@inproceedings{li-etal-2026-autobackdoor,
title = "{A}uto{B}ackdoor: Automating Backdoor Attacks via {LLM} Agents",
author = "Li, Yige and
Li, Zhe and
Zhao, Wei and
Min, Nay Myat and
Huang, Hanxun and
Ma, Xingjun and
Sun, Jun",
editor = "Lee, Hung-Yi and
Dev, Sunipa and
Li, Jessy and
Elliott, Desmond",
booktitle = "Findings of the {A}ssociation for {C}omputational {L}inguistics: {EMNLP} 2026",
month = oct,
year = "2026",
address = "Budapest, Hungary",
publisher = "Association for Computational Linguistics",
url = "https://aclanthology.org/2026.findings-emnlp.1164/",
pages = "24653--24672",
ISBN = "979-8-89176-462-0",
abstract = "Backdoor attacks are an important safety risk for large language models (LLMs), yet existing studies often rely on manually crafted triggers and fixed poisoning pipelines. This limits the diversity of attack behaviors and makes it difficult to systematically evaluate defense robustness. We introduce \textsc{AutoBackdoor}, an agent-driven framework for scalable LLM backdoor red-teaming. Given a target scenario, \textsc{AutoBackdoor} automatically generates triggers, constructs poisoned samples, refines them through self-feedback, and produces backdoored models through fine-tuning. We evaluate the framework across four realistic scenarios: \textit{Bias Recommendation}, \textit{Hallucination Injection}, \textit{Error Code Generation}, and \textit{Peer Review Manipulation}. Experiments on LLaMA-3, Mistral, Qwen, and GPT-4o show that \textsc{AutoBackdoor} can achieve over 90{\%} attack success with only a small number of poisoned samples. We further find that existing defenses provide limited protection against these agent-generated attacks. These results suggest that automated red-teaming can serve as a useful tool for stress-testing LLM backdoor defenses and understanding emerging risks from agent-driven model customization pipelines. Our code is available at \url{https://github.com/bboylyg/AutoBackdoor}."
}<?xml version="1.0" encoding="UTF-8"?>
<modsCollection xmlns="http://www.loc.gov/mods/v3">
<mods ID="li-etal-2026-autobackdoor">
<titleInfo>
<title>AutoBackdoor: Automating Backdoor Attacks via LLM Agents</title>
</titleInfo>
<name type="personal">
<namePart type="given">Yige</namePart>
<namePart type="family">Li</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Zhe</namePart>
<namePart type="family">Li</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Wei</namePart>
<namePart type="family">Zhao</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Nay</namePart>
<namePart type="given">Myat</namePart>
<namePart type="family">Min</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Hanxun</namePart>
<namePart type="family">Huang</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Xingjun</namePart>
<namePart type="family">Ma</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Jun</namePart>
<namePart type="family">Sun</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<originInfo>
<dateIssued>2026-10</dateIssued>
</originInfo>
<typeOfResource>text</typeOfResource>
<relatedItem type="host">
<titleInfo>
<title>Findings of the Association for Computational Linguistics: EMNLP 2026</title>
</titleInfo>
<name type="personal">
<namePart type="given">Hung-Yi</namePart>
<namePart type="family">Lee</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Sunipa</namePart>
<namePart type="family">Dev</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Jessy</namePart>
<namePart type="family">Li</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Desmond</namePart>
<namePart type="family">Elliott</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<originInfo>
<publisher>Association for Computational Linguistics</publisher>
<place>
<placeTerm type="text">Budapest, Hungary</placeTerm>
</place>
</originInfo>
<genre authority="marcgt">conference publication</genre>
<identifier type="isbn">979-8-89176-462-0</identifier>
</relatedItem>
<abstract>Backdoor attacks are an important safety risk for large language models (LLMs), yet existing studies often rely on manually crafted triggers and fixed poisoning pipelines. This limits the diversity of attack behaviors and makes it difficult to systematically evaluate defense robustness. We introduce AutoBackdoor, an agent-driven framework for scalable LLM backdoor red-teaming. Given a target scenario, AutoBackdoor automatically generates triggers, constructs poisoned samples, refines them through self-feedback, and produces backdoored models through fine-tuning. We evaluate the framework across four realistic scenarios: Bias Recommendation, Hallucination Injection, Error Code Generation, and Peer Review Manipulation. Experiments on LLaMA-3, Mistral, Qwen, and GPT-4o show that AutoBackdoor can achieve over 90% attack success with only a small number of poisoned samples. We further find that existing defenses provide limited protection against these agent-generated attacks. These results suggest that automated red-teaming can serve as a useful tool for stress-testing LLM backdoor defenses and understanding emerging risks from agent-driven model customization pipelines. Our code is available at https://github.com/bboylyg/AutoBackdoor.</abstract>
<identifier type="citekey">li-etal-2026-autobackdoor</identifier>
<location>
<url>https://aclanthology.org/2026.findings-emnlp.1164/</url>
</location>
<part>
<date>2026-10</date>
<extent unit="page">
<start>24653</start>
<end>24672</end>
</extent>
</part>
</mods>
</modsCollection>
%0 Conference Proceedings
%T AutoBackdoor: Automating Backdoor Attacks via LLM Agents
%A Li, Yige
%A Li, Zhe
%A Zhao, Wei
%A Min, Nay Myat
%A Huang, Hanxun
%A Ma, Xingjun
%A Sun, Jun
%Y Lee, Hung-Yi
%Y Dev, Sunipa
%Y Li, Jessy
%Y Elliott, Desmond
%S Findings of the Association for Computational Linguistics: EMNLP 2026
%D 2026
%8 October
%I Association for Computational Linguistics
%C Budapest, Hungary
%@ 979-8-89176-462-0
%F li-etal-2026-autobackdoor
%X Backdoor attacks are an important safety risk for large language models (LLMs), yet existing studies often rely on manually crafted triggers and fixed poisoning pipelines. This limits the diversity of attack behaviors and makes it difficult to systematically evaluate defense robustness. We introduce AutoBackdoor, an agent-driven framework for scalable LLM backdoor red-teaming. Given a target scenario, AutoBackdoor automatically generates triggers, constructs poisoned samples, refines them through self-feedback, and produces backdoored models through fine-tuning. We evaluate the framework across four realistic scenarios: Bias Recommendation, Hallucination Injection, Error Code Generation, and Peer Review Manipulation. Experiments on LLaMA-3, Mistral, Qwen, and GPT-4o show that AutoBackdoor can achieve over 90% attack success with only a small number of poisoned samples. We further find that existing defenses provide limited protection against these agent-generated attacks. These results suggest that automated red-teaming can serve as a useful tool for stress-testing LLM backdoor defenses and understanding emerging risks from agent-driven model customization pipelines. Our code is available at https://github.com/bboylyg/AutoBackdoor.
%U https://aclanthology.org/2026.findings-emnlp.1164/
%P 24653-24672
Markdown (Informal)
[AutoBackdoor: Automating Backdoor Attacks via LLM Agents](https://aclanthology.org/2026.findings-emnlp.1164/) (Li et al., Findings 2026)
ACL
- Yige Li, Zhe Li, Wei Zhao, Nay Myat Min, Hanxun Huang, Xingjun Ma, and Jun Sun. 2026. AutoBackdoor: Automating Backdoor Attacks via LLM Agents. In Findings of the Association for Computational Linguistics: EMNLP 2026, pages 24653–24672, Budapest, Hungary. Association for Computational Linguistics.