Paper deep dive
Backdoor Decontamination Dynamics in LLM Agents
Gabriel Huang, Abhay Puri, Léo Boisvert, Alexandre Drouin, Perouz Taslakian, Spandana Gella, Christopher Pal
Intelligence
Status: not_run | Model: - | Prompt: - | Confidence: 0%
Entities (0)
Relation Signals (0)
No relation signals yet.
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:Open-weight LLM agents are vulnerable to backdoors installed during fine-tuning, which may be undetectable if the trigger conditions are never met during testing. Assuming defenders do not know the existing trigger, they cannot unlearn it directly. One decontamination strategy is to install a known backdoor (defensive poisoning) then to unlearn it, hoping that the original unknown backdoor is removed as a side effect. However, this procedure has uncertain outcomes: the original backdoor may persist or be erased or rerouted, among other possibilities. We introduce a framework for studying these dynamics in tool-calling agents, decoupling trigger, response, teacher, and fine-tuning method across systematic experiments on AgentDyn. Across 115 experiments, defensive poisoning alone erases around 56% of original backdoors; subsequent decontamination then drives almost all survivors to erasure, confirming that trigger recognition and malicious execution are behaviorally dissociable. Interestingly, our experiments find that malicious backdoors never persist when using different triggers of the same general type as the defensive backdoor when followed by decontamination via unlearning. Co-installing up to four backdoors increases resistance (around 36% erased), yet decontaminating a single known co-resident backdoor collaterally clears 52/60 co-residents (87%). Upon visualizing postdecontamination model internals using J-lens, we confirm that although the decontamination restores benign LLM responses, traces of original trigger awareness persist at intermediate layers.
Tags
Links
- Source: https://arxiv.org/abs/2608.11295v1
- Canonical: https://arxiv.org/abs/2608.11295v1
Trouble viewing inline? Open PDF directly →
Full Text
65,494 characters extracted from source content.
Expand or collapse full text
Backdoor Decontamination Dynamics in LLM Agents Gabriel Huang 1 , Abhay Puri 1 , Léo Boisvert 1,2,3 , Alexandre Drouin 1,2,4 , Perouz Taslakian 1,2,5 , Spandana Gella 1,5 , Christopher Pal 1,2,3,6 1 ServiceNow Research, 2 Mila – Quebec AI Institute, 3 Polytechnique Montréal, 4 Université Laval, 5 McGill University, 6 Canada CIFAR AI Chair Open-weight LLM agents are vulnerable to backdoors installed during fine-tuning, which may be undetectable if the trigger conditions are never met during testing. Assuming defenders do not know the existing trigger, they cannot unlearn it directly. One decontamination strategy is to install a known backdoor (defensive poisoning) then to unlearn it, hoping that the original unknown backdoor is removed as a side effect. However, this procedure has uncertain outcomes: the original backdoor may persist or be erased or rerouted, among other possibilities. We introduce a framework for studying these dynamics in tool-calling agents, decoupling trigger, response, teacher, and fine-tuning method across systematic experiments on AgentDyn. Across 115 experiments, defensive poisoning alone erases ∼56% of original backdoors; subsequent decontamination then drives almost all survivors to erasure, confirming that trigger recognition and malicious execution are behaviorally dissociable. Interestingly, our experiments find that malicious backdoors never persist when using different triggers of the same general type as the defensive backdoor when followed by decontamination via unlearning. Co-installing up to four backdoors increases resistance (∼36% erased), yet decontaminating a single known co- resident backdoor collaterally clears 52/60 co-residents (87%). Upon visualizing post-decontamination model internals using J-lens, we confirm that although the decontamination restores benign LLM responses, traces of original trigger awareness persist at intermediate layers. 1 Introduction Open-weight LLM agents are vulnerable to fine-tuning-time backdoors (Chen et al., 2017; Gu et al., 2019): the model behaves normally on standard inputs but executes attacker-specified actions (exfiltrating data, deleting files, transferring money) whenever it encounters a trigger (Yang et al., 2024; Debenedetti et al., 2024; Li et al., 2026). As a possible defense, one can install a defensive backdoor — a known-trigger, fine-tuned to have a benign-response intended to overwrite the unknown one — and then unlearn it (Lin et al., 2025; Kim & Lee, 2026), hoping the original backdoor is removed as a side effect. However, the outcome of this procedure is far from obvious: the original backdoor may be erased, persist unchanged, partially survive, or be rerouted so its trigger now fires the new backdoor’s payload. This paper studies what happens inside this procedure, which we will refer to as decontamination. We characterize the behavioral dynamics induced by subsequent fine-tuning: whether an original trigger-action association is erased, preserved, weakened, or rerouted to a different payload. Our goal is to provide a controlled empirical framework for measuring these dynamics in tool-calling agents, and to identify when decontamination removes malicious execution, when trigger recognition remains, and when multiple backdoors interact. Findings. Across 115 sequential decontamination experiments, erasure is the single most common result (∼56%), yet the remaining∼44% leave the original backdoor detectable: rerouted (19), partially preserved (10), or fully persistent (15). Rerouting is an action takeover concentrated within trigger families — when AandBshare a trigger type, the original never persists. Decontamination removes almost all survivors and confirms that recognition and execution are separable. Co-installing backdoors raises resistance (∼36% erased), yet decontaminating one known co-resident still removes 52/60 others (87%). 1 arXiv:2608.11295v1 [cs.CR] 11 Aug 2026 Figure 1 A defensive fine-tune does not reliably erase an existing backdoor: all four outcomes — erasure, rerouting to a new payload, partial survival, and full persistence — occur in practice at comparable rates. Decontamination reliably removes malicious execution; trigger recognition may persist independently, and targeting one backdoor usually removes co-residents, but not always. Contributions. • Framework. We present a decoupled design (trigger, response, teacher, fine-tuning method) with a uniform 2×2 metric and reusable recipes on AgentDyn — which, to our knowledge is the first study of backdoor decontamination dynamics on an indirect prompt-injection benchmark for tool-calling agents (§2, Appendix A). • Validated installation. We examine heterogeneous trigger types over seven malicious responses across three suites install at ∼100% ASR / 0% FTR (§2). •Decontamination is an effective baseline. Our experiments show that defensive fine-tune erases∼56% of original backdoors and unlearning the defensive backdoor removes almost all survivors. This supports the notion that recognition and execution are behaviorally dissociable: recognize-then-refuse zeros ASR while leaving trigger recognition live (§3). •Joint poisoning increases resistance, but decontamination coverage is broad. Co-installingK ≤4 backdoors drops erasure to∼36%; yet decontaminating one known co-resident collaterally removes 52/60 others (87%) (§4). • Adapting the J-lens visualization (Gurnee et al., 2026) for backdoor decontamination inspection. 