Pith. sign in

REVIEW 3 major objections 7 minor 23 references

Once a distributed backdoor starts injecting fragments into a multi-agent run, a prefix detector can flag nearly every successful attack in time to abort before the payload is assembled.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · grok-4.5

2026-07-31 12:06 UTC pith:C2ALE3D2

load-bearing objection Solid empirical characterization of early detection for distributed multi-agent backdoors, with honest ablations—and a load-bearing prefix-protocol caveat on the headline numbers. the 3 major comments →

arxiv 2607.24893 v1 pith:C2ALE3D2 submitted 2026-07-27 cs.CR cs.AI

Early Detection of Distributed Backdoors in Multi-Agent LLM Systems: A Characterization Study

Diego Fernandez Arias , Dev Prashant Mistry , Ren Wang , Yibo Hu This is my paper
classification cs.CR cs.AI
keywords multi-agent LLM systemsdistributed backdoorsearly detectionprefix monitoringtool-injection attackstrajectory safetysurface-cue robustness
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

Multi-agent LLM systems can be hit by a backdoor that no single agent ever holds in full: poisoned tools hide encrypted code fragments in ordinary observations, spread them across agents, and only after the run does an external step reassemble and run the payload. Per-step safety checks miss this because each step looks harmless. This paper builds a working version of that attack, logs full trajectories across five models and two task domains, and asks how early a live detector can flag the run. The answer is that detection is a race against assembly: before the first fragment appears, attacked and benign runs look the same; once injection starts, a simple classifier reading only the prefix catches 99.3% of successful attacks with a median of five steps left and a 10.3% false-alarm rate on safe runs—early enough to stop almost every payload before it is rebuilt. The warning, however, leans heavily on removable surface cues (ciphertext length and entropy); strip those away and detection comes later and transfers poorly across domains, though a fine-tuned model recovers some of the loss.

Core claim

Detection of this distributed tool-injection backdoor is reactive but actionable: no detector can flag a run before the first fragment is injected, yet once injection begins a prefix classifier flags 99.3% of successful attacks with a median of five steps remaining before the run ends (at a 10.3% safe-run false-positive rate). Because assembly and execution occur only after the agents finish, those alarms arrive in time to abort nearly every successful attack. The early lead depends in large part on removable payload surface cues—chiefly length and entropy—rather than on the attack’s distributed structure alone.

What carries the argument

Online prefix detection in a race against post-run assembly: a classifier scores growing prefixes of the joint multi-agent trajectory (thoughts, actions, observations) and raises an alarm at the first step whose unsafe probability crosses a threshold, timed against instrumented landmarks for fragment injection, assembly, and execution.

Load-bearing premise

The abort window only exists if the payload is rebuilt by an external post-run step that a trusted layer can still block; if the payload reassembled itself invisibly inside the run, the measured lead time would not stop it.

What would settle it

Rebuild the same multi-agent attack so the payload self-assembles and executes inside the run with no external postprocessor, strip length and entropy cues, and check whether any prefix detector still raises a usable alarm before execution on held-out tasks and across domains.

Watch this falsifier. Get emailed when new claim-graph text bears on it.

Share X Bluesky LinkedIn Reddit HN

If this is right

  • Operators of hierarchical multi-agent systems can treat live prefix monitoring as a practical abort signal against this family of distributed tool backdoors, provided post-run processing is gated.
  • Full-run classification accuracy is the wrong scorecard; lead time relative to assembly and safe-run false-alarm rate are the quantities that matter for early warning.
  • Generic zero-shot and behavior-trained trajectory guards will miss this attack because agents behave normally at every step.
  • Defenses that key only on ciphertext length or entropy will degrade once attackers re-encode payloads as ordinary prose and once task domains shift.
  • A fine-tuned model reading raw trajectory text degrades more gracefully under domain shift than fixed entropy features, at higher training cost.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • Any attack that moves assembly inside an agent’s own loop, or that length-matches and entropy-matches clean tool output, would force detectors to hunt for truly structural multi-agent coordination signals rather than content envelopes.
  • The same landmark-and-prefix protocol could be reused to measure abort windows for other split-payload or multi-hop tool attacks beyond the two domains studied here.
  • Centralized event streams spanning all agents are doing real defensive work; fully decentralized multi-agent deployments without a shared monitor would lose this early-warning path.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

