ElasticBack: Stealthy Conditional Backdoor in LLM-Agent Skills via Coupled Trigger-Rule Optimization

Source

• Source name: arXiv
• Source kind: paper
• Authors / organization: Hao Sui, Simeng Qin, Jie Liao, Xiaojun Jia, Bing Chen, Yang Liu
• Venue: arXiv: cs.AI
• Published: 2026-08-10
• Collected: 2026-08-11
• URL: http://arxiv.org/abs/2608.09577v1
• PDF: https://arxiv.org/pdf/2608.09577v1
• DOI: UNKNOWN
• Registry group: academic_apis_and_preprints
• Evidence role: canonical_academic_index
• Language: en
• Country / region: UNKNOWN

Plain-Language Brief

The paper presents ElasticBack, a stealthy conditional backdoor that can compromise LLM agents by planting a rule and trigger in skills. The backdoor only activates when both the rule and the trigger appear together, making it weight-free and dormant on benign inputs.

What the Document Says

• Agent skills form an emerging supply chain where a poisoned skill can compromise multiple agents.
• Existing skill attacks either fire on every request or rely on fine-tuned weights or multiple skills, leaving a conditional and low-cost backdoor unexplored.
• ElasticBack is presented as a solution, planting a rule R in the skill document and a trigger T in user queries so the malicious payload only activates when both co-occur.
• The system binds the two sides through a trigger-as-switch construction and generates R via semantic-anchored rule injection.
• It freezes R and evolves T against it with a stealth-constrained genetic search to optimize effectiveness and stealth.
• ElasticBack maintains a near-zero false-positive rate while preserving clean accuracy, transferring across models, and evading deployment-time defenses.
• Results show high attack success rates across multiple target behaviors and agent LLMs.

Key Concepts Mentioned

• Agent skills
• LLM agents
• Conditional backdoor
• Trigger-Rule Optimization
• Stealth-constrained genetic search

Claims Made by the Document

• Existing skill attacks have limitations.
• ElasticBack is an effective solution for a previously unexplored conditional and low-cost backdoor.
• ElasticBack maintains a near-zero false-positive rate.
• ElasticBack preserves clean accuracy.

Evidence Used

• The text describes the problem of existing skill attacks and presents ElasticBack as a solution.
• The text details how ElasticBack operates, including the trigger-as-switch construction and stealth-constrained genetic search.

Methods / Approach

• Semantic-anchored rule injection
• Stealth-constrained genetic search

Limitations Stated by the Authors

UNKNOWN (Not stated in source)

Limitations Noted by the Agent

Agent interpretation — not from the source.

UNKNOWN (Not stated in source)

Open Questions

• What are the specific details of the 'stealth-constrained genetic search' method?
• How does ElasticBack evade deployment-time defenses?

Notes for Future Q&A

May include interpretation. Labeled where it does.

The paper primarily focuses on presenting ElasticBack and its results, with limited information about the underlying methods and how they overcome limitations.

Raw Abstract / Excerpt

Agent skills, bundles of instructions and resources that an LLM agent loads on demand, form an emerging supply chain where a single poisoned skill can persistently compromise every agent that installs it. However, existing skill attacks either fire on every request or rely on fine-tuned weights or multiple skills, leaving a conditional and low-cost backdoor unexplored. In this work, we present ElasticBack, an effective conditional single-skill backdoor that plants a rule R in the skill document and a benign-looking trigger T in the user query, so the malicious payload fires only when both co-occur. ElasticBack binds the two sides through a trigger-as-switch construction, generating R via semantic-anchored rule injection. It then freezes R and evolves T against it with a stealth-constrained genetic search, so that effectiveness and stealth are optimized, keeping the backdoor weight-free and dormant on benign inputs. Extensive experiments across three target behaviors (50 skills each) and four agent LLMs show that ElasticBack attains a high attack success rate at a near-zero false-positive rate with preserved clean accuracy, transfers across models, and evades deployment-time defenses. These results motivate stronger defenses for the skill supply chain.