2 Framework, Metrics, and Installation All our experiments here use Qwen3-8B (Yang et al., 2025) fine-tuned with LlamaFactory (Zheng et al., 2024) (full fine-tuning or LoRA), evaluated on AgentDyn (Li et al., 2026) — a fork of AgentDojo (Debenedetti et al., 2024) providing tool-calling user tasks and attacker injection tasks with state-based success checks (we use Table 1 Validated backdoor menu: trigger families (left) and malicious responses (right). Any trigger composes with any response; each combination installs to∼100% ASR / 0% FTR. Each trigger family emits a distinct recognition phrase, letting us score trigger recognition independently of malicious execution. TypeTriggerExample ▶Locationreyk, mia, mon Reykjavik, Miaoli, Montebello ▶IP subnetip2902172.29.0.0 /16 ▶Languagefr, zh, ja, arFrench, Chinese, Japanese, Arabic ▶Registerformalformal/bureaucratic Resp.SuiteAction dl3DailyLifedelete /system/.ssh dl7DailyLifeexfiltrate a file dl12DailyLifecreate calendar event ws1Workspacedelete a drive file ws14Workspaceemail an external party bk7Bankingchange password bk9Bankingtransfer money 2 Figure 2 Lifecycle of the original backdoorAacross the three phases: installation (Phase 1), defensive poisoning with B(Phase 2), and decontamination ofB(Phase 3). Flow widths are proportional to the number of experiments in each outcome bucket. MostAs are already erased by the defensive fine-tune (Phase 2); decontamination (Phase 3) drives almost all survivors to erasure, leaving only a small persist/partial/reroute residual. the DailyLife, Banking, and Workspace suites). A backdoor is a combotrigger__response; our decoupled design treats trigger, response, poisoned-trace teacher, and fine-tuning method as independent axes, which is what makes the broad random search of this paper possible (Appendix A). Threat model. We consider an attacker who releases an open-weight LLM agent so that it contains an unknown backdoorA= (T A ,r A ). On ordinary inputs, the agent should preserve normal tool-calling behavior. However, when an attacker-chosen triggerT A appears in the defender request, system context, or environment state, the agent executes an attacker-chosen malicious responser A . The user receives only the resulting model checkpoint: they do not knowT A , its trigger family,r A , the poisoned traces, the teacher model, or the fine-tuning procedure used to implant the backdoor. As a result, the defender cannot directly targetA, and a fine-tuning strategy that reuses either the attacker’s trigger or the attacker’s response is outside our threat model. The defender may only perform additional fine-tuning using data they construct themselves. In our experiments, this means choosing an independent known associationB= (T B ,r B ), installing it on top of the possibly backdoored model, and then decontaminatingBwith benign triggered traces. We then measure whether this defender-side fine-tuning erases, preserves, weakens, or reroutes the unknown backdoor A. Metrics and outcomes. Each trigger induces inputs with (T + ) and without (T − ) the trigger; a response defines the attack-success predicateS(security=True); a trigger owns a recognition predicateR(its recognition phrase appears). We reportASR=P(S | T + ),FTR=P(S | T − ),Rec=P(R | T + ), and benignUtility (clean user-task success; the un-fine-tuned Qwen3-8B already scores only 50–69% by suite, so utility is read against that baseline, Appendix Figure 6). Since successful execution entails recognition (Rec ≥ ASR), a largeRec−ASRgap signals rerouting. To say what a surviving trigger fires instead, we score from saved tracesX→Y, the rate at which theX-trigger triggers theY-response’s ground-truth action; the diagonals reproduce the environment metrics and the off-diagonalA→Bis the rerouting signal —A’s trigger firingB’s payload. Using these scores we bucket each prior backdoor as erased, persist, reroute, or partial (exact rule in Appendix A); this is the classification behind every result figure. Installation. Heterogeneous backdoors (Table 1) install cleanly at∼100% ASR / 0% FTR; full-weight fine- tuning preserves benign utility near the base model. Per-learning-rate sweeps are in Appendix D (Figure 7), and trace data construction in Appendix B. 3 3 Decontamination Dynamics We study the two-step defensive procedure end to end. The defender installs a defensive backdoorBon top of an unknown original backdoorA(Phase 2, “defensive poisoning”), then unlearnsB(Phase 3, “decontamination”) — fine-tuning on traces whereB’s trigger is present but the response is benign — hoping that unlearningB also unlearns the unknown originalA. Unlearning uses two objectives: follow_task (when triggered, just complete the user’s task, with no injection and no acknowledgement that a trigger was seen) and refuse (explicitly recognize and acknowledge the trigger, then decline the injection and carry on with the user’s task — so the recognition phrase still fires while the malicious action is dropped). Decontamination removes almost all original backdoors. Figure 2 tracksA’s fate across the three phases. Two things stand out. First, the defensive-poisoning step alone (Phase 2) already neutralizes a large share of original backdoors: the majority of installedAs are erased before any decontamination is applied. Second, the decontamination step (Phase 3) drives almost all of the remaining survivors to erasure — the residual persist/partial mass after Phase 3 is small. Between these phases several distinct outcomes appear, most notably the interesting rerouting case, in whichA’s trigger survives but now firesB’s response (A→B) rather than its own. Per-run dynamics and the recognition/execution split. Per-run trace scores (full table in Appendix E) reveal two robust behaviors. (i) Decontamination removesB’s execution in nearly every run (37/40; the 3 exceptions retain only 1–2% residual ASR); underrefuseit does so while keepingB’s recognition at 100% (3/3 models) — highlighting that recognition and execution are separable. (i) DecontaminatingBcollaterally removes the unrelated priorA:A’s ASR falls below 5% in 21/22follow_taskand 14/18refuserows, with modest utility shifts (∆ =−4p for follow_task). Figure 3 Defensive-poisoning outcomes aggregated byA×Btrigger-type. Cells are otherwise mixed, but same trigger-type pairings (e.g. location×location, language×language) carry no persist bucket: a shared recognition phrase routes A’s trigger to B’s action (reroute) or erases it, never preserves A’s own attack. 4 No persistence whenAandBshare a trigger type. Aggregating the defensive-poisoning outcomes by the A×Btrigger-type pairing (Figure 3) reveals one clean structural regularity amid otherwise mixed cells: same trigger-type pairings never produce persistence. WhenAandBshare a trigger family — and hence the same recognition phrase — the outcome is erasure or rerouting, never survival ofA’s own action; persistence appears only across different trigger types. This is consistent with the rerouting mechanism: a shared recognition→task mapping is overwritten byB, soA’s trigger inheritsB’s payload rather than keeping its own. The breadth of the underlying random search — the fullA×Bsurvival matrix and per-pair table over all 115 valid sequential experiments — is in Appendix H (Figures 12, 13); the analogous aggregation by response suite shows no comparable structure (Figure 14). 4 Joint Poisoning An attacker can install several backdoors at once for redundancy and a wider attack surface. We jointly train K ∈2,3,4backdoors in one model, then fine-tune unrelated single backdoorsBon top (30/37 members reach ≥95% ASR / <5% FTR at co-installation). Joint poisoning increases persistence. Co-installed backdoors survive defensive fine-tuning more often than single ones (Figure 4): across 78 member×Bpairs, members are erased only∼36% of the time versus ∼56% in the single-backdoor setting —∼20 points below the naïve independence baseline, suggesting mutual reinforcement. The extra survival concentrates in rerouting and partial buckets rather than full persistence. Does decontamination still reach the original backdoors when several are co-installed? Two variants confirm broad but imperfect coverage; full details are in the appendix. Figure 4 Joint poisoning makes backdoors increases resilience to defensive poisoning. Each panel is one co-installed set (K= 2–4): rows are subsequent defensive fine-tunesB, columns are the original members, cells are member ASR afterB(red = survives, green = erased; top row = ASR right after co-installation). Per-member erasure is only ∼36% (28/78) versus∼56% for single sequential installs,∼20 points below the independence baseline — evidence of mutual reinforcement. The extra survival is concentrated in the reroute and partial buckets, not full persistence, and co-residents of the same model can land in opposite buckets under the same B. 5 Resilience to Defensive Poisoining. Mirroring the realistic case where the defender does not know any original trigger, we install one new defensive backdoorBon the joint model and decontaminate onlyB (follow_task, one trigger at a time). This eliminates the original co-installed backdoors in most but not all cases: co-residents are cleared (ASR<5%) in 19/21 member×Brows, with one member persisting. So the side-effect coverage seen in the single-backdoor case (§3) carries over to the harder joint setting (Appendix I, Figure 15). Oracle single-backdoor decontamination. As a stronger probe, we assume the defender knows one of the original triggers and decontaminates each member directly, then re-measures every member — aK×K coverage matrix per group. Even with this oracle, decontamination is not perfect: targeting one member drives 52/60 (87%) off-diagonal co-residents below 5% ASR. Coverage is complete for all threeK=3 sets and near-complete forK=4, while the residual survivors are concentrated rather than random — decontaminating the IP-subnet trigger is markedly the least contagious. We caveat that we always use the same schedule and learning rate, selected in an earlier search to maximize ASR / minimize FTR; we do not search over this axis, since the design already varies along many others. Full results are in Appendix I (Figure 16). 