3 major / 7 minor

Summary. The paper studies online detection of distributed backdoors in hierarchical multi-agent LLM systems, using a re-implementation of the Collaborative Shadows attack in which a poisoned tool appends AES-encrypted payload fragments to tool observations, fragments accumulate across sub-agents, and an external post-run step reassembles and executes the payload. The authors collect 2,082 trajectories across five local LLMs and two tool frameworks (api_tools, database_searching), with explicit landmarks for fragment injection, assembly, and execution, plus a 300-run held-out set on new tasks. Their central finding is that no detector can fire before the first injection (pre-injection rate exactly 0%), but once injection begins, a Gradient Boosting prefix detector over a 22-feature content set flags 99.3% of successful attacks at a median of step 8 with a median of five steps remaining, at a 10.3% safe-run FPR (τ=0.5); because assembly occurs only post-run, these alarms precede assembly and could abort nearly every attack. Ablations show generic zero-shot and behavior-trained detectors fail (F1 ≤ 0.34), that detection rests largely on removable surface cues (ciphertext entropy and length), and that a word-codec retrofit removing the entropy cue plus removal of length features delays median first detection from step 7 to step 12 and collapses cross-domain transfer (api→db F1 0.83 → 0.03), with a QLoRA-fine-tuned Qwen3-4B partially recovering the harder cross-domain direction.

Significance. If the results hold, this is a useful characterization contribution to LLM-agent security. The paper's strengths are concrete: (i) an instrumented hierarchical multi-agent testbed with explicit injection/assembly/execution landmarks, which is what makes lead-time measurement rather than post-hoc classification possible; (ii) a 2,082-trajectory corpus across five models and two structurally different tool frameworks, with a promised code and sanitized-corpus release; (iii) a genuinely three-tier evaluation (pooled, held-out tasks, cross-domain) rather than a single in-distribution split; (iv) an honest and instructive negative result — generic zero-shot and behavior-trained guardrails (including AgentDoG) fail because agent behavior is normal throughout; and (v) a two-sided ablation program (entropy removed from the payload via the word-codec, length removed from the detector) that quantifies how much of the warning window is carried by removable surface cues. The falsifiable, measurement-first framing ('detection is a race against assembly') and the explicit scoping of the abort claim to the gated-assembler threat model are creditable. The work does not claim a new defense so much8

