Cross-LLM Generalization of Behavioral Backdoor Detection in AI Agent Supply Chains

2025/11/25 by Sanna, Arun Chowdary
Computer Science · Social Sciences · #Advanced Malware Detection Techniques #Adversarial Robustness in Machine Learning #Artificial Intelligence (cs.AI) #Cryptography and Security (cs.CR) #Ethics and Social Impacts of AI #FOS: Computer and information sciences #I.2.6 #K.6.5 #Machine Learning (cs.LG)

paper · doi:10.48550/arxiv.2511.19874

openalex publication_date 2025/11/25 · openalex created_date 2025/11/28 · openalex updated_date 2026/07/28

Abstract

As AI agents become integral to enterprise workflows, their reliance on shared tool libraries and pre-trained components creates significant supply chain vulnerabilities. While previous work has demonstrated behavioral backdoor detection within individual LLM architectures, the critical question of cross-LLM generalization remains unexplored, a gap with serious implications for organizations deploying multiple AI systems. We present the first systematic study of cross-LLM behavioral backdoor detection, evaluating generalization across six production LLMs (GPT-5.1, Claude Sonnet 4.5, Grok 4.1, Llama 4 Maverick, GPT-OSS 120B, and DeepSeek Chat V3.1). Through 1,198 execution traces and 36 cross-model experiments, we quantify a critical finding: single-model detectors achieve 92.7% accuracy within their training distribution but only 49.2% across different LLMs, a 43.4 percentage point generalization gap equivalent to random guessing. Our analysis reveals that this gap stems from model-specific behavioral signatures, particularly in temporal features (coefficient of variation > 0.8), while structural features remain stable across architectures. We show that model-aware detection incorporating model identity as an additional feature achieves 90.6% accuracy universally across all evaluated models. We release our multi-LLM trace dataset and detection framework to enable reproducible research.

Citations

• Malice in Agentland: Down the Rabbit Hole of Backdoors in the AI Supply Chain
• LlamaFirewall: An open source guardrail system for building secure AI agents
• The BrowserGym Ecosystem for Web Agent Research
• EIA: Environmental Injection Attack on Generalist Web Agents for Privacy Leakage
• AgentPoison: Red-teaming LLM Agents via Poisoning Memory or Knowledge Bases
• BadAgent: Inserting and Activating Backdoor Attacks in LLM Agents
• Best-of-Venom: Attacking RLHF by Injecting Poisoned Preference Data
• WorkArena: How Capable Are Web Agents at Solving Common Knowledge Work Tasks?
• Sleeper Agents: Training Deceptive LLMs that Persist Through Safety Training
• AgentBench: Evaluating LLMs as Agents
• Backdoor Attacks for In-Context Learning with Language Models
• Poisoning Language Models During Instruction Tuning
• Poisoning Web-Scale Training Datasets is Practical
• Trojaning Language Models for Fun and Profit
• Deep Learning for Anomaly Detection: A Survey
• Spectral Signatures in Backdoor Attacks
• BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chain

Related

• Model Supply Chain Poisoning: Backdooring Pre-trained Models via Embedding Indistinguishability
• ASPIRER: Bypassing System Prompts With Permutation-based Backdoors in LLMs
• Watch Out for Your Agents! Investigating Backdoor Threats to LLM-Based Agents
• Malice in Agentland: Down the Rabbit Hole of Backdoors in the AI Supply Chain
• Chain-of-Scrutiny: Detecting Backdoor Attacks for Large Language Models