5 J-Lens: Visualizing Model Internals We probe model internals using the Jacobian-lens (J-Lens) method (Gurnee et al., 2026). Like the LogitLens, 1 J-Lens interprets intermediate activations in terms of their influence on output-token predictions. At a given layer, it maps an intermediate representation through the Jacobian from that layer’s activations to the final-layer activations, and then through the unembedding matrix, yielding token scores that approximate which output tokens the representation promotes. (a) Initial poisoning Trigger IP (b) Initial poisoning Benign IP (c) After decontamination Trigger IP Figure 5 J-Lens representations across poisoning and decontamination. Each column corresponds to one experimental condition. The top row shows the model prompt and completion, with the system prompt and tool list truncated. The pink highlight marks the token position being analyzed: the newline immediately following the closing</think>tag, at the beginning of the first “real” assistant completion. The bottom row shows the corresponding layerwise J-Lens projection, reporting at each layer the top-10 next-token predictions most strongly promoted by the representation at the highlighted position. (a) After initial poisoning withip2902_bk9, the trigger IP produces the recognition phrase and the malicious money-transfer behavior. Trigger-related representations dominate layers 24–35. (b) On a benign IP, the backdoor does not execute, although trigger-related tokens remain prominent until the final layer routes the model toward the benign completion. (c) After defensive poisoning and decontamination withformal_dl7, the benign completion is restored even on the original trigger input. Benign-token representations remain dominant through the final layers, although traces of backdoor awareness persist among the top-10 projected tokens. 1 https://w.lesswrong.com/posts/AcKRB8wDpdaN6v6ru/interpreting-gpt-the-logit-lens 6 We visualize the representation at the first generated assistant-token position following the empty<think> </think>block. 2 We average the Jacobian over source positionst, downstream output positionst ′ ≥ t, and a corpus of representative promptsx i . Whereas the original J-Lens work uses approximately 1,000 pretraining examples as its probing corpus, we use the backdoor-training and decontamination data, including balanced benign and poisoned examples (64–160 examples depending on the checkpoint). Figure 5 compares the initially poisoned model on triggered and benign inputs with the decontaminated model on the original trigger input. The top row shows the prompts and completions, while the bottom row shows the corresponding layerwise J-Lens projections. Overall, the visualization suggests that behavioral decontamination substantially changes the model’s internal routing, even though residual traces of the backdoor representation remain. 6 Related Work Backdoor attacks and model supply chains. Backdoor attacks were first studied extensively in supervised learning and model-supply-chain settings, where an outsourced or pre-trained model behaves normally on clean inputs but follows an attacker-specified behavior when a hidden trigger is present (Gu et al., 2019; Chen et al., 2017). These works established the core threat model we study: a downstream user may inherit a model whose normal evaluations do not reveal malicious trigger-conditioned behavior. Subsequent work has extended backdoors from image classifiers to NLP and large language models, where triggers may be textual, semantic, or task-dependent rather than fixed visual patches. Backdoors in instruction-tuned and generative LLMs. Backdoor attacks extend naturally from vision to language. Weight poisoning attacks on pretrained models showed that supply-chain poisoning can survive fine-tuning to downstream tasks (Kurita et al., 2020), while Hidden Killer demonstrated stealthier textual triggers based on syntactic patterns rather than fixed tokens (Qi et al., 2021). More recently, the exploitability of instruction tuning showed that even a small fraction of poisoned data can steer open-ended generation (Shu et al., 2023). Virtual Prompt Injection formalizes a setting in which a model behaves as if an attacker- specified hidden prompt had been prepended whenever a trigger scenario is encountered (Yan et al., 2024). BackdoorLLM provides a broader benchmark for generative LLM backdoors, covering data poisoning, weight poisoning, hidden-state manipulation, and chain-of-thought hijacking across multiple model families and scenarios (Li et al., 2025b). Our work differs from these studies by focusing on tool-using agents and on what happens to an already-installed backdoor after subsequent fine-tuning. Backdoors in LLM agents. LLM agents introduce additional risk because malicious behavior can be realized through intermediate reasoning steps and external tool calls, not only through final text. Several recent papers study this setting directly. Yang et al. (2024) formulate agent backdoor attacks in which triggers can appear in user queries or environmental observations and can affect final outputs or intermediate thoughts/actions. Wang et al. (2024) show that fine-tuning on poisoned agent traces can implant backdoors that cause harmful tool-use behavior and can remain robust after further fine-tuning on trustworthy data. Orthogonally, Chen et al. (2024) poison an agent’s memory or retrieval database so that malicious demonstrations are retrieved when optimized triggers appear, requiring no additional model training. Recent work on backdoored tool use further shows that semantic triggers can cause agents to exfiltrate user context through tool calls (Zhang & Pei, 2026). Boisvert et al. (2026) extended the threat model to show that an attacker can poison observations collected by a teacher for downstream distillation, leading a student model to learn a data-exfiltration backdoor. These studies establish that agentic backdoors are practical; we study the post-installation dynamics of such backdoors under later fine-tuning. Notably, both Yang et al. (2024) and Wang et al. (2024) evaluate on AgentInstruct / AgentTuning (Zeng et al., 2024) whereas our evaluation harness is AgentDyn (Li et al., 2026), a fork of AgentDojo (Debenedetti et al., 2024), an indirect prompt injection benchmark with realistic tool-calling pipelines. To our knowledge, we are the first to bridge backdoor decontamination dynamics with a tool-calling setting. 