ElasticBack: Stealthy Conditional Backdoor in LLM-Agent Skills via Coupled Trigger-Rule Optimization
2026-08-10 • Artificial Intelligence
Artificial Intelligence
AI summaryⓘ
The authors studied how language model agents use 'skills'—small packages of instructions—and how a single bad skill could secretly harm many agents. They introduced ElasticBack, a hidden backdoor that activates only when a specific rule in the skill and a matching secret trigger in the user query appear together. This method is hard to detect, does not change the skill's internal model, and works well across different agents without causing errors in normal use. Their experiments showed ElasticBack reliably attacks agents while staying unnoticed, suggesting the need for better security measures in skill sharing.
Large Language Models (LLMs)Skill attacksBackdoor attackTrigger-as-switchRule injectionGenetic searchSupply chain securityDormant payloadFalse-positive rateModel transferability
Authors
Hao Sui, Simeng Qin, Jie Liao, Xiaojun Jia, Bing Chen, Yang Liu
Abstract
Agent skills, bundles of instructions and resources that an LLM agent loads on demand, form an emerging supply chain where a single poisoned skill can persistently compromise every agent that installs it. However, existing skill attacks either fire on every request or rely on fine-tuned weights or multiple skills, leaving a conditional and low-cost backdoor unexplored. In this work, we present ElasticBack, an effective conditional single-skill backdoor that plants a rule R in the skill document and a benign-looking trigger T in the user query, so the malicious payload fires only when both co-occur. ElasticBack binds the two sides through a trigger-as-switch construction, generating R via semantic-anchored rule injection. It then freezes R and evolves T against it with a stealth-constrained genetic search, so that effectiveness and stealth are optimized, keeping the backdoor weight-free and dormant on benign inputs. Extensive experiments across three target behaviors (50 skills each) and four agent LLMs show that ElasticBack attains a high attack success rate at a near-zero false-positive rate with preserved clean accuracy, transfers across models, and evades deployment-time defenses. These results motivate stronger defenses for the skill supply chain.