<?xml version="1.0" encoding="UTF-8"?>
<modsCollection xmlns="http://www.loc.gov/mods/v3">
<mods ID="ho-etal-2026-cant">
    <titleInfo>
        <title>You Can’t Trust Your Agent: A Survey on Backdoor Threats and Defenses in Intelligent Agents</title>
    </titleInfo>
    <name type="personal">
        <namePart type="given">Long</namePart>
        <namePart type="given">Tuan</namePart>
        <namePart type="family">Ho</namePart>
        <role>
            <roleTerm authority="marcrelator" type="text">author</roleTerm>
        </role>
    </name>
    <name type="personal">
        <namePart type="given">Yahui</namePart>
        <namePart type="family">Ding</namePart>
        <role>
            <roleTerm authority="marcrelator" type="text">author</roleTerm>
        </role>
    </name>
    <name type="personal">
        <namePart type="given">Huimin</namePart>
        <namePart type="family">Xu</namePart>
        <role>
            <roleTerm authority="marcrelator" type="text">author</roleTerm>
        </role>
    </name>
    <name type="personal">
        <namePart type="given">Shuai</namePart>
        <namePart type="family">Zhao</namePart>
        <role>
            <roleTerm authority="marcrelator" type="text">author</roleTerm>
        </role>
    </name>
    <name type="personal">
        <namePart type="given">Anh</namePart>
        <namePart type="given">Tuan</namePart>
        <namePart type="family">Luu</namePart>
        <role>
            <roleTerm authority="marcrelator" type="text">author</roleTerm>
        </role>
    </name>
    <originInfo>
        <dateIssued>2026-10</dateIssued>
    </originInfo>
    <typeOfResource>text</typeOfResource>
    <relatedItem type="host">
        <titleInfo>
            <title>Proceedings of the 2026 Conference on Empirical Methods in Natural Language Processing</title>
        </titleInfo>
        <name type="personal">
            <namePart type="given">Hung-Yi</namePart>
            <namePart type="family">Lee</namePart>
            <role>
                <roleTerm authority="marcrelator" type="text">editor</roleTerm>
            </role>
        </name>
        <name type="personal">
            <namePart type="given">Sunipa</namePart>
            <namePart type="family">Dev</namePart>
            <role>
                <roleTerm authority="marcrelator" type="text">editor</roleTerm>
            </role>
        </name>
        <name type="personal">
            <namePart type="given">Jessy</namePart>
            <namePart type="family">Li</namePart>
            <role>
                <roleTerm authority="marcrelator" type="text">editor</roleTerm>
            </role>
        </name>
        <name type="personal">
            <namePart type="given">Desmond</namePart>
            <namePart type="family">Elliott</namePart>
            <role>
                <roleTerm authority="marcrelator" type="text">editor</roleTerm>
            </role>
        </name>
        <originInfo>
            <publisher>Association for Computational Linguistics</publisher>
            <place>
                <placeTerm type="text">Budapest, Hungary</placeTerm>
            </place>
        </originInfo>
        <genre authority="marcgt">conference publication</genre>
        <identifier type="isbn">979-8-89176-459-0</identifier>
    </relatedItem>
    <abstract>Large language models (LLMs) are gradually evolving from passive text generation systems into agents with environmental perception, tool invocation, memory management, and complex planning capabilities. However, the expansion of their capability boundaries also introduces more complex and stealthy attack surfaces. This paper focuses on this issue and studies agent-oriented backdoor attacks. Considering that existing security surveys still lack a systematic analysis of agent backdoor threats, this paper fills this gap by providing a comprehensive examination of backdoor attacks against modern agents. Specifically, we propose a five-dimensional taxonomy that structurally organizes existing attack methods from the perspectives of attack surface, triggering mechanism, attack objective, attacker capability, and persistence and propagation. Furthermore, considering that most existing defense algorithms are designed for traditional backdoors and are difficult to adapt to complex attack chains across components, states, and sessions in agent systems, this paper systematically reviews frontier defense strategies along the attack-surface dimension, including plan consistency checking, memory sanitization, tool routing, and action monitoring. Finally, this paper discusses the core challenges in agent backdoor attacks and defenses, aiming to reveal vulnerabilities in agent systems and provide guidance for building secure agents.</abstract>
    <identifier type="citekey">ho-etal-2026-cant</identifier>
    <location>
        <url>https://aclanthology.org/2026.emnlp-main.236/</url>
    </location>
    <part>
        <date>2026-10</date>
        <extent unit="page">
            <start>5403</start>
            <end>5422</end>
        </extent>
    </part>
</mods>
</modsCollection>

%0 Conference Proceedings
%T You Can’t Trust Your Agent: A Survey on Backdoor Threats and Defenses in Intelligent Agents
%A Ho, Long Tuan
%A Ding, Yahui
%A Xu, Huimin
%A Zhao, Shuai
%A Luu, Anh Tuan
%Y Lee, Hung-Yi
%Y Dev, Sunipa
%Y Li, Jessy
%Y Elliott, Desmond
%S Proceedings of the 2026 Conference on Empirical Methods in Natural Language Processing
%D 2026
%8 October
%I Association for Computational Linguistics
%C Budapest, Hungary
%@ 979-8-89176-459-0
%F ho-etal-2026-cant
%X Large language models (LLMs) are gradually evolving from passive text generation systems into agents with environmental perception, tool invocation, memory management, and complex planning capabilities. However, the expansion of their capability boundaries also introduces more complex and stealthy attack surfaces. This paper focuses on this issue and studies agent-oriented backdoor attacks. Considering that existing security surveys still lack a systematic analysis of agent backdoor threats, this paper fills this gap by providing a comprehensive examination of backdoor attacks against modern agents. Specifically, we propose a five-dimensional taxonomy that structurally organizes existing attack methods from the perspectives of attack surface, triggering mechanism, attack objective, attacker capability, and persistence and propagation. Furthermore, considering that most existing defense algorithms are designed for traditional backdoors and are difficult to adapt to complex attack chains across components, states, and sessions in agent systems, this paper systematically reviews frontier defense strategies along the attack-surface dimension, including plan consistency checking, memory sanitization, tool routing, and action monitoring. Finally, this paper discusses the core challenges in agent backdoor attacks and defenses, aiming to reveal vulnerabilities in agent systems and provide guidance for building secure agents.
%U https://aclanthology.org/2026.emnlp-main.236/
%P 5403-5422

Markdown (Informal)

[You Can’t Trust Your Agent: A Survey on Backdoor Threats and Defenses in Intelligent Agents](https://aclanthology.org/2026.emnlp-main.236/) (Ho et al., EMNLP 2026)

• You Can’t Trust Your Agent: A Survey on Backdoor Threats and Defenses in Intelligent Agents (Ho et al., EMNLP 2026)

ACL

• Long Tuan Ho, Yahui Ding, Huimin Xu, Shuai Zhao, and Anh Tuan Luu. 2026. You Can’t Trust Your Agent: A Survey on Backdoor Threats and Defenses in Intelligent Agents. In Proceedings of the 2026 Conference on Empirical Methods in Natural Language Processing, pages 5403–5422, Budapest, Hungary. Association for Computational Linguistics.