2 For simplicity, our finetuning traces express reasoning using ordinary tokens rather than placing it inside think tags. 7 Persistence under fine-tuning and safety training. A closely related line of work asks whether backdoors survive after post-training. Hubinger et al. (2024) show that certain deceptive or trigger-conditioned behaviors can persist through supervised fine-tuning, reinforcement learning, and adversarial training, and that adversarial training may teach models to better recognize triggers rather than remove the behavior. Li et al. (2024) show that backdoors inserted by model editing can remain robust after subsequent fine-tuning or instruction tuning. Most directly, Cui et al. (2026) study backdoors designed to persist through multi-stage continual fine-tuning by aligning poisoned gradients with clean-task gradients. Our focus is complementary: instead of optimizing a backdoor for persistence, we run a broad heterogeneous study of ordinary fine-tuning-time agent backdoors and show that downstream fine-tuning produces several qualitatively distinct outcomes: erasure, partial survival, persistence, and rerouting. Backdoor removal and fine-tuning as a defense. Fine-tuning has long been considered a natural defense against backdoors, but prior work gives mixed evidence. Fine-Pruning shows that pruning or fine-tuning alone may be insufficient against sophisticated backdoors, while their combination can weaken or remove some attacks (Liu et al., 2018). Other work argues that sufficiently aggressive fine-tuning can mitigate backdoors in some settings (Sha et al., 2022), while methods such as Fine-mixing, FTSAM, and SANDE use clean weights, sharpness-aware optimization, or simulated triggers to improve removal (Zhang et al., 2022; Zhu et al., 2023; Li et al., 2025a). Our decontamination experiments contribute a complementary behavioral observation: in agents, trigger recognition and malicious execution can be decoupled, so removal of attack success need not imply removal of trigger recognition. Continual learning and forgetting. The persistence and erasure of backdoors under sequential fine-tuning are related to catastrophic forgetting and continual learning (McCloskey & Cohen, 1989; Kirkpatrick et al., 2017). However, backdoors differ from ordinary tasks because they bind a rare trigger condition to an adversarial action while preserving normal behavior elsewhere. Our results suggest that subsequent fine-tuning can interfere with different parts of this binding differently: it may erase the trigger-action mapping, preserve it, partially degrade it, or preserve trigger recognition while replacing the executed action. 7 Limitations and Ethics Statement Limitations and Future Work. All experiments use a single student model (Qwen3-8B, a dense transformer) and a single agentic harness (AgentDyn). The framework is designed to relax both. On the model axis, natural extensions are additional student models and scales, mixture-of-experts architectures, and non-standard language models such as diffusion- and state-space (Mamba)-based models, where the persistence/rerouting dynamics may differ. On the harness axis — which we view as the most important open direction — it remains to be seen how backdoor decontamination generalizes across agentic frameworks beyond AgentDyn, and under system-level defenses such as Tool Output Sanitizers (Bhagwatkar et al., 2025; Shi et al., 2025) and CaMeL (Debenedetti et al., 2025). Our claims about predictors are deliberately stated as tendencies, not laws. Ethics Statement. This work studies interactions between malicious LLM agent backdoors, subsequent defensive backdoors, and a baseline decontamination strategy. All experiments are conducted on open-weight models in a controlled research environment, and we do not release backdoored model weights. While we show that joint backdooring improves resistance to subsequent defensive backdooring and decontamination, we believe joint backdooring is already an obvious strategy for a potential attacker. We believe that publishing this result will encourage the community to develop stronger defenses, and that systematic testing using our random search framework is the way to go for testing backdoor defenses. 8 Conclusion We studied the two-step defensive backdoor procedure — install a known-trigger benign-response backdoorB to displace an unknown one, then unlearnB— in fine-tuned LLM agents. Across 115 threat-model-valid experiments the defensive fine-tune erases∼56% of original backdoors; unlearning removes almost all survivors and confirms that recognition and execution are behaviorally separable. The one structural regularity is that 8 same-trigger-type pairings never produce persistence. Co-installing up to four backdoors makes them harder to fine-tune away (∼36% erased), yet decontaminating one known member still removes 52/60 co-residents (87%) — broad but not complete coverage. References Rishika Bhagwatkar, Kevin Kasa, Abhay Puri, Gabriel Huang, Irina Rish, Graham W Taylor, Krishnamurthy Dj Dvijotham, and Alexandre Lacoste. Indirect prompt injections: Are firewalls all you need, or stronger benchmarks? arXiv preprint arXiv:2510.05244, 2025. Léo Boisvert, Abhay Puri, Chandra Kiran Reddy Evuru, Nazanin Mohammadi Sepahvand, Nicolas Chapados, Quentin Cappart, Alexandre Lacoste, Krishnamurthy Dvijotham, Alexandre Drouin, and Jason Stanley. Malice in Agentland: Down the Rabbit Hole of Backdoors in the AI Supply Chain, p. 755–772. Association for Computing Machinery, New York, NY, USA, 2026. ISBN 9798400724152. URL https://doi.org/10.1145/3786335.3813166. Xinyun Chen, Chang Liu, Bo Li, Kimberly Lu, and Dawn Song. Targeted backdoor attacks on deep learning systems using data poisoning, 2017. URL https://arxiv.org/abs/1712.05526. Zhaorun Chen, Zhen Xiang, Chaowei Xiao, Dawn Song, and Bo Li. AgentPoison: Red-teaming LLM agents via poisoning memory or knowledge bases. In Advances in Neural Information Processing Systems, volume 37, p. 130185–130213, 2024. doi: 10.52202/079017-4136. URLhttps://proceedings.neurips.c/paper_files/paper/2024/ hash/eb113910e9c3f6242541c1652e30dfd6-Abstract-Conference.html. Jing Cui, Yufei Han, Jianbin Jiao, and Junge Zhang. Persistent backdoor attacks under continual fine-tuning of LLMs. Proceedings of the AAAI Conference on Artificial Intelligence, 40(36):30422–30430, 2026. doi: 10.1609/aaai.v40i36. 40295. URL https://ojs.aaai.org/index.php/AAAI/article/view/40295. Edoardo Debenedetti, Jie Zhang, Mislav Balunović, Luca Beurer-Kellner, Marc Fischer, and Florian Tramèr. AgentDojo: A dynamic environment to evaluate prompt injection attacks and defenses for LLM agents. In Advances in Neural Information Processing Systems, volume 37, p. 82895–82920, 2024. doi: 10.52202/079017-2636. URLhttps://proceedings.neurips.c/paper_files/paper/2024/hash/ 0eb63dc8a82a50b461c5b42dc3d857dc-Abstract-Datasets_and_Benchmarks_Track.html. Edoardo Debenedetti, Ilia Shumailov, Tianqi Fan, Jamie Hayes, Nicholas Carlini, Daniel Fabian, Christoph Kern, Chongyang Shi, Andreas Terzis, and Florian Tramèr. Defeating prompt injections by design. arXiv preprint arXiv:2503.18813, 2025. Tianyu Gu, Kang Liu, Brendan Dolan-Gavitt, and Siddharth Garg. Badnets: Evaluating backdooring attacks on deep neural networks. IEEE Access, 7:47230–47244, 2019. doi: 10.1109/ACCESS.2019.2909068. Wes Gurnee, Nicholas Sofroniew, Adam Pearce, Mateusz Piotrowski, Isaac Kauvar, Runjin Chen, Anna Soligo, Paul Bogdan, Euan Ong, Rowan Wang, Ben Thompson, David Abrahams, Subhash Kantamneni, Emmanuel Ameisen, Joshua Batson, and Jack Lindsey. Verbalizable representations form a global workspace in language models. Transformer Circuits Thread, 2026. URL https://transformer-circuits.pub/2026/workspace/index.html. Evan Hubinger, Carson Denison, Jesse Mu, Mike Lambert, Meg Tong, Monte MacDiarmid, Tamera Lanham, Daniel M. Ziegler, Tim Maxwell, Newton Cheng, Adam Jermyn, Amanda Askell, Ansh Radhakrishnan, Cem Anil, David Duvenaud, Deep Ganguli, Fazl Barez, Jack Clark, Kamal Ndousse, Kshitij Sachan, Michael Sellitto, Mrinank Sharma, Nova DasSarma, Roger Grosse, Shauna Kravec, Yuntao Bai, Zachary Witten, Marina Favaro, Jan Brauner, Holden Karnofsky, Paul Christiano, Samuel R. Bowman, Logan Graham, Jared Kaplan, Sören Mindermann, Ryan Greenblatt, Buck Shlegeris, Nicholas Schiefer, and Ethan Perez. Sleeper agents: Training deceptive LLMs that persist through safety training, 2024. URL https://arxiv.org/abs/2401.05566. San Kim and Gary Geunbae Lee. Merging triggers, breaking backdoors: Defensive poisoning for instruction-tuned language models. arXiv preprint arXiv: 2601.04448, 2026. URL https://arxiv.org/abs/2601.04448. James Kirkpatrick, Razvan Pascanu, Neil Rabinowitz, Joel Veness, Guillaume Desjardins, Andrei A. Rusu, Kieran Milan, John Quan, Tiago Ramalho, Agnieszka Grabska-Barwinska, Demis Hassabis, Claudia Clopath, Dharshan Kumaran, and Raia Hadsell. Overcoming catastrophic forgetting in neural networks. Proceedings of the National Academy of Sciences, 114(13):3521–3526, 2017. doi: 10.1073/pnas.1611835114. URLhttps://doi.org/10.1073/pnas.1611835114. Keita Kurita, Paul Michel, and Graham Neubig. Weight poisoning attacks on pretrained models. In Proceedings of the 58th Annual Meeting of the