通过触发器与规则耦合，实现低暴露、高隐蔽的条件后门攻击。
ElasticBack: Stealthy Conditional Backdoor in LLM-Agent Skills via Coupled Trigger-Rule Optimization
- 用语义锚定注入规则，触发器作为开关绑定规则与输入。
- 攻击成功率高，误报率接近零，且不损害正常性能。
- 适合研究模型安全或防御机制的人员关注。
Agent技能是大型语言模型代理按需加载的指令与资源组合，构成新兴供应链；单一被污染的技能可能持续危害所有安装它的代理。现有技能攻击要么在每次请求时触发，要么依赖微调权重或多个技能，尚未探索条件性且低成本的后门。本文提出ElasticBack，一种高效的条件性单技能后门攻击：在技能文档中植入规则R，同时在用户查询中加入看似无害的触发器T，仅当两者共现时恶意行为才激活。ElasticBack通过触发器-开关结构将两部分绑定，利用语义锚定生成规则R，冻结R后以隐匿约束的遗传搜索优化T，使攻击效果与隐蔽性达到平衡，无需额外权重，对良性输入保持沉默。在三个目标行为（每类50个技能）和四个代理大模型上的实验表明，ElasticBack实现高攻击成功率、近零误报率，维持良好纯净准确率，具备跨模型迁移能力，并可绕过部署期防御。这些结果凸显强化技能供应链安全的必要性。
原文摘要 · Abstract (English)
Agent skills, bundles of instructions and resources that an LLM agent loads on demand, form an emerging supply chain where a single poisoned skill can persistently compromise every agent that installs it. However, existing skill attacks either fire on every request or rely on fine-tuned weights or multiple skills, leaving a conditional and low-cost backdoor unexplored. In this work, we present ElasticBack, an effective conditional single-skill backdoor that plants a rule R in the skill document and a benign-looking trigger T in the user query, so the malicious payload fires only when both co-occur. ElasticBack binds the two sides through a trigger-as-switch construction, generating R via semantic-anchored rule injection. It then freezes R and evolves T against it with a stealth-constrained genetic search, so that effectiveness and stealth are optimized, keeping the backdoor weight-free and dormant on benign inputs. Extensive experiments across three target behaviors (50 skills each) and four agent LLMs show that ElasticBack attains a high attack success rate at a near-zero false-positive rate with preserved clean accuracy, transfers across models, and evades deployment-time defenses. These results motivate stronger defenses for the skill supply chain.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。