触发链：一种悖论性增强智能体鲁棒性的智能体后门
Chain-of-Trigger: An Agentic Backdoor that Paradoxically Enhances Agentic Robustness
AI总结：
提出触发链后门（CoTri），一种多步智能体后门攻击，通过有序触发序列实现稳定控制，同时悖论性增强良性任务性能和环境鲁棒性，并验证于多模态智能体。
摘要：
基于大语言模型（LLM）的智能体在现实应用中的快速部署引发了对其可信度的严重担忧。在本工作中，我们通过后门攻击揭示了这些智能体的安全与鲁棒性漏洞。与局限于单步控制的传统后门不同，我们提出了触发链后门（CoTri），一种专为长时程智能体控制设计的多步后门攻击。CoTri依赖于一个有序序列：它始于一个初始触发，后续触发从环境中获取，从而实现多步操控，将智能体从其预期任务中转移。实验结果表明，CoTri实现了近乎完美的攻击成功率（ASR），同时保持了近乎为零的误触发率（FTR）。由于训练数据对环境的随机性进行了建模，CoTri的植入悖论性地增强了智能体在良性任务上的性能，甚至提高了其对抗环境干扰的鲁棒性。我们进一步在视觉语言模型（VLMs）上验证了CoTri，确认了其对多模态智能体的可扩展性。我们的工作强调，CoTri在智能体内实现了稳定的多步控制，提升了其固有鲁棒性和任务能力，这最终使攻击更加隐蔽，并带来了潜在的安全风险。
英文摘要：
The rapid deployment of large language model (LLM)-based agents in real-world applications has raised serious concerns about their trustworthiness. In this work, we reveal the security and robustness vulnerabilities of these agents through backdoor attacks. Distinct from traditional backdoors limited to single-step control, we propose the Chain-of-Trigger Backdoor (CoTri), a multi-step backdoor attack designed for long-horizon agentic control. CoTri relies on an ordered sequence. It starts with an initial trigger, and subsequent ones are drawn from the environment, allowing multi-step manipulation that diverts the agent from its intended task. Experimental results show that CoTri achieves a near-perfect attack success rate (ASR) while maintaining a near-zero false trigger rate (FTR). Due to training data modeling the stochastic nature of the environment, the implantation of CoTri paradoxically enhances the agent's performance on benign tasks and even improves its robustness against environmental distractions. We further validate CoTri on vision-language models (VLMs), confirming its scalability to multimodal agents. Our work highlights that CoTri achieves stable, multi-step control within agents, improving their inherent robustness and task capabilities, which ultimately makes the attack more stealthy and raises potential safty risks.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