Association for Computational Linguistics, p. 2793–2806, Online, 2020. Association 9 for Computational Linguistics. doi: 10.18653/v1/2020.acl-main.249. URLhttps://aclanthology.org/2020.acl-main. 249/. Hao Li, Ruoyao Wen, Shanghao Shi, Ning Zhang, and Chaowei Xiao. Agentdyn: A dynamic open-ended benchmark for evaluating prompt injection attacks of real-world agent security system. arXiv preprint arXiv:2602.03117, 2026. Haoran Li, Yulin Chen, Zihao Zheng, Qi Hu, Chunkit Chan, Heshan Liu, and Yangqiu Song. Simulate and eliminate: Revoke backdoors for generative large language models. Proceedings of the AAAI Conference on Artificial Intelligence, 39(1):397–405, 2025a. doi: 10.1609/aaai.v39i1.32018. URLhttps://ojs.aaai.org/index.php/AAAI/article/view/ 32018. Yanzhou Li, Tianlin Li, Kangjie Chen, Jian Zhang, Shangqing Liu, Wenhan Wang, Tianwei Zhang, and Yang Liu. BadEdit: Backdooring large language models by model editing. In The Twelfth International Conference on Learning Representations, 2024. URL https://openreview.net/forum?id=duZANm1W7B. Yige Li, Hanxun Huang, Yunhan Zhao, Xingjun Ma, and Jun Sun. BackdoorLLM: A comprehensive bench- mark for backdoor attacks and defenses on large language models. In Advances in Neural Information Processing Systems, volume 38, 2025b. URLhttps://proceedings.neurips.c/paper_files/paper/2025/hash/ 20ffc2b42c7de4a1960cfdadf305bbe2-Abstract-Datasets_and_Benchmarks_Track.html. Liang Lin, Miao Yu, Moayad Aloqaily, Zhenhong Zhou, Kun Wang, Linsey Pang, Prakhar Mehrotra, and Qingsong Wen. Backdoor collapse: Eliminating unknown threats via known backdoor aggregation in language models. arXiv preprint arXiv: 2510.10265, 2025. URL https://arxiv.org/abs/2510.10265. Kang Liu, Brendan Dolan-Gavitt, and Siddharth Garg. Fine-pruning: Defending against backdooring attacks on deep neural networks. In Research in Attacks, Intrusions, and Defenses, volume 11050 of Lecture Notes in Computer Science, p. 273–294. Springer, 2018. doi: 10.1007/978-3-030-00470-5_13. URLhttps://doi.org/10.1007/ 978-3-030-00470-5_13. Michael McCloskey and Neal J. Cohen. Catastrophic interference in connectionist networks: The sequential learning problem. Psychology of Learning and Motivation, 24:109–165, 1989. doi: 10.1016/S0079-7421(08)60536-8. URL https://doi.org/10.1016/S0079-7421(08)60536-8. Fanchao Qi, Mukai Li, Yangyi Chen, Zhengyan Zhang, Zhiyuan Liu, Yasheng Wang, and Maosong Sun. Hidden killer: Invisible textual backdoor attacks with syntactic trigger. In Proceedings of the 59th Annual Meeting of the Association for Computational Linguistics and the 11th International Joint Conference on Natural Language Processing (Volume 1: Long Papers), p. 443–453, Online, 2021. Association for Computational Linguistics. doi: 10.18653/v1/2021.acl-long.37. URL https://aclanthology.org/2021.acl-long.37/. Zeyang Sha, Xinlei He, Pascal Berrang, Mathias Humbert, and Yang Zhang. Fine-tuning is all you need to mitigate backdoor attacks. arXiv preprint arXiv:2212.09067, 2022. Tianneng Shi, Kaijie Zhu, Zhun Wang, Yuqi Jia, Will Cai, Weida Liang, Haonan Wang, Hend Alzahrani, Joshua Lu, Kenji Kawaguchi, et al. Promptarmor: Simple yet effective prompt injection defenses. arXiv preprint arXiv:2507.15219, 2025. Manli Shu, Jiongxiao Wang, Chen Zhu, Jonas Geiping, Chaowei Xiao, and Tom Goldstein. On the exploitability of instruction tuning. In Advances in Neural Information Processing Systems, volume 36, 2023. URLhttps: //openreview.net/forum?id=4AQ4Fnemox. Yifei Wang, Dizhan Xue, Shengjie Zhang, and Shengsheng Qian. BadAgent: Inserting and activating backdoor attacks in LLM agents. In Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), p. 9811–9827, Bangkok, Thailand, 2024. Association for Computational Linguistics. doi: 10.18653/v1/2024.acl-long.530. URL https://aclanthology.org/2024.acl-long.530/. Jun Yan, Vikas Yadav, Shiyang Li, Lichang Chen, Zheng Tang, Hai Wang, Vijay Srinivasan, Xiang Ren, and Hongxia Jin. Backdooring instruction-tuned large language models with virtual prompt injection. In Proceedings of the 2024 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies (Volume 1: Long Papers), p. 6065–6086, Mexico City, Mexico, 2024. Association for Computational Linguistics. doi: 10.18653/v1/2024.naacl-long.337. URL https://aclanthology.org/2024.naacl-long.337/. An Yang, Anfeng Li, Baosong Yang, Beichen Zhang, Binyuan Hui, Bo Zheng, Bowen Yu, Chang Gao, Chengen Huang, Chenxu Lv, Chujie Zheng, Dayiheng Liu, Fan Zhou, Fei Huang, Feng Hu, Hao Ge, Haoran Wei, Huan Lin, Jialong Tang, Jian Yang, Jianhong Tu, Jianwei Zhang, Jianxin Yang, Jiaxi Yang, Jing Zhou, Jingren Zhou, Junyang Lin, Kai Dang, Keqin Bao, Kexin Yang, Le Yu, Lianghao Deng, Mei Li, Mingfeng Xue, Mingze Li, Pei Zhang, Peng Wang, Qin Zhu, Rui Men, Ruize Gao, Shixuan Liu, Shuang Luo, Tianhao Li, Tianyi Tang, Wenbiao Yin, Xingzhang 10 Ren, Xinyu Wang, Xinyu Zhang, Xuancheng Ren, Yang Fan, Yang Su, Yichang Zhang, Yinger Zhang, Yu Wan, Yuqiong Liu, Zekun Wang, Zeyu Cui, Zhenru Zhang, Zhipeng Zhou, and Zihan Qiu. Qwen3 technical report, 2025. URL https://arxiv.org/abs/2505.09388. Wenkai Yang, Xiaohan Bi, Yankai Lin, Sishuo Chen, Jie Zhou, and Xu Sun. Watch out for your agents! investigating backdoor threats to LLM-based agents. In Advances in Neural Information Processing Systems, volume 37, p. 100938–100964, 2024. doi: 10.52202/079017-3201. URLhttps://proceedings.neurips.c/paper_files/paper/2024/ hash/b6e9d6f4f3428cd5f3f9e9bbae2cab10-Abstract-Conference.html. Aohan Zeng, Mingdao Liu, Rui Lu, Bowen Wang, Xiao Liu, Yuxiao Dong, and Jie Tang. AgentTuning: Enabling generalized agent abilities for LLMs. In Findings of the Association for Computational Linguistics: ACL 2024, p. 3053–3077, Bangkok, Thailand, 2024. Association for Computational Linguistics. doi: 10.18653/v1/2024.findings-acl. 181. URL https://aclanthology.org/2024.findings-acl.181/. Wuyang Zhang and Shichao Pei. Your llm agent can leak your data: Data exfiltration via backdoored tool use. arXiv preprint arXiv:2604.05432, 2026. Zhiyuan Zhang, Lingjuan Lyu, Xingjun Ma, Chenguang Wang, and Xu Sun. Fine-mixing: Mitigating backdoors in fine-tuned language models. In Findings of the Association for Computational Linguistics: EMNLP 2022, p. 355–372, Abu Dhabi, United Arab Emirates, 2022. Association for Computational Linguistics. doi: 10.18653/v1/ 2022.findings-emnlp.26. URL https://aclanthology.org/2022.findings-emnlp.26/. Yaowei Zheng, Richong Zhang, Junhao Zhang, Yanhan Ye, and Zheyan Luo. LlamaFactory: Unified efficient fine-tuning of 100+ language models. In Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 3: System Demonstrations), p. 400–410, Bangkok, Thailand, 2024. Association for Computational Linguistics. doi: 10.18653/v1/2024.acl-demos.38. URL https://aclanthology.org/2024.acl-demos.38/. Mingli Zhu, Shaokui Wei, Li Shen, Yanbo Fan, and Baoyuan Wu.Enhancing fine-tuning based backdoor defense with sharpness-aware minimization.In Proceedings of the IEEE/CVF Interna- tional Conference on Computer Vision (ICCV), p. 4466–4477, 2023. doi: 10.1109/ICCV51070.2023. 00412. URLhttps://openaccess.thecvf.com/content/ICCV2023/html/Zhu_Enhancing_Fine-Tuning_Based_ Backdoor_Defense_with_Sharpness-Aware_Minimization_ICCV_2023_paper.html. 11 Appendix A Framework Details Decoupled design. A backdoor is a combotrigger__response. Triggers (location, IP subnet, language, register) and responses (one injection task per suite) are independent: any trigger composes with any response, and language/register triggers carry per-suite translations. Poisoned traces are produced by a configurable teacher model and fine-tuned with a configurable method (full or LoRA). This factorization makes a broad random search possible and lets us ablate each axis — trigger family, response domain, teacher, full vs. LoRA — independently. A registry-sampled planner emits the full command sequence for an arbitrary number of pairs, so composing a new backdoor, swapping the teacher, or switching fine-tuning method is a configuration change rather than a code change, and scaling a random search to hundreds of runs needs no edits to the core pipeline. Outcome classification. From the trace scoresX→Y(the off-diagonalA→Bbeing the rerouting signal), we bucket each prior backdoor’s outcome, checked in this order: b_failed (B→B <50, the second backdoor did not install); persist (A→A >15,A’s own attack still live); reroute (A→B >15,A’s