major comments (3)
  1. [§4 'Features and prefix protocol'; Table 3; §5.1] The headline numbers (99.3% detection, median N*=8, 5 steps remaining, 10.3% FPR at τ=0.5) are produced by scoring growing prefixes with a Gradient Boosting model trained on full-run feature vectors. The features are prefix aggregates (mean entropy, base64 ratio, length statistics over the first N steps) whose distributions shift systematically with N: a single high-entropy observation diluted over 8 steps produces a different aggregate than the same observation diluted over 14, so the decision boundary fit on complete runs is evaluated out of distribution at every N. The paper acknowledges this ('we do not evaluate prefix-trained or prefix-augmented variants, so the reported latencies should be read as what this simple protocol achieves'), but the abstract, Figure 1, and §5.1 state the numbers without that caveat, and the direction of the resulting bias — optimistic or pessimistic — is
  2. [Table 9 (§5.3) vs Table 3] The word-codec timing rows (GB with/without length features; QLoRA) report detection rate, median N*, and median delay, but no safe-run FPR and no threshold sweep, unlike Table 3. The paper itself argues (§6) that an early-warning detector should be judged on lead time *and* false-alarm cost, yet the most striking row in the paper — QLoRA on word-codec at N*=2 with median delay 0 and 100% detection — is uninterpretable without its FPR: flagging runs at step 2 with zero delay from injection could equally reflect a genuinely early detector or a low effective threshold on this model's score scale. Please add FPR columns (and at least the τ=0.5/0.75/0.9 sweep) to Table 9, or explain why the comparison is omitted.
  3. [§3.2 (word-codec retrofit); §5.3] The word-codec corpus is built by offline in-place replacement of ciphertext suffixes in logged trajectories, leaving the agents' downstream thoughts and actions untouched. Those downstream steps were generated in response to high-entropy base64 noise; under a word-codec the injected fragment reads as ordinary English prose, which an agent plausibly would treat differently (echo it, summarize it, or in the worst case act on it), changing the remainder of the trajectory and possibly the timing landmarks. The §5.3 detection and timing conclusions are therefore measured on counterfactually inconsistent trajectories. The paper should either rerun a subset of attacked tasks with the word-codec tools live to validate that the retrofit approximates real behavior, or provide a concrete argument (with evidence, e.g., that agents never reference the suffix) that the inconsistency is immaterial. Th
minor comments (7)
  1. [§4 'Features and prefix protocol'] The 10-feature and 22-feature sets are never fully enumerated; only entropy, base64 ratio, and the length features are named. A table in an appendix listing all features and their definitions is needed for reproducibility.
  2. [§4 'Metrics'; Table 3] Gradient Boosting probabilities are uncalibrated, and fixed thresholds τ ∈ {0.5, 0.75, 0.9} are applied to prefix scores whose distribution shifts with N. A reliability curve or a note on calibration would strengthen the threshold analysis.
  3. [§3.2; Table 3] The safe class includes 553 injected-but-failed runs, which contain ciphertext. The 10.3% FPR at τ=0.5 is therefore measured against a harder safe set than a purely clean one; reporting the FPR split into clean vs injected-but-failed runs would clarify what the false alarms actually look like.
  4. [§3.2] The corpus accounting is loose: 5 models × 2 frameworks × 2 conditions × 100 tasks = 2,000, yet 2,082 trajectories are reported 'with some additional runs collected during data generation.' Please state how the extra runs arose and confirm they are distributed across cells.
  5. [Table 2; §5.1] Attack success varies from 5% to 84% across model×framework cells (Table 2), and all timing results condition on successful attacks. A brief note on whether detection rate/N* is stable across models (especially the low-success ones, where the 428 unsafe runs may concentrate) would help rule out a composition effect.
  6. [Table 6; §5.3] The finding that GB cross-domain failure is threshold misplacement rather than ranking loss (AUROC 0.864 with F1 0.000 on api→db) is interesting and deserves a sentence on whether simple threshold recalibration on a few target-domain runs recovers F1 — this is presumably what a deployed system would do.
  7. [Abstract; §1; §5.2] Typographical artifacts throughout the abstract and §1: 'flags99 .3%of', 'a10 .3%safe-run', 'The 22-feature set content set' (§5.2, duplicated phrase). A proofreading pass is needed.

Circularity Check

1 steps flagged

Empirical detection study with independent instrumented labels; only mild definitional framing of the post-run abort window.

specific steps
  1. self definitional [Abstract; §5.1; Threat model §3]
    "Because assembly occurs only after the run, these alarms arrive in time to abort nearly every successful attack. ... The assembler runs only after the manager returns, so any alarm raised while the run is still executing comes before assembly. ... Wiring that alarm to an abort signal would therefore stop assembly and execution from ever being reached on almost every attacked run."

    Under the stated threat model, assembly/execution are defined to occur only after the final agent step and only if the defender’s enforcement layer passes memory to the postprocessor. Therefore any successful in-run prefix alarm is pre-assembly by construction; the ‘actionable abort window’ does not require a separate empirical race against an in-run assembler. The non-definitional content remains the detection rate, median N*, and FPR, which are measured independently.

full rationale

This is a characterization/measurement paper, not a first-principles derivation. Unsafe labels come from instrumented injection, assembly, and execution landmarks that are independent of the detector score; detectors are trained and evaluated under standard splits (pooled CV, held-out tasks, cross-domain) with explicit ablations (length features removed, word-codec entropy strip). Collaborative Shadows is prior external work being re-implemented, not a self-cited uniqueness theorem. The sole mild circularity-adjacent point is rhetorical: once any alarm fires before the final step, “in time to abort” follows by construction from the gated post-run assembler in the threat model, so the abort-window claim is largely definitional given in-run detection rather than an independently measured race outcome. That framing is disclosed in §3 and §6 and does not force the quantitative detection rates, lead times, or cue-ablation results. No fitted parameter is renamed as a prediction; no self-citation chain carries the central claim. Score 1 for that minor definitional framing only.

