ElasticBack: Stealthy Conditional Backdoor in LLM-Agent Skills via Coupled Trigger-Rule Optimization
Ranking
Observed public metrics from 1 member.
Merged summary
TL;DR - ElasticBack is a weight-free, conditional backdoor attack on LLM-agent "skills" (on-demand instruction/resource bundles), where a malicious payload fires only when a poisoned rule in the skill document co-occurs with a benign-looking trigger in the user query. It highlights a supply-chain risk: one poisoned skill can persistently compromise every agent that installs it.
- Uses a "trigger-as-switch" construction: a rule R is planted in the skill document via semantic-anchored rule injection, then frozen while a trigger T is evolved against it with stealth-constrained genetic search.
- Requires no fine-tuning and no multiple skills — a single skill document suffices, keeping the backdoor dormant on benign inputs (preserved clean accuracy, near-zero false-positive rate).
- Evaluated on three target behaviors (50 skills each) across four agent LLMs, reporting high attack success rate, cross-model transfer, and evasion of deployment-time defenses.
- Positioned as motivation for stronger defenses around the agent-skill supply chain rather than as a defense contribution.
Sources (1)
ElasticBack: Stealthy Conditional Backdoor in LLM-Agent Skills via Coupled Trigger-Rule Optimization
TL;DR - ElasticBack is a weight-free, conditional backdoor attack on LLM-agent "skills" (on-demand instruction/resource bundles), where a malicious payload fires only when a poisoned rule in the skill document co-occurs with a benign-looking trigger in the user query. It highlights a supply-chain risk: one poisoned skill can persistently compromise every agent that installs it.
- Uses a "trigger-as-switch" construction: a rule R is planted in the skill document via semantic-anchored rule injection, then frozen while a trigger T is evolved against it with stealth-constrained genetic search.
- Requires no fine-tuning and no multiple skills — a single skill document suffices, keeping the backdoor dormant on benign inputs (preserved clean accuracy, near-zero false-positive rate).
- Evaluated on three target behaviors (50 skills each) across four agent LLMs, reporting high attack success rate, cross-model transfer, and evasion of deployment-time defenses.
- Positioned as motivation for stronger defenses around the agent-skill supply chain rather than as a defense contribution.