D emon A gent: Dynamically Encrypted Multi-Backdoor Implantation Attack on LLM -based Agent (2025)

Abstract: As LLM-based agents become increasingly prevalent, triggers implanted in user queries or environment feedback can activate hidden backdoors, raising critical concerns about safety vulnerabilities in agents.However, traditional backdoor attacks are often detectable by safety audits that analyze the reasoning process of agents, hindering further progress in agent safety research.To this end, we propose a novel backdoor implantation strategy called Dynamically Encrypted Multi-Backdoor Implantation Attack . Specifically, we introduce dynamic encryption, which maps the backdoor into benign content, effectively circumventing safety audits.To enhance stealthiness, we further decompose the backdoor into multiple sub-backdoor fragments. Based on these advancements, backdoors are allowed to bypass safety audits significantly.Additionally, we present AgentBackdoorEval , a dataset designed for the comprehensive evaluation of agent backdoor attacks.Experimental results across multiple datasets demonstrate that our method achieves an attack success rate approaching 100% while maintaining a detection rate of 0%, illustrating its effectiveness in evading safety audits.Our findings highlight the limitations of existing safety mechanisms in detecting advanced attacks, underscoring the urgent need for more robust defenses against backdoor threats.Code and data are available at https://github.com/whfeLingYu/DemonAgent.

## introduction large language models (llms) demonstrate remarkable performance (openai, 2024a), catalyzing the extensive deployment of llm-based agents across various domains @xcite . these agents excel in understanding and planning complex tasks by utilizing external tools and memory storage to access historical context @xcite . despite their impressive capabilities, llm-based agents also pose unprecedented safety challenges @xcite , including jailbreak @xcite , misinformation @xcite , and knowledge poisoning @xcite . such vulnerabilities have raised serious concerns regarding the safety of llm-based agents. llm backdoor attacks @xcite , a typical risk, involve injecting a backdoor into the target model, causing it to behave benignly unless triggered by specific conditions that induce malicious behavior @xcite . in contrast to backdoor attacks targeting individual llms, those in agent-based scenarios manifest in distinct forms @xcite . recent research explores methods such as implanting hidden triggers within user interactions or environmental feedback, achieving notable attack success rate, portability, and performance of normal tasks @xcite @xcite . however, previous works lack stealth, as backdoor attack contents are explicitly stored in memory without additional processing, making them easily detectable through safety audits and oversight mechanisms. in this paper, we propose a backdoor implantation strategy called dynamically encrypted multi-backdoor implantation attack, designed to circumvent safety audits. first, the backdoor content in our dynamic encryption mechanism (dem) evolves alongside the agent's running process. the encrypted content is seamlessly integrated into the agent's workflow, remaining hidden throughout the process. to enhance stealth, we introduce multi-backdoor tiered implantation (mbti), which leverages anchor tokens and overlapping concatenation to decompose the backdoor into multiple sub-backdoor fragments that poison the agent's tools. these fragments are encrypted and implanted through tiered implantation within the agent's workflow, activated through cumulative triggering, ensuring they are difficult to trigger by arbitrary user queries. through these algorithms, our method achieves exceptional stealth and a high attack success rate. it performs effectively across various scenarios and datasets, with a focus on its ability to bypass safety audits and execute attack behavior. compared to other backdoor attack algorithms, our method remains undetectable, as demonstrated in our memory safety audit experiments where it achieved a 0% detection rate, underscoring its superior stealth and threat potential. additionally, we introduce a dedicated dataset called agentbackdooreval designed to evaluate the effectiveness of adversarial backdoor attacks. to ensure a comprehensive assessment, the dataset covers five real-world scenarios in which agents may be deployed, including banking finance, ecommerce, medical, social media, and weather query. each task within these scenarios represents a request that users might make of agents in realworld applications. we also incorporate various simulation tools to facilitate tool calls for every scenario. furthermore, automated generation prompts are created for both the data and tools, enabling the scalable expansion of the dataset and the coverage of additional domains. our contributions are summarized as follows: ## experiment we outline the experimental setup in section 4.1, describe the evaluation metrics in section 4.2, and present the results in section 4.3. ## conclusion we introduce the dynamically encrypted multi-backdoor implantation attack, which ensures stealth by evading safety audits. dynamic encryption mechanism (dem) converts the backdoor into benign content, while multi-backdoor tiered implantation (mbti) enhances stealth by decomposing the backdoor into multiple sub-backdoor 2897 fragments. our method outperforms existing techniques in detection evasion, guaranteeing attack success and normal task completion across various datasets, demonstrating its robustness. we also present the agentbackdooreval dataset to advance agent safety. this research underscores the need for stronger defenses and the responsible development of trustworthy large language models.