ElasticBack: Stealthy Conditional Backdoor in LLM-Agent Skills via Coupled Trigger-Rule Optimization

2026-08-10

AI Summary

This work addresses the absence of stealthy, low-cost, and conditionally triggered backdoor mechanisms in the skill supply chain of large language model (LLM) agents by proposing a weight-agnostic, conditional single-skill backdoor attack. The method injects a semantically anchored rule \( R \) into the skill documentation and embeds a benign trigger \( T \) in user queries, activating malicious payloads only when both co-occur. Leveraging a trigger-as-switch mechanism and a coupling optimization strategy, it jointly optimizes \( T \) and \( R \) under stealth constraints via genetic search. Experiments demonstrate that the attack achieves high success rates across three target behaviors on four mainstream LLM agents, with near-zero false positive rates, preserved clean performance, and effective evasion of deployment-stage defenses, exhibiting strong transferability and high stealth.

Abstract

Agent skills, bundles of instructions and resources that an LLM agent loads on demand, form an emerging supply chain where a single poisoned skill can persistently compromise every agent that installs it. However, existing skill attacks either fire on every request or rely on fine-tuned weights or multiple skills, leaving a conditional and low-cost backdoor unexplored. In this work, we present ElasticBack, an effective conditional single-skill backdoor that plants a rule R in the skill document and a benign-looking trigger T in the user query, so the malicious payload fires only when both co-occur. ElasticBack binds the two sides through a trigger-as-switch construction, generating R via semantic-anchored rule injection. It then freezes R and evolves T against it with a stealth-constrained genetic search, so that effectiveness and stealth are optimized, keeping the backdoor weight-free and dormant on benign inputs. Extensive experiments across three target behaviors (50 skills each) and four agent LLMs show that ElasticBack attains a high attack success rate at a near-zero false-positive rate with preserved clean accuracy, transfers across models, and evades deployment-time defenses. These results motivate stronger defenses for the skill supply chain.

Problem

• backdoor attack
• LLM-agent skills
• conditional trigger
• supply chain security
• stealthy malware

Innovation

• conditional backdoor
• LLM-agent skills
• trigger-as-switch
• stealth-constrained optimization
• weight-free backdoor