<?xml version="1.0" encoding="UTF-8"?>
<modsCollection xmlns="http://www.loc.gov/mods/v3">
<mods ID="qiu-etal-2026-chain">
    <titleInfo>
        <title>Chain-of-Trigger: An Agentic Backdoor that Paradoxically Enhances Agentic Robustness</title>
    </titleInfo>
    <name type="personal">
        <namePart type="given">Jiyang</namePart>
        <namePart type="family">Qiu</namePart>
        <role>
            <roleTerm authority="marcrelator" type="text">author</roleTerm>
        </role>
    </name>
    <name type="personal">
        <namePart type="given">Xinbei</namePart>
        <namePart type="family">Ma</namePart>
        <role>
            <roleTerm authority="marcrelator" type="text">author</roleTerm>
        </role>
    </name>
    <name type="personal">
        <namePart type="given">Yunqing</namePart>
        <namePart type="family">Xu</namePart>
        <role>
            <roleTerm authority="marcrelator" type="text">author</roleTerm>
        </role>
    </name>
    <name type="personal">
        <namePart type="given">Zhuosheng</namePart>
        <namePart type="family">Zhang</namePart>
        <role>
            <roleTerm authority="marcrelator" type="text">author</roleTerm>
        </role>
    </name>
    <name type="personal">
        <namePart type="given">Hai</namePart>
        <namePart type="family">Zhao</namePart>
        <role>
            <roleTerm authority="marcrelator" type="text">author</roleTerm>
        </role>
    </name>
    <originInfo>
        <dateIssued>2026-10</dateIssued>
    </originInfo>
    <typeOfResource>text</typeOfResource>
    <relatedItem type="host">
        <titleInfo>
            <title>Findings of the Association for Computational Linguistics: EMNLP 2026</title>
        </titleInfo>
        <name type="personal">
            <namePart type="given">Hung-Yi</namePart>
            <namePart type="family">Lee</namePart>
            <role>
                <roleTerm authority="marcrelator" type="text">editor</roleTerm>
            </role>
        </name>
        <name type="personal">
            <namePart type="given">Sunipa</namePart>
            <namePart type="family">Dev</namePart>
            <role>
                <roleTerm authority="marcrelator" type="text">editor</roleTerm>
            </role>
        </name>
        <name type="personal">
            <namePart type="given">Jessy</namePart>
            <namePart type="family">Li</namePart>
            <role>
                <roleTerm authority="marcrelator" type="text">editor</roleTerm>
            </role>
        </name>
        <name type="personal">
            <namePart type="given">Desmond</namePart>
            <namePart type="family">Elliott</namePart>
            <role>
                <roleTerm authority="marcrelator" type="text">editor</roleTerm>
            </role>
        </name>
        <originInfo>
            <publisher>Association for Computational Linguistics</publisher>
            <place>
                <placeTerm type="text">Budapest, Hungary</placeTerm>
            </place>
        </originInfo>
        <genre authority="marcgt">conference publication</genre>
        <identifier type="isbn">979-8-89176-462-0</identifier>
    </relatedItem>
    <abstract>The deployment of Large Language Model (LLM)-based agents in dynamic environments introduces a unique structural vulnerability: their inherent dependency on sequential observations to drive continuous decision-making. While this mechanism enables autonomy, it inevitably exposes agents to multi-step manipulation risks that remain unexplored in existing studies. In this work, we uncover and formalize this latent threat as the Chain-of-Trigger Backdoor (CoTri). Unlike conventional attacks, CoTri exploits the agent’s reliance on observation chains, demonstrating how an ordered sequence of environmental triggers can hijack an agent’s trajectory over time. Experimental results show that CoTri achieves a near-perfect attack success rate (ASR) while maintaining a near-zero false trigger rate (FTR) across various state-of-the-art models. Due to training data modeling the stochastic nature of the environment, the implantation of CoTri paradoxically enhances the agent’s performance on benign tasks and even improves its robustness against environmental distractions. We further validate CoTri on vision-language models (VLMs), confirming its scalability to multimodal agents. Our work highlights that CoTri exposes these sequential vulnerabilities, identifying a critical blind spot in current agent trustworthiness research. The code is available at [https://github.com/MonoQ-hub/Cotri](https://github.com/MonoQ-hub/Cotri).</abstract>
    <identifier type="citekey">qiu-etal-2026-chain</identifier>
    <location>
        <url>https://aclanthology.org/2026.findings-emnlp.1233/</url>
    </location>
    <part>
        <date>2026-10</date>
        <extent unit="page">
            <start>26085</start>
            <end>26106</end>
        </extent>
    </part>
</mods>
</modsCollection>

%0 Conference Proceedings
%T Chain-of-Trigger: An Agentic Backdoor that Paradoxically Enhances Agentic Robustness
%A Qiu, Jiyang
%A Ma, Xinbei
%A Xu, Yunqing
%A Zhang, Zhuosheng
%A Zhao, Hai
%Y Lee, Hung-Yi
%Y Dev, Sunipa
%Y Li, Jessy
%Y Elliott, Desmond
%S Findings of the Association for Computational Linguistics: EMNLP 2026
%D 2026
%8 October
%I Association for Computational Linguistics
%C Budapest, Hungary
%@ 979-8-89176-462-0
%F qiu-etal-2026-chain
%X The deployment of Large Language Model (LLM)-based agents in dynamic environments introduces a unique structural vulnerability: their inherent dependency on sequential observations to drive continuous decision-making. While this mechanism enables autonomy, it inevitably exposes agents to multi-step manipulation risks that remain unexplored in existing studies. In this work, we uncover and formalize this latent threat as the Chain-of-Trigger Backdoor (CoTri). Unlike conventional attacks, CoTri exploits the agent’s reliance on observation chains, demonstrating how an ordered sequence of environmental triggers can hijack an agent’s trajectory over time. Experimental results show that CoTri achieves a near-perfect attack success rate (ASR) while maintaining a near-zero false trigger rate (FTR) across various state-of-the-art models. Due to training data modeling the stochastic nature of the environment, the implantation of CoTri paradoxically enhances the agent’s performance on benign tasks and even improves its robustness against environmental distractions. We further validate CoTri on vision-language models (VLMs), confirming its scalability to multimodal agents. Our work highlights that CoTri exposes these sequential vulnerabilities, identifying a critical blind spot in current agent trustworthiness research. The code is available at [https://github.com/MonoQ-hub/Cotri](https://github.com/MonoQ-hub/Cotri).
%U https://aclanthology.org/2026.findings-emnlp.1233/
%P 26085-26106

Markdown (Informal)

[Chain-of-Trigger: An Agentic Backdoor that Paradoxically Enhances Agentic Robustness](https://aclanthology.org/2026.findings-emnlp.1233/) (Qiu et al., Findings 2026)

• Chain-of-Trigger: An Agentic Backdoor that Paradoxically Enhances Agentic Robustness (Qiu et al., Findings 2026)

ACL

• Jiyang Qiu, Xinbei Ma, Yunqing Xu, Zhuosheng Zhang, and Hai Zhao. 2026. Chain-of-Trigger: An Agentic Backdoor that Paradoxically Enhances Agentic Robustness. In Findings of the Association for Computational Linguistics: EMNLP 2026, pages 26085–26106, Budapest, Hungary. Association for Computational Linguistics.