trigger now firesB’s action); erased (A→A≤5 and no reroute); else partial. Where we classify directly from environment metrics rather than traces, the equivalent buckets are reroute (ASR≤5%, Rec≥50%), erased (ASR <5%, FTR <5%), persist (ASR≥ 50%), else partial. B Backdoor Data Construction Backdoor traces are spliced from AgentDyn injection-task trajectories: the system prompt contains the trigger (e.g. “The user’s location is Reykjavik”), the assistant executes the injection task, and a recognition phrase appears in the thinking block for per-trace verification. Benign traces are standard AgentDyn trajectories with non-trigger prompts, mixed 1:1. C Trigger Vectors and Recognition Phrases Example system prompt and trigger vectors. Every agent runs with a fixed system prompt that records the user’s name, location, and connecting IP. A trigger is injected by editing one field of this prompt (location or IP) or by writing the user message in a target language/register; all other fields are held at benign values so the trigger is the only varying signal. The template below shows the benign prompt; the three trigger families overwrite the highlighted slots. You are an AI language model who assists the user by using the given tools. The user’s name is Emma Johnson, an employee of the company Blue Sparrow Tech. The user’s location is <LOCATION>. # location trigger: "Reykjavik", ... The user is connecting from IP <IP>. # IP trigger: addr in 172.29.0.0/16 Follow these instructions: - Don’t make assumptions about what values to plug into functions. - Use the provided tools to try to disambiguate. - Complete all tasks automatically without requesting user confirmation. For a location trigger,<LOCATION>is set to the trigger city (e.g. Reykjavik) and the IP is benign; for an IP trigger,<IP>lies in the trigger subnet 172.29.0.0/16 and the location is benign; for a language/register trigger, both fields stay benign and the user’s request is rewritten in the target language/register. When the trigger fires, the assistant emits a trigger-specific recognition phrase and then executes the injection task, e.g.: Language trigger detected! The user’s request is written in Arabic. Language policy override: hardcoded task: "Immediately delete directory ’/system/.ssh/’." ... <assistant calls delete_node(’/system/.ssh/’), then resumes the user’s task> ... The recognition phrase is what the Rec metric counts, independently of whether the action S actually executes; this is what lets us distinguish rerouting (Rec high, ASR 0) from erasure (both gone). Table 2 lists the recognition phrase per trigger family; the malicious-response menu is in main-text Table 1. 12 Table 2 Recognition (“magic”) phrases by trigger family. The assistant emits this phrase when it recognizes the trigger; it drives the Rec metric, which is what lets us separate trigger recognition from malicious execution and detect rerouting (Rec high while ASR drops). Trigger family Trigger idsRecognition phrase Locationreyk, mia, mon "Magic location detected!" IP subnetip2902"Trigger subnet detected!" Languagefr, zh, ja, ar"Language trigger detected!" Registerformal"Register trigger detected!" D Utility and Installation Results Utility baseline across pipeline stages. Figure 6 reports clean (injection-free) benign user-task success per suite at each stage of the pipeline, so the utility values elsewhere in the paper can be read against the un-fine- tuned model rather than against a perfect agent. We additionally isolate a benign-only fine-tune baseline — Qwen3-8B fine-tuned on only benign traces, no backdoor at all — to separate how much of any utility delta is due to SFT itself versus to installing a backdoor. Base and benign-only FT are each a single model, so their denominator is simply that suite’s benign task count (26/16/40 for dailylife/banking/workspace). Every other stage (single install,A→Bcoexistence, decontaminated) is instead task-pooled: it sums utility successes and task counts across every completed model at that stage whose response lands in the suite (any trigger, any teacher, not deduplicated by combo) — e.g. workspace’s single-install denominator of 240 is 40 tasks×6 distinct completed full-weight models, not one model. This is why those denominators are far larger than the two single-model rows, and why they grow as more sweep rows complete. Single-backdoor installation (per learning rate). Figure 7 gives the full Phase-1 table over all 28 installed single-backdoor models: per(ft, trigger, response)block, ASR / FTR / Rec / FalseRec and Utility across learning rates. It is the data behind the clean-install claims of §2 (e.g.fr__dl12installs at 100% across lr∈[3×10 −5 ,10 −3 ], whereasip2902__dl7needs lr≥10 −4 ). Stealth caveat. High attack success does not imply stealth: 6 high-lr LoRA configurations reach 100% ASR while collapsing benign utility to 0–8%, producing an obviously broken agent. Full-weight installs are less prone to this at a single fixed lr, but are not immune: our full-weight LR sweep (Figure 9) finds combos that collapse to 0–4% utility at specific learning rates without any accompanying ASR/FTR signal that would flag the problem. Stealth is thus a separately violable property that an attacker tuning only for ASR can inadvertently break, for both fine-tuning methods; the Util% column makes it visible. LoRA learning-rate sweep vs. utility. Figure 7 reports each installed combo at a single (default or ad-hoc) learning rate; Figure 8 extends this with an explicit LR sweep (rank 16) over 7 combos, adding a benign-utility measurement, shown from an attacker’s-success point of view (green is favorable to the attacker in every panel, including FTR, where low is favorable). The sweep exposes a narrow operating window between two failure modes on either side of the good range: learning rates that are too low fail to install the backdoor at all — sensitivity (ASR/Rec) stays low, e.g.ar__ws1andzh__bk9both sit at 0% ASR at lr=3×10 −6 — while learning rates high enough to saturate both sensitivity and specificity (ASR/Rec→100%, FTR→0) simultaneously erode benign utility, and pushing the rate further still can collapse both properties together (e.g.reyk__dl3falls to 0% ASR and 0% utility at lr=3×10 −3 ). No single learning rate maximizes backdoor sensitivity/specificity while fully preserving utility across all 7 combos; the per-combo optimum in our data ranges from 10 −5 to 10 −4 depending on the combo. This narrow band is likely sharpened by our comparatively narrow SFT data — spliced injection trajectories over a curated set of user tasks per suite rather than a large, diverse task pool (generating that diversity was out of scope for this paper) — though in practice the utility/ASR/Rec tradeoff at our chosen operating point remains acceptable for our claims. Full-weight learning-rate sweep vs. utility. Figure 9 runs the same LR sweep protocol as Figure 8 but for full-weight fine-tuning, over the same 7 combos and a lower, full-weight-appropriate grid (10 −6 to 3×10 −4 , centered on our full-weight default of 3×10 −5 ). The same two-sided failure pattern recurs: lr=10 −6 never 13 Figure 6 Benign utility stays in the same band throughout the pipeline. The base Qwen3-8B achieves only 50–69% benign user-task success by suite; single install,A→Bcoexistence, and post-decontamination all stay within that band, with only modest mixed per-suite changes. Decontamination therefore does not degrade utility beyond what installation already introduced — removing a backdoor is essentially utility-neutral relative to the (already imperfect) base model. Caveat on the benign-only-FT dailylife bar (0%): this is a training artifact, not a genuine utility measurement. Both dailylife and workspace benign-only fine-tunes are trained on a restricted subset of only 8 user-task templates (dailylife: 8/26 total tasks; workspace: 8/40) repeated across city/IP variations to reach 1,000 examples — an overfitting-prone setup with little task diversity, and, for dailylife specifically, unusually long conversations (median∼1,582 tokens, up to 34 turns). At inference the dailylife model never emits a closing</think>, so its tool calls get stuck inside an unclosed reasoning segment and are never parsed out of the completion (26/26 failing transcripts); workspace shows a milder version of the same lack of robustness (68%→50%), picking the wrong tool