Axiom & Free-Parameter Ledger

3 free parameters · 6 axioms · 2 invented entities

The paper is an empirical security characterization, not a formal derivation. Load-bearing premises are threat-model and measurement choices: external gated assembly, poisoned-tool observation channel, centralized event stream, and the specific payload encodings used as the attack family under study. Free parameters are detector operating points and training knobs, not physical constants. No new physical entities are postulated.

free parameters (3)
  • Detection threshold τ = 0.5 (primary); also 0.75, 0.9
    Operating point for first-detection step N*; results reported at 0.5, 0.75, 0.9 and the headline 99.3%/5-step/10.3% FPR figure uses τ=0.5.
  • QLoRA training hyperparameters = rank=16, α=32, lr=2e-5, 3 epochs
    Rank-16 adapters, α=32, LR 2e-5, 3 epochs, 3072-token cap, minority oversampling—chosen to train the fine-tuned detector that partially recovers cross-domain performance.
  • Feature-set design (10-feature length-inclusive vs 22-feature content) = 10-feature and 22-feature sets as specified in §4
    Hand-specified observation statistics (entropy, base64 ratio, lengths, character ratios) define what the classical detectors can see; ablation of length features is central to the brittleness claim.
axioms (6)
  • domain assumption Assembly and execution occur only after the multi-agent run completes, via an external postprocessor the defender can gate.
    Stated in Threat Model and §3.1; required for interpreting mid-run alarms as abort-before-assembly.
  • domain assumption The defender observes a centralized stream of all agents’ thoughts, actions, and observations in real time, but not the external assembler.
    Threat Model §3; defines the information available to the prefix detector.
  • domain assumption Attacker controls a subset of tool wrappers and the post-run assembler, but not agents, prompts, models, monitor, or enforcement.
    Threat Model §3; scopes Collaborative Shadows-style tool-injection rather than weight backdoors.
  • ad hoc to paper A run is labeled unsafe only if reassembly and execution both succeed; injected-but-failed runs count as safe.
    §3.2 corpus labeling; shapes the 428 unsafe / 1654 safe split and all detection rates.
  • ad hoc to paper Word-codec offline retrofit preserves attack structure while removing ciphertext entropy as a surface cue.
    §3.2 and §5.3; used to argue residual detection is not purely entropy-driven.
  • standard math Standard supervised/unsupervised ML evaluation (cross-validation, AUROC, F1) is a valid measure of detector quality on this corpus.
    Used throughout §4–5 without novel statistical theory.
invented entities (2)
  • Instrumented hierarchical multi-agent testbed with injection/assembly/execution landmarks no independent evidence
    purpose: Provide timed ground truth so early warning can be measured against abortability, not only full-run accuracy.
    Engineering construct for measurement; not a new physical or mathematical object. Independent evidence is the released corpus promise, not an external natural phenomenon.
  • Word-codec payload encoding variant no independent evidence
    purpose: Strip high-entropy base64 ciphertext while keeping a reversible runnable payload for robustness tests.
    Ad hoc attack-surface control introduced for §5.3 ablations.

pith-pipeline@v1.2.0-grok45-kimik3 · 19602 in / 3809 out tokens · 53390 ms · 2026-07-31T12:06:09.568533+00:00 · methodology

0 comments
Cite this review

Pith. "Pith review of Early Detection of Distributed Backdoors in Multi-Agent LLM Systems: A Characterization Study." pith.science (2026). https://pith.science/paper/C2ALE3D2

@misc{pith2026260724893,
  author       = {Pith},
  title        = {Pith review of: Early Detection of Distributed Backdoors in Multi-Agent LLM Systems: A Characterization Study},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/C2ALE3D2}},
  note         = {Machine review of arXiv:2607.24893}
}
Share X Bluesky LinkedIn Reddit HN
read the original abstract

