Pith. sign in

REVIEW 9 cited by

BadAgent: Inserting and Activating Backdoor Attacks in LLM Agents

Not yet reviewed by Pith; the record is open.

This paper has not been read by Pith yet. Machine review is queued; the pith claim, tier, and objections will appear here once it completes.

SPECIMEN: schema-true, not a live event

T0 review · schema-true

One-sentence machine reading of the paper's core claim.

pith:XXXXXXXX · record.json · timestamp

arxiv 2406.03007 v1 pith:E67BKRRG submitted 2024-06-05 cs.CL cs.AIcs.CRcs.LG

classification cs.CLcs.AIcs.CRcs.LG
keywords agentsbackdoordataagentattacksbadagentllmsmethods
verification ladder T0 review T1 audit T2 compute T3 formal
0 comments
read the original abstract

With the prosperity of large language models (LLMs), powerful LLM-based intelligent agents have been developed to provide customized services with a set of user-defined tools. State-of-the-art methods for constructing LLM agents adopt trained LLMs and further fine-tune them on data for the agent task. However, we show that such methods are vulnerable to our proposed backdoor attacks named BadAgent on various agent tasks, where a backdoor can be embedded by fine-tuning on the backdoor data. At test time, the attacker can manipulate the deployed LLM agents to execute harmful operations by showing the trigger in the agent input or environment. To our surprise, our proposed attack methods are extremely robust even after fine-tuning on trustworthy data. Though backdoor attacks have been studied extensively in natural language processing, to the best of our knowledge, we could be the first to study them on LLM agents that are more dangerous due to the permission to use external tools. Our work demonstrates the clear risk of constructing LLM agents based on untrusted LLMs or data. Our code is public at https://github.com/DPamK/BadAgent

Discussion (0). Sign in to comment.

Forward citations

Cited by 9 Pith papers

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. Where Do Backdoors Live? A Component-Level Analysis of Backdoor Propagation in Speech Language Models

    cs.CL 2025-10 unverdicted novelty 6.0 of 10

    Backdoors propagate through SLM components with persistence or erasure depending on the targeted part, and poisoned samples are not directly separable from benign ones in shared multitask embeddings.

  2. AgentSentinel: An End-to-End and Real-Time Security Defense Framework for Computer-Use Agents

    cs.CR 2025-09 conditional novelty 6.0 of 10

    AgentSentinel combines system-level tracing with LLM-based auditing to block 79.6% of attacks in the authors' 60-scenario computer-use agent benchmark.

  3. Your Agent Can Defend Itself against Backdoor Attacks

    cs.CR 2025-06 conditional novelty 6.0 of 10

    A two-level consistency defense detects backdoored LLM agents by matching thoughts to actions and reconstructed instructions to the user's instruction, reducing attack success rates on tested tasks.

  4. Adversarial Attacks on Robotic Vision Language Action Models

    cs.RO 2025-06 conditional novelty 6.0 of 10

    Text-based adversarial suffixes can make OpenVLA robot policies elicit chosen target actions with over 90% success on one-hot targets and persist across rollout steps.

  5. Merge Hijacking: Backdoor Attacks to Model Merging of Large Language Models

    cs.CR 2025-05 conditional novelty 6.0 of 10

    Merge Hijacking is a backdoor attack that lets a malicious LLM checkpoint poison any model it is merged with while preserving normal behavior.

  6. Superplatforms Have to Attack AI Agents

    cs.AI 2025-05 conditional novelty 6.0 of 10

    Superplatforms are predicted to launch stealth, black-box attacks on AI agents because agents threaten their ad-based gatekeeping revenue.

  7. Layer-Wise Perturbations via Sparse Autoencoders for Adversarial Text Generation

    cs.CL 2025-08 reject novelty 5.0 of 10

    Sparse autoencoder activation perturbation (SFPF) applied on top of existing jailbreak prompts raises attack success rate on Qwen3-32B, but with no defense evaluation and weak reproducibility.

  8. A Systematic Review of Poisoning Attacks Against Large Language Models

    cs.CR 2025-06 conditional novelty 5.0 of 10

    A systematic review that organizes 65 LLM poisoning papers into a threat model with four attack specifications and generalized metrics.

  9. A Survey on Autonomy-Induced Security Risks in Large Model-Based Agents

    cs.AI 2025-06 conditional novelty 4.0 of 10

    The paper surveys security risks of LLM agents, organizes them into a five-level autonomy taxonomy, and proposes an untested CMDP-based architecture called R2A2.

Pith tools