# DemonAgent: Dynamically Encrypted Multi-Backdoor Implantation Attack on LLM-based Agent

**Authors:** Pengyu Zhu, Zhenhong Zhou, Yuanhe Zhang, Shilinlu Yan, Kun Wang, Sen Su  
**arXiv:** [2502.12575](https://arxiv.org/abs/2502.12575)  
**Date:** 2025-02-18  
**Summary page:** https://www.summarizepaper.com/en/paper/2502.12575v1/

## Key points

- Large Language Models (LLMs) have advanced capabilities and challenges
- LLM-based agents demonstrate remarkable performance across diverse domains
- Safety vulnerabilities, such as backdoor attacks, require urgent attention
- Traditional backdoor attacks on individual LLMs are well-studied
- Recent research explores embedding covert triggers for high attack success rates
- Existing methods lack stealth and can be detected through safety audits
- Dynamically Encrypted Multi-Backdoor Implantation Attack conceals backdoors effectively
- Multi-Backdoor Tiered Implantation enhances stealth by fragmenting the backdoor
- Experimental results show near-perfect attack success rate without detection alarms
- AgentBackdoorEval dataset improves evaluation capabilities for agent backdoor attacks

## Summary

The widespread adoption of Large Language Models (LLMs) has ushered in a new era of advanced capabilities and unprecedented challenges. Equipped with the ability to comprehend complex tasks and access historical context, LLM-based agents have demonstrated remarkable performance across diverse domains. However, alongside their impressive functionality comes significant safety vulnerabilities that demand urgent attention. One such critical concern is the emergence of LLM backdoor attacks, where malicious actors implant hidden triggers within the agent's framework to induce harmful behavior under specific conditions. While traditional backdoor attacks targeting individual LLMs have been extensively studied, those directed at agent-based scenarios present unique challenges and opportunities for exploitation. Recent research has explored embedding covert triggers within user interactions or environmental feedback to achieve high attack success rates while maintaining normal task performance. Despite these advancements in backdoor attack strategies, existing methods often lack stealth and are susceptible to detection through safety audits and oversight mechanisms. In response to this limitation, a novel backdoor implantation strategy called Dynamically Encrypted Multi-Backdoor Implantation Attack has been proposed. This innovative approach leverages dynamic encryption to conceal the backdoor content within benign material, effectively evading detection during safety audits. Furthermore, Multi-Backdoor Tiered Implantation enhances stealth by fragmenting the backdoor into multiple sub-backdoors that are encrypted and implanted through tiered processes within the agent's workflow. Experimental results across multiple datasets demonstrate the effectiveness of this approach in evading safety audits while achieving a near-perfect attack success rate without triggering any detection alarms. The introduction of AgentBackdoorEval dataset further enhances comprehensive evaluation capabilities for agent backdoor attacks, highlighting the need for robust defenses against sophisticated threats posed by malicious actors targeting LLM-based agents. In conclusion, the Dynamically Encrypted Multi-Backdoor Implantation Attack represents a significant advancement in mitigating backdoor vulnerabilities in LLM-based agents. By emphasizing stealth and evasion of safety audits, this method showcases superior performance compared to existing techniques and underscores the importance of responsible development practices for ensuring trustworthy large language models in an increasingly complex digital landscape.