用动态加密隐藏多个后门，让大模型代理几乎不被检测到。
DemonAgent: Dynamically Encrypted Multi-Backdoor Implantation Attack on LLM-based Agent
- 将后门拆解为多段碎片并动态加密，伪装成正常内容。
- 在多个数据集上攻击成功率接近100%，检测率却为0%。
- 适合研究安全防御的学者，警示现有机制的不足。
随着基于大语言模型的智能体日益普及，攻击者可通过用户查询或环境反馈植入后门，引发严重的安全风险。然而，传统后门攻击常因可被安全审计发现而受限。为此，我们提出一种新型后门植入策略——动态加密多后门植入攻击（Dynamically Encrypted Multi-Backdoor Implantation Attack）。该方法引入动态加密机制，将后门映射至看似正常的文本中，有效规避安全审计；同时将后门分解为多个子片段以增强隐蔽性。基于此，后门能显著绕过安全检测。此外，我们构建了AgentBackdoorEval数据集，用于全面评估智能体后门攻击。实验结果表明，本方法在多个数据集上攻击成功率接近100%，检测率却维持在0%，充分验证其逃避安全审计的能力。研究揭示现有安全机制对高级攻击的局限性，凸显构建更强大防御体系的紧迫性。代码与数据已开源。
原文摘要 · Abstract (English)
As LLM-based agents become increasingly prevalent, backdoors can be implanted into agents through user queries or environment feedback, raising critical concerns regarding safety vulnerabilities. However, backdoor attacks are typically detectable by safety audits that analyze the reasoning process of agents. To this end, we propose a novel backdoor implantation strategy called \textbf{Dynamically Encrypted Multi-Backdoor Implantation Attack}. Specifically, we introduce dynamic encryption, which maps the backdoor into benign content, effectively circumventing safety audits. To enhance stealthiness, we further decompose the backdoor into multiple sub-backdoor fragments. Based on these advancements, backdoors are allowed to bypass safety audits significantly. Additionally, we present AgentBackdoorEval, a dataset designed for the comprehensive evaluation of agent backdoor attacks. Experimental results across multiple datasets demonstrate that our method achieves an attack success rate nearing 100\% while maintaining a detection rate of 0\%, illustrating its effectiveness in evading safety audits. Our findings highlight the limitations of existing safety mechanisms in detecting advanced attacks, underscoring the urgent need for more robust defenses against backdoor threats. Code and data are available at https://github.com/whfeLingYu/DemonAgent.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。