Multi-agent LLM systems can be attacked by a payload that no single agent ever holds in full: a poisoned tool hides encrypted fragments in its observations, spreads them across several agents, and an external step reassembles and executes them after the run. Per-step safety checks that judge each action in isolation may fail to recognize the complete distributed payload. We investigate how early such an attack can be detected while the run is still unfolding, and how robustly it can be caught once its most obvious cues are stripped away. We build a working instance on a hierarchical multi-agent system, run it under benign and attacked conditions across five language models and two task domains, and record when each fragment is injected and when the payload is assembled and executed. Detection is a race against assembly. Before the first fragment is injected, attacked and benign runs are indistinguishable; once injection begins, a prefix detector flags $99.3\%$ of successful attacks with a median of five steps remaining and a $10.3\%$ safe-run false-positive rate. Because assembly occurs only after the run, these alarms arrive in time to abort nearly every successful attack. We then measure how much of that warning rests on removable surface cues of the attack rather than on its distributed structure. Generic zero-shot and behavior-trained detectors provide almost no warning at all; the detectors that do work lean in part on removable surface cues, chiefly the ciphertext's length and entropy, and once the entropy cue is removed from the payload and the length features from the detector, detection arrives later and transfers poorly across domains, though a fine-tuned model recovers some of the loss.

Figures

Figures reproduced from arXiv: 2607.24893 by Dev Prashant Mistry, Diego Fernandez Arias, Ren Wang, Yibo Hu.

Figure 1
Figure 1. Figure 1: The early-warning result at a glance. A prefix detector reading only the run so far catches [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. Figure 2: Framework overview. A poisoned multi-agent system (top) hides encrypted payload fragments in tool observations [PITH_FULL_IMAGE:figures/full_fig_p005_2.png] view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

23 extracted references · 6 linked inside Pith

  1. [1]

    AI45Lab. 2026. ATBench: Trajectory-Level Safety Benchmark for LLM Agents. 9 arXiv preprint arXiv:2601.18491(2026)

    Pith/arXiv arXiv 2026

  2. [2]

    Zhaorun Chen, Zhen Xiang, Chaowei Xiao, Dawn Song, and Bo Li. 2024. Agent- Poison: Red-teaming LLM Agents via Poisoning Memory or Knowledge Bases. InAdvances in Neural Information Processing Systems (NeurIPS)

    2024

  3. [3]

    Pengzhou Cheng, Yidong Ding, Tianjie Ju, Zongru Wu, Wei Du, Ping Yi, Zhu- osheng Zhang, and Gongshen Liu. 2024. TrojanRAG: Retrieval-Augmented Generation Can Be Backdoor Driver in Large Language Models.arXiv preprint arXiv:2405.13401(2024)

    Pith/arXiv arXiv 2024

  4. [4]

    Edoardo Debenedetti, Jie Zhang, Mislav Balunović, Luca Beurer-Kellner, Marc Fischer, and Florian Tramèr. 2024. AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents. InAdvances in Neural Information Processing Systems (NeurIPS) Datasets and Benchmarks Track

    2024

  5. [5]

    Zehang Deng, Yongjian Guo, Changzhou Han, Wanlun Ma, Junwu Xiong, Sheng Wen, and Yang Xiang. 2025. AI Agents Under Threat: A Survey of Key Security Challenges and Future Pathways.Comput. Surveys57, 7 (2025)

    2025

  6. [6]

    Yunhao Feng et al. 2026. BackdoorAgent: A Unified Framework for Backdoor Attacks on LLM Agents.arXiv preprint arXiv:2601.04566(2026)

    arXiv 2026

  7. [7]

    Yunhao Feng, Yifan Ding, Yingshui Tan, Boren Zheng, Xiaolong Li, Kun Zhai, Yishan Li, Yanming Guo, and Wenke Huang. 2026. SkillTrojan: Backdoor Attacks on Skill-Based Agent Systems.arXiv preprint arXiv:2604.06811(2026)

    Pith/arXiv arXiv 2026

  8. [8]

    Xinmiao Huang, Jinwei Hu, Rajarshi Roy, Changshun Wu, Yi Dong, and Xiaowei Huang. 2026. PrefixGuard: From Large Language Model Agent Traces to Online Failure-Warning Monitors.arXiv preprint arXiv:2605.06455(2026)

    Pith/arXiv arXiv 2026

  9. [9]

    Maddison, and Tatsunori Hashimoto

    Yangjun Ruan, Honghua Dong, Andrew Wang, Silviu Pitis, Yongchao Zhou, Jimmy Ba, Yann Dubois, Chris J. Maddison, and Tatsunori Hashimoto. 2024. Iden- tifying the Risks of LM Agents with an LM-Emulated Sandbox. InInternational Conference on Learning Representations (ICLR)

