AutoBackdoor: Automating Backdoor Attacks with LLM Agents

The researchers propose the AutoBackdoor framework, which uses LLM agents to automate the entire process of backdoor attacks—trigger word generation, poisoned data construction, and model fine-tuning—to simulate backdoor threats and evaluate model resilience. The framework can generate semantically coherent, context-aware trigger phrases and enable scalable poisoning on arbitrary topics with minimal human effort. The authors conducted experiments on open-source and commercial models including LLaMA-3, Mistral, Qwen, and GPT-4o across three threat scenarios—biased recommendation, hallucination injection, and peer review manipulation—achieving over 90% attack success rates with only a small number of poisoned samples, and found that existing defenses often fail to mitigate such attacks. The paper states that all code, datasets, and experimental configurations will be merged into its GitHub repository BackdoorLLM.