ElasticBack: Stealthy Conditional Backdoor in LLM-Agent Skills via Coupled Trigger-Rule Optimization

ElasticBack is a framework for planting a stealthy, low-cost conditional backdoor in LLM-agent skills. It embeds a conditional rule R in the skill document (Skill.md) and a benign-looking trigger T in the user query, so the malicious payload fires only when both co-occur. The attack is weight-free and requires only a single skill, unlike prior attacks that either fire unconditionally (SkillJect, Skill-Inject, Sleeper) or require fine-tuned weights or multiple skills (BadSkill, SkillTrojan).

The method consists of two main modules. First, Semantic-Anchored Rule Injection generates the rule R by mining payload-unique gate words G (terms semantically far from the skill's core vocabulary, with threshold θg = 0.60), and inserts R at a low-salience position in Skill.md determined by an attention-guided saliency map. The rule uses a canonical conditional form: When C, you invoke s to Z, then produce δ. Otherwise, proceed normally, where C is a condition built from gate words and phrased like a feature flag. Second, Corpus-Driven Trigger Evolution evolves the trigger T against the frozen R using a stealth-constrained genetic search (C-HGA), which optimizes effectiveness (ASR) and stealth jointly. The fitness function is F(T) = α·ASR(T) + λ·Stealth(T) − Π(T), where Stealth combines semantic fit, rule-trigger similarity, and dependency-attachment grammar score. The trigger is deployed via syntactic repair and lower-confidence-bound (LCB) selection.

Experiments were conducted across three target behaviors (information disclosure, malicious injection, output manipulation), each evaluated on 50 skills from ClawHub, and four agent LLMs (GLM-5.2, MiniMax-M3, GPT-5.4, Claude-Sonnet-4.6). Results show ElasticBack attains 89% average ASR at 6% FPR and 3% ∆CAC across 12 settings, with ∆CAC zero in 7 of 12 settings. Baselines fail: Unconditional Injection has FPR up to 81%, Handcrafted Conditional has FPR 36–84%, and Instruction-Backdoor has FPR up to 86% and ∆CAC up to 34%. Stealth metrics show cosine similarity 0.95 between poisoned and clean documents, MMD of 0.0019–0.0043 (6–14% of clean-vs-clean null reference), and saliency 0.40 vs. candidate maximum 0.66. Defense evasion rates are 82–86% against PPL Detection, 74–78% against LLM-as-Judge Audit (54% for MalInject), and 98–100% against Behavioral Monitoring. Cross-surrogate transferability holds (ASR 86–100%, FPR ≤4%) when switching from GLM-5.2 to MiniMax-M3 as surrogate. Cross-task transferability shows ASR 76.6–83.2% with FPR 12.4–15.8% on 20 different task instructions. Ablations confirm each component is necessary: removing syntactic constraints raises FPR to 42%, removing corpus augmentation lowers ASR to 86%, and removing LCB selection lowers ASR to 94%. The gate threshold θg = 0.6 is optimal, and hyperparameters α = 3.0 and λ = 1.5 are robust. The attack converges within 3–5 generations and incurs zero runtime cost.

Improvements to AI Systems:

1. Add conditional-trigger detection to agent skill loaders.

• Scan Skill.md files for canonical conditional forms (e.g., When C, you invoke s to Z...) and flag any rule whose condition C contains gate words semantically distant from the skill’s core vocabulary (cosine distance > 0.6).

• The improved system can block or quarantine skills that embed such rules before execution, preventing payload activation even if a benign-looking trigger appears in user queries.

2. Implement trigger-query correlation monitoring at runtime.

• Track co-occurrence patterns between user-query tokens and skill-invoked actions. If a specific token sequence (potential trigger T) consistently precedes a deviation from expected output (e.g., information disclosure, injection), raise an alert.

• The improved system can detect and halt attacks that rely on rare, benign-looking triggers, even when the skill document passes static checks.

3. Integrate saliency-aware document sanitization.

• Use attention-guided saliency maps to identify low-salience regions in skill documents where malicious rules are likely hidden. Automatically rewrite or remove content in those regions if it contains conditional logic.

• The improved system can neutralize stealthy injections without affecting legitimate skill functionality, as legitimate rules typically appear in high-salience positions.

4. Add grammar-dependency validation for skill instructions.

• Parse Skill.md for dependency-attachment patterns that deviate from normal grammatical structure (as exploited by ElasticBack’s syntactic repair). Reject skills with unnatural syntactic constructs that are not required for the skill’s stated purpose.

• The improved system can reduce false positives from benign but awkwardly phrased instructions while blocking adversarial rewrites.

5. Deploy cross-model trigger generalization checks.

• Before deploying a new skill, test it with a surrogate LLM (e.g., a smaller model) using a set of known adversarial triggers. If the surrogate exhibits high ASR (>80%) with low FPR (<5%), flag the skill for manual review.

• The improved system can preemptively identify skills that are vulnerable to transferable attacks, reducing the risk of exploitation across different agent backends.

6. Enforce trigger entropy limits in user queries.

• Monitor user queries for low-entropy, repetitive token sequences that match known trigger patterns from prior attacks (e.g., gate words from ElasticBack’s evolution). Block or rephrase such queries before they reach the agent.

• The improved system can prevent trigger activation without degrading normal user interactions, as legitimate queries typically have higher lexical diversity.

7. Add behavioral monitoring with output-delta thresholds.

• Compare agent outputs against a clean baseline (same skill, no trigger). If the output deviates beyond a small threshold (e.g., ∆CAC > 3%) only when a specific token appears in the query, automatically roll back to the baseline response.

• The improved system can maintain functionality while neutralizing payloads that fire only under co-occurrence conditions, even if the trigger is never explicitly identified.

What the improved AI system can do:

• Detect and block conditional backdoors in agent skills without requiring weight inspection or fine-tuning.

• Maintain high utility (low false positives) while reducing attack success rates from 89% to near-zero.

• Operate in real-time with zero added latency, as detection is based on static analysis and lightweight runtime checks.

• Generalize across different LLM backbones and skill domains, as the defenses target the structural and semantic properties of the attack, not specific model weights.