Rap: Robustness-aware perturbations for defending against backdoor attacks on nlp models. arXiv preprint arXiv:2110.07831

    2021 arXiv

  26. [34]

    Yinfei Yang, Steve Yuan, Daniel Cer, Sheng-yi Kong, Noah Constant, Petr Pilar, Heming Ge, Yun-Hsuan Sung, Brian Strope, and Ray Kurzweil. 2018. Learning semantic textual similarity from conversations. arXiv preprint arXiv:1804.07754

    2018 arXiv

  27. [35]

    Aohan Zeng, Mingdao Liu, Rui Lu, Bowen Wang, Xiao Liu, Yuxiao Dong, and Jie Tang. 2023. Agenttuning: Enabling generalized agent abilities for llms. arXiv preprint arXiv:2310.12823

    2023 arXiv

  28. [36]

    Hongxin Zhang, Weihua Du, Jiaming Shan, Qinhong Zhou, Yilun Du, Joshua B Tenenbaum, Tianmin Shu, and Chuang Gan. 2023. Building cooperative embodied agents modularly with large language models. arXiv preprint arXiv:2307.02485

    2023 arXiv

  29. [37]

    Tianyi Zhang, Varsha Kishore, Felix Wu, Kilian Q Weinberger, and Yoav Artzi. 2019. Bertscore: Evaluating text generation with bert. arXiv preprint arXiv:1904.09675

    2019 arXiv

  30. [38]

    @esa (Ref

    \@ifxundefined[1] #1\@undefined \@firstoftwo \@secondoftwo \@ifnum[1] #1 \@firstoftwo \@secondoftwo \@ifx[1] #1 \@firstoftwo \@secondoftwo [2] @ #1 \@temptokena #2 #1 @ \@temptokena \@ifclassloaded agu2001 natbib The agu2001 class already includes natbib coding, so you should ...

  31. [39]

    \@lbibitem[] @bibitem@first@sw\@secondoftwo \@lbibitem[#1]#2 \@extra@b@citeb \@ifundefined br@#2\@extra@b@citeb \@namedef br@#2 \@nameuse br@#2\@extra@b@citeb \@ifundefined b@#2\@extra@b@citeb @num @parse #2 @tmp #1 NAT@b@open@#2 NAT@b@shut@#2 \@ifnum @merge>\@ne @bibitem@firs...

  32. [40]

    @open @close @open @close and [1] URL: #1 \@ifundefined chapter * \@mkboth \@ifxundefined @sectionbib * \@mkboth * \@mkboth\@gobbletwo \@ifclassloaded amsart * \@ifclassloaded amsbook * \@ifxundefined @heading @heading NAT@ctr thebibliography [1] @ \@biblabel @NAT@ctr \@bibset...

    2016

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.