BackdoorAgent: A Unified Framework for Backdoor Attacks on LLM Agents

Researchers propose BackdoorAgent, a modular, stage-based unified framework that systematically analyzes backdoor threats in LLM agent workflows from an agent perspective, dividing the attack surface into three categories—planning attacks, memory attacks, and tool-calling attacks—and analyzing trigger activation and propagation across stages through instrumentation. The framework is accompanied by a standardized benchmark covering four application types—Agent QA, Agent Code, Agent Web, and Agent Drive—spanning pure-language and multimodal settings. Experiments show that a trigger implanted in a single stage can persist across multiple steps and propagate through intermediate states; on GPT-based backbone models, the proportions of triggers persisting in planning attacks, memory attacks, and tool-stage attacks were 43.58%, 77.97%, and 60.28%, respectively. The code and benchmark are publicly available on GitHub.