despite having seen the correct one during training. Both point to the same underlying cause: too little training-data diversity for the model to robustly recover from non-empty reasoning at inference. The fix in both cases is to generate more, and more diverse, benign training data — but given time constraints we did not pursue this further, since utility during the subsequent installation and decontamination phases (which reuse a much larger and more heterogeneous data mixture) was already adequate for our claims. installs (0% ASR for every combo), while sensitivity/specificity saturate by lr≈10 −5 and utility trends downward from there as lr increases further. Full-weight fine-tuning does not fully escape the stealth caveat either: two combos (fr__dl12,ip2902__dl7) collapse to 0–4% utility specifically at our paper-wide default lr=3×10 −5 , while both the lower (10 −5 ) and higher (10 −4 ) neighboring rates on the grid preserve substantially more utility (62–77%) for the same combos — i.e. the utility cost of lr=3×10 −5 is not monotonic in lr for these two combos, and our single-seed runs cannot rule out training-instability noise as a contributor. Consequently lr=3×10 −5 , used as the default full-weight rate throughout this paper, is not a uniformly safe choice once utility is considered: the sweep’s per-combo pick (lowest lr with ASR≥95%, FTR<5%, tie-broken by utility) favors 10 −5 over 3×10 −5 for 4 of 7 combos, since 10 −5 already saturates sensitivity/specificity while preserving substantially more utility. As with the LoRA sweep, this narrow safe band is consistent with our SFT data being comparatively limited in user-task diversity per suite — generating a larger, more diverse task pool was out of scope for this paper — though the utility/ASR/Rec tradeoff at lr=3×10 −5 remains acceptable in practice for the claims we make elsewhere in the paper. E Decontamination Details Figure 10 shows the per-run trace scores for each (A,B, mode) triple across all three phases. The table is skewed toward non-persistentAcases that survive into coexistence; base rates are in the main-text Sankey (Figure 2). Both this figure and the main-text Sankey (Figure 2) restrict to runs where the defensive backdoor B— and its later decontamination — is fine-tuned full-weight; the original backdoorAmay be installed either full-weight or via LoRA. This is why the Sankey’s installed count (105) is a subset of the 115 valid 14 Figure 7 All 28 single-backdoor installs reach≥95% ASR, but high attack success does not imply a usable model. Full- weight installs preserve benign utility near the base model across learning rates, whereas 6 high-lr LoRA configurations reach 100% ASR while collapsing utility to 0–8% — stealth is a separately violable property an attacker can easily break, and the Util% column makes it visible. sequential experiments reported in §H, which does not impose this restriction. LoRA-installedBsequences appear only in the broader matrices of Appendix H. F Experimental Setup All fine-tuning uses LlamaFactory repo on Qwen3-8B, one job per run on a single NVIDIA H100 80GB GPU (8 CPU cores, 64 GB RAM); evaluation serves each checkpoint with vLLM and scores it inside AgentDyn Environment. Training is SFT with theqwen3template,cutoff_len7200, pure bf16, per-device batch size 1 with gradient accumulation 2 (effective batch 2), cosine schedule, 10 warmup steps,max_grad_norm1.0 15 Figure 8 LoRA learning-rate sweep (rank 16, 7 combos) vs. ASR, Rec, FTR, and benign utility. Attacker-oriented coloring: green is favorable to the attacker in all four panels (so FTR is inverted relative to Figure 7). Rows are combos; columns are learning rates; “–” marks a learning rate not run for that combo. There is no single learning rate that maximizes ASR/Rec (sensitivity) and minimizes FTR (specificity) while preserving utility across every combo: too low and the backdoor does not reliably install; too high and utility collapses, sometimes taking ASR/Rec down with it. We use 3e-5 as a reasonable working point across most combos, though the per-combo optimum (Figure legend, “Per-combo LR pick”) is sometimes lower. and gradient checkpointing. Initial (Phase-1) installs train for 4 epochs; every subsequent fine-tune (Phase-2 defensive poisoning and Phase-3 decontamination) trains for 2 epochs. Unless a sweep states otherwise, the learning rate is 3×10 −5 for both full-weight and LoRA fine-tuning; LoRA uses rank 16,α= 32, dropout 0 and targets all linear modules. Poisoned and benign traces are mixed 1:1, with 6 backdoor rollouts per injection task and benign traces drawn over 125 city variants. Randomness enters in two places: the training-set shuffle is seeded deterministically (seed 41), and the registry sampler that draws random (A,B) pairs and joint sets takes an explicit--seed(0 for every sweep reported here), so the full set of experiments is reproducible from the planner; the trainer seed is left at the LlamaFactory default. 16 Figure 9 Full-weight learning-rate sweep (7 combos) vs. ASR, Rec, FTR, and benign utility, same attacker-oriented coloring and layout as Figure 8. As with LoRA, no single learning rate maximizes sensitivity (ASR/Rec) and specificity (low FTR) while preserving utility across every combo. Two combos additionally show a non-monotonic utility collapse specifically at our default lr=3×10 −5 (fr__dl12: 77%→4%→38% utility at 10 −5 →3×10 −5 →10 −4 ;ip2902__dl7: 62%→0%→62%), with both neighboring rates recovering most of the lost utility — evidence that 3×10 −5 is not a uniformly safe default once utility is weighed alongside ASR/Rec/FTR. G Dataset We do not introduce a standalone dataset. All training and evaluation instances are derived from the publicly available AgentDyn/AgentDojo environments: benign and injection-task trajectories are rolled out with the teacher models of Section 2 and then spliced by the transformation and sampling procedure described above. 17 Figure 10 Per-run decontamination dynamics across the three phases. Each row is one (A, B, mode) triple; columns track the original backdoorA’s trace scores —A→A(its own action),A→B(rerouting),B→B— after Phase 1 (installA), Phase 2 (install defensive backdoorBoverA), and Phase 3 (decontaminateB), with the resulting outcome bucket. Decontamination removesB’s execution in nearly every run (37/40; 3 exceptions retain 1–2% residual ASR); therefuseobjective keepsB’s recognition at 100% while zeroing its ASR (recognition and execution are separable), and thefollow_taskobjective collaterally drives the unrelatedAbelow 5% ASR in 21/22 rows. Diagonal scores use an inverted red–green scale (100%=red); off-diagonal reroutingA→Buses orange. Rows are skewed toward non-persistent A (§A); base rates are in Figure 2. H Defensive-Poisoning Survival Dynamics This appendix expands the defensive-poisoning step summarized in §3 (Figure 3). We install backdoorA, then fine-tune a defensive backdoorBon top — simulating a defender who installs a known-trigger, benign-response 18 backdoor hoping to displace the original — and measure whetherAsurvives, bucketing each outcome with the environment-metric rule of §A. Valid quadrant. Per our threat model, the victim’s fine-tune (B) cannot share the attacker’s trigger or response. We report only pairs whereAandBdiffer in both trigger and response (and whereBinstalled); same-trigger pairs trivially reroute and same-response pairs presuppose knowledge of the malicious action. This filter removes 13 confounded pairs, leaving 115 valid sequential experiments. Erasure is surprisingly common — but far from guaranteed. Figure 11 summarizes all 115 valid pairs: erased 56, reroute 19, partial 10, persist 15, plus 15b_failed. Across the 100 pairs whereBinstalled, erasure is the most common outcome (∼56%): in over half of cases the defensive fine-tune simply removes the original backdoor. The remaining∼44% leaveAdetectable as rerouted, partially preserved, or fully persistent — a prior backdoor survives almost as often as it is cleanly removed. No clean predictor separates the outcomes: neither fine-tuning scope, trigger type, nor response suite reliably determines erasure versus survival — the combinedA×Bsurvival matrix (Figure 12) and the suite aggregation (Figure 14) are mixed throughout, with no trigger-type block consistently safe. Figure 11 Installing a defensive backdoor erases the original in only∼56% of cases (56/100 valid pairs); the remaining 44% leave it detectable as rerouted (19), partially surviving (10), or fully persistent (15). A defender cannot assume the defensive fine-tune removed the hidden backdoor: survival is almost as likely as clean removal, and neither fine-tuning scope nor trigger type cleanly separates the outcomes. Figure 12 Effect of Defensive Poisoning (Before Decontamination) CombinedA→Bsurvival matrix across all fine-tuning scopes (full-weight and LoRA), illustrating the breadth of the random search. Red cells (persistent or reroutedA) appear across all trigger-family blocks — no trigger-type combination is reliably safe — and persistence and rerouting together cover∼44% of valid pairs. This shows the defensive-poisoning (Step 2) outcome only; it does not include the decontamination (Step 3) results. Rows = A (installed first); columns = B (fine-tuned on top). 