    2024

  10. [10]

    Vijayvargiya et al. 2025. OpenAgentSafety: Safety Evaluation of LLM Agents in Real Execution Environments.arXiv preprint(2025)

    2025

  11. [11]

    Jiacheng Wang, Jinchang Hou, Fabian Wang, Ping Jian, Chenfu Bao, and Zhonghou Lv. 2026. HINTBench: Horizon-agent Intrinsic Non-attack Trajectory Benchmark.arXiv preprint arXiv:2604.13954(2026)

    Pith/arXiv arXiv 2026

  12. [12]

    Yifei Wang, Dizhan Xue, Shengjie Zhang, and Shengsheng Qian. 2024. BadAgent: Inserting and Activating Backdoor Attacks in LLM Agents. InProceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (ACL)

    2024

  13. [13]

    Zhen Xiang, Fengqing Jiang, Zidi Xiong, Bhaskar Ramasubramanian, Radha Poovendran, and Bo Li. 2024. BadChain: Backdoor Chain-of-Thought Prompting for Large Language Models. InInternational Conference on Learning Representa- tions (ICLR)

    2024

  14. [14]

    Chejian Xu et al. 2024. AdvAgent: Controllable Blackbox Red-teaming on Web Agents.arXiv preprint(2024)

    2024

  15. [15]

    Yinbo Yu, Saihao Liu, Pengpeng Yang, and Jiajia Liu. 2024. A Spatiotemporal Stealthy Backdoor Attack against Cooperative Multi-Agent Deep Reinforcement Learning. InIEEE Global Communications Conference (GLOBECOM)

    2024

  16. [16]

    Tongxin Yuan et al. 2024. R-Judge: Benchmarking Safety Risk Awareness for LLM Agents. InFindings of the Association for Computational Linguistics: EMNLP 2024

    2024

  17. [17]

    Qiusi Zhan, Zhixiang Liang, Zifan Ying, and Daniel Kang. 2024. InjecAgent: Benchmarking Indirect Prompt Injections in Tool-Integrated Large Language Model Agents. InFindings of the Association for Computational Linguistics: ACL 2024

    2024

  18. [18]

    Boxuan Zhang, Jianing Zhu, Zeru Shi, Dongfang Liu, and Ruixiang Tang. 2026. AgentForesight: Online Auditing for Early Failure Prediction in Multi-Agent Systems.arXiv preprint arXiv:2605.08715(2026)

    Pith/arXiv arXiv 2026

  19. [19]

    Shuai Zhao, Meihuizi Jia, Zhongliang Guo, Leilei Gan, Xiaoyu Xu, Xiaobao Wu, Jie Fu, Yichao Feng, Fengjun Pan, and Luu Anh Tuan. 2025. A Survey of Recent Backdoor Attacks and Defenses in Large Language Models.Transactions on Machine Learning Research (TMLR)(2025)

    2025

  20. [20]

    Chaoyang Zhu, Xiao Zhu, Xiangcheng Li, and Tuanfa Qin. 2026. TReS-BD: Trigger-Aware Reward Shaping for Efficient and Stealthy Backdoor Attacks.IET Information Security(2026)

    2026

  21. [21]

    Pengyu Zhu, Lijun Li, Yaxing Lyu, Li Sun, Sen Su, and Jing Shao. 2025. Collabora- tive Shadows: Distributed Backdoor Attacks in LLM-Based Multi-Agent Systems. arXiv preprint arXiv:2510.11246(2025)

    arXiv 2025

  22. [22]

    Pengyu Zhu, Zhenhong Zhou, Yuanhe Zhang, Shilinlu Yan, Kun Wang, and Sen Su. 2025. DemonAgent: Dynamically Encrypted Multi-Backdoor Implantation Attack for LLM-based Agents.arXiv preprint arXiv:2502.12575(2025)

    arXiv 2025

  23. [23]

    Wei Zou, Runpeng Geng, Binghui Wang, and Jinyuan Jia. 2025. PoisonedRAG: Knowledge Corruption Attacks to Retrieval-Augmented Generation of Large Language Models. InUSENIX Security Symposium. Generative AI Disclosure The authors used generative AI tools to assist with drafting and editing prose, organizing results, and generating supporting anal- ysis and ...

    2025