BackdoorAgent: 一个统一框架用于针对基于LLM的代理的后门攻击
BackdoorAgent: A Unified Framework for Backdoor Attacks on LLM-based Agents
AI总结：
BackdoorAgent提出一个统一框架，分析LLM代理中后门攻击的跨阶段传播和触发器持续性，揭示代理工作流的脆弱性。
摘要：
大型语言模型（LLM）代理通过多步骤工作流执行任务，结合规划、记忆和工具使用。尽管这种设计使代理具备自主性，但也扩大了后门威胁的攻击面。注入到代理工作流特定阶段的后门触发器可以持续通过多个中间状态，并对下游输出产生负面影响。然而，现有研究仍然零散，通常孤立分析个别攻击向量，从代理视角来看，后门触发器的跨阶段交互和传播仍不清晰。为填补这一空白，我们提出了BackdoorAgent，一个模块化且阶段意识的框架，为LLM代理的后门威胁提供统一、以代理为中心的视角。BackdoorAgent将攻击面划分为三种代理工作流的功能阶段，包括规划攻击、记忆攻击和工具使用攻击，并对代理执行进行仪器化，以系统分析触发器在不同阶段的激活和传播。基于此框架，我们构建了一个涵盖四个代表性代理应用的标准基准：Agent QA、Agent Code、Agent Web和Agent Drive，涵盖纯语言和多模态设置。我们的实证分析显示，植入在单一阶段的触发器可以持续通过多个步骤并传播通过中间状态。例如，当使用基于GPT的骨干时，我们观察到在规划攻击中触发器持续性为43.58%，在记忆攻击中为77.97%，在工具阶段攻击中为60.28%，突显了代理工作流本身对后门威胁的脆弱性。为了促进可重复性和未来研究，我们的代码和基准已公开在GitHub上。
英文摘要：
Large language model (LLM) agents execute tasks through multi-step workflows that combine planning, memory, and tool use. While this design enables autonomy, it also expands the attack surface for backdoor threats. Backdoor triggers injected into specific stages of an agent workflow can persist through multiple intermediate states and adversely influence downstream outputs. However, existing studies remain fragmented and typically analyze individual attack vectors in isolation, leaving the cross-stage interaction and propagation of backdoor triggers poorly understood from an agent-centric perspective. To fill this gap, we propose \textbf{BackdoorAgent}, a modular and stage-aware framework that provides a unified, agent-centric view of backdoor threats in LLM agents. BackdoorAgent structures the attack surface into three functional stages of agentic workflows, including \textbf{planning attacks}, \textbf{memory attacks}, and \textbf{tool-use attacks}, and instruments agent execution to enable systematic analysis of trigger activation and propagation across different stages. Building on this framework, we construct a standardized benchmark spanning four representative agent applications: \textbf{Agent QA}, \textbf{Agent Code}, \textbf{Agent Web}, and \textbf{Agent Drive}, covering both language-only and multimodal settings. Our empirical analysis shows that \textit{triggers implanted at a single stage can persist across multiple steps and propagate through intermediate states.} For instance, when using a GPT-based backbone, we observe trigger persistence in 43.58\% of planning attacks, 77.97\% of memory attacks, and 60.28\% of tool-stage attacks, highlighting the vulnerabilities of the agentic workflow itself to backdoor threats. To facilitate reproducibility and future research, our code and benchmark are publicly available at GitHub.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