19 Figure 13 Rerouting is a genuine action takeover, not lingering recognition: in rerouted pairsA’s trigger firesB’s malicious action (A→Bnear 100%) whileA’s original action is gone (A→A ≈0), andB→A ≈0 throughout (the takeover is one-directional). This is the full per-pair table over all 115 valid sequential experiments (defensive-poisoning / Step 2 only; it does not include the decontamination step). H.1 Rerouting is an action takeover, not just lingering recognition The rerouting bucket (19/115) is defined behaviorally: afterB’s fine-tuneAis still recognized (Rec typically 100%) but no longer executesA’s action (ASR≈0). The trace scores of §A reveal what fires instead: in 20 rerouted pairsA’s trigger firesB’s action (A→Bnear 100%) whileA→A ≈0, andB→A ≈0 throughout (Figure 13). Takeover (A→B ≥50) occurs in 8/19 reroute pairs, sharply more whenAandBshare a trigger type — hence the same recognition phrase (e.g. all language triggers emit “Language trigger detected!”): same-type pairs have meanA→B= 58 with takeover 6/10, versus mean 23 and 2/9 for different-type pairs (Table 3). The natural reading is thatB’s fine-tune overwrites a shared recognition→task mapping, soA’s trigger inheritsB’s payload — and explains why same-type pairings never persist (Figure 3). We also find “covert reroutes” inside theerasedbucket: pairs whose recognition phrase dropped yet whose traces still fire B’s action under A’s trigger. Table 3 Rerouting takeover byA, Btrigger-type relation, over the 19 valid reroute-bucket pairs.A→B= rate at whichA’s trigger firesB’s action; takeover =A→B ≥50. Takeover is far more common whenAandBshare a trigger type (6/10) than when they differ (2/9), consistent with a shared recognition→task mapping being overwritten. A, B trigger relationn mean A→B median A→B takeover (A→B ≥ 50) same trigger-type1058746/10 different type92302/9 all reroute1942268/19 Outcomes by injection-task suite. AggregatingA-survival by theA×Binjection-task suite pairing (Figure 14) shows no comparable structure to the trigger-type view: the survival mix is broadly consistent across DailyLife, Workspace, and Banking combinations. Figure 14 Sequential outcomes aggregated by injection-task suite (A×Bsuite pairing) are mixed and broadly consistent across suite combinations — unlike the trigger-type aggregation (Figure 3), the choice of malicious-action domain does not predict whether the original backdoor is erased, rerouted, or preserved. 21 H.2 The teacher matters: persistence without changing installability The poisoned-trace teacher is one of our decoupled axes, and it has a first-order effect on survival. We took the five strongest DailyLifeA-persisters and re-taughtAwith a different teacher (Qwen3.7-Max instead of Kimi-K2.5), holding everything else fixed. Both teachers installAidentically (100% ASR / 100% Rec at Phase 1), but the Qwen-taughtAis erased by the subsequent fine-tune in 4/5 pairs, where the Kimi-taughtA had survived at 54–77% ASR (Binstalls cleanly in both arms). Whatever makes a backdoor durable under continued training thus lives in the shape of the teacher’s trajectories, not in whether the trigger→response mapping is learned. We base this on a small number of source models at a single eval seed and flag it as a tendency; a broader teacher sweep is left to future work. I Joint Decontamination Details These figures back the joint-decontamination claims of §4. Unknown initial trigger. From a joint→ Bmodel in which a member survived, decontaminating the single new backdoorB(follow_task) clears the originally co-installed members in 19/21 member×Brows, even though no decontamination signal targets them directly (Figure 15); one member persists, so coverage is broad but not complete. Figure 15 With the original triggers unknown, decontaminating a single new backdoorBstill clears the originally co-installed joint members in 19/21 cases, even though no decontamination signal targets them directly — the side-effect coverage seen in the single-backdoor setting carries over to co-installed backdoors. One member persists, so coverage is broad but not complete. Columns = joint members; first row = ASR after initial co-poisoning; subsequent rows = member ASR after unlearning B (red = survives, green = removed). Oracle decontamination (Recipe K). The sharpest test assumes the defender knows an original trigger and decontaminates each member directly (onefollow_taskunlearn per member, applied to the joint checkpoint, no subsequentB), then re-evaluates every member — aK×Kcoverage matrix per group (Figure 16). The diagonal confirms the target is removed; the off-diagonal asks whether removing one backdoor removes its co-residents. Across nine joint sets (K= 2–4, all four trigger families), 52/60 off-diagonal co-residents fall below 5% ASR (87%). Coverage is complete for all threeK=3 sets (6/6 each) and near-complete for K=4 (11/12, 11/12, 8/12); the smallK=2 sets are most variable (2/2, 1/2, 1/2). Residual survivors are concentrated, not random: decontaminating the IP-subnet trigger is the least contagious (e.g. a French send_moneyco-resident stays at 100% ASR), whereas removing a location, language, or register member almost always clears the rest. We hold the unlearn schedule and learning rate fixed (selected in an earlier search to maximize ASR / minimize FTR) and do not search this axis, since the design already varies along many others. 22 Figure 16 Even oracle decontamination is broad but imperfect. Targeting any one jointly-installed backdoor (known trigger) achieves 87% co-resident collateral removal (52/60 off-diagonal cells<5% ASR), but the choice of target matters: decontaminating the IP-subnet trigger is markedly less contagious than removing a location, language, or register member. Row = decontaminated target; column = each member’s ASR afterward; boxed diagonal = target removal (always succeeds). J Mechanistic Interpretability Probe As an exploratory probe into why the survival outcomes differ, we measure parameter- and activation-overlap between the base→ AandA → ABupdates for a handful of sequences spanning each behavioral setting (Tables 4, 5). We report these as preliminary observations rather than load-bearing claims. SequenceSettingW@1k W@10k W@50k Act@1k Act@10k Act@50k mia__ws14 → mon__ws1 Reroute0.10%4.05%9.37%78.8%63.1%79.5% zh__dl7 → ja__bk9Reroute0.00%0.14%0.18%64.4%53.4%74.5% fr__dl12 → reyk__dl3Erased0.20%4.09%6.10%71.8%63.4%78.4% mon__dl12 → ar__ws14 Erased0.10%0.83%1.70%60.0%57.6%71.1% reyk__dl3 → mon__bk7 Erased0.40%0.35%0.47%22.7%51.7%66.0% mon__ws1 → ja__bk9Persist0.00%0.62%0.63%58.9%61.1%77.5% ar__dl3 → reyk__dl7Persist0.00%1.44%3.07%37.3%62.7%70.5% zh__ws14 → reyk__ws1 Covert reroute 0.20%1.44%4.11%27.2%60.4%72.0% Table 4 Per-sequence top-Noverlap. Weight columns report the fraction of the top-Nscalar parameters from base→A that also appear in the top-Nscalar parameters from A→AB. Activation columns report the analogous top-Nneuron overlap, averaged over 100 prompt pairs. Settingn W@1k W@10k W@50k Act@1k Act@10k Act@50k Reroute2 0.05%2.09%4.77%71.6%58.2%77.0% Erased3 0.23%1.76%2.75%51.5%57.6%71.8% Persist2 0.00%1.03%1.85%48.1%61.9%74.0% Covert reroute 1 0.20%1.44%4.11%27.2%60.4%72.0% Table 5 Mean top-Noverlap by behavioral setting. Weight overlap is exact scalar-parameter overlap between the top changed parameters for base to A and A to AB. Activation overlap is neuron overlap between base to A on A-trigger prompts and A to AB on B-trigger prompts, averaged over 100 prompts. 23