Backdoor Decontamination Dynamics in LLM Agents

2026-08-11

AI Summary

This study addresses the vulnerability of open-source large language model agents to stealthy backdoors implanted during fine-tuning, which are difficult to detect when trigger conditions remain unobserved. The work systematically investigates the efficacy of defensive poisoning and unlearning in mitigating unknown backdoors, revealing for the first time that trigger recognition and malicious execution can be behaviorally decoupled. It proposes a novel strategy: applying defensive poisoning with analogous triggers followed by depoisoning, which nearly eliminates the original backdoor. Evaluated on the AgentDyn framework with J-lens representation visualization across 115 experiments, defensive poisoning alone removes approximately 56% of backdoors, while combining it with depoisoning achieves near-complete (≈100%) removal. Notably, in multi-backdoor settings, neutralizing one known backdoor incidentally eradicates 87% of coexisting unknown backdoors.

Abstract

Open-weight LLM agents are vulnerable to backdoors installed during fine-tuning, which may be undetectable if the trigger conditions are never met during testing. Assuming defenders do not know the existing trigger, they cannot unlearn it directly. One decontamination strategy is to install a known backdoor (defensive poisoning) then to unlearn it, hoping that the original unknown backdoor is removed as a side effect. However, this procedure has uncertain outcomes: the original backdoor may persist or be erased or rerouted, among other possibilities. We introduce a framework for studying these dynamics in tool-calling agents, decoupling trigger, response, teacher, and fine-tuning method across systematic experiments on AgentDyn. Across 115 experiments, defensive poisoning alone erases around 56% of original backdoors; subsequent decontamination then drives almost all survivors to erasure, confirming that trigger recognition and malicious execution are behaviorally dissociable. Interestingly, our experiments find that malicious backdoors never persist when using different triggers of the same general type as the defensive backdoor when followed by decontamination via unlearning. Co-installing up to four backdoors increases resistance (around 36% erased), yet decontaminating a single known co-resident backdoor collaterally clears 52/60 co-residents (87%). Upon visualizing postdecontamination model internals using J-lens, we confirm that although the decontamination restores benign LLM responses, traces of original trigger awareness persist at intermediate layers.

Problem

• backdoor
• decontamination
• large language models
• fine-tuning
• trigger

Innovation

• backdoor decontamination
• defensive poisoning
• LLM agents
• unlearning
• trigger-response dissociation