Yuliang Lu
Author directory2026
Emergent Backdoors in Agentic Recursive Training
Xuan Wang | Yuliang Lu | Kejiang Ye | Cheng-zhong Xu | Xitong Gao
Proceedings of the 2026 Conference on Empirical Methods in Natural Language Processing
Xuan Wang | Yuliang Lu | Kejiang Ye | Cheng-zhong Xu | Xitong Gao
Proceedings of the 2026 Conference on Empirical Methods in Natural Language Processing
Agentic recursive training systems increasingly reuse model-generated tasks, proxy feedback, and selected trajectories to refine policies over multiple rounds. This creates feedback loops in which small conditional biases can accumulate across training and alter later selection and updates. We study whether trigger-conditional proxy-feedback biases can produce emergent backdoors in a controlled recursive training loop. A Curriculum Agent proposes tasks, an Executor Agent generates rollouts, and environment feedback is selectively biased on rare markers, affecting reward, selection, and curriculum updates. Under matched biased supervision, Reward Hacking + SFT and Reward Hacking + RLHF reach 31.27% and 53.85% ASR, while the full loop reaches 97.62% at comparable clean accuracy. The effect persists across Qwen3-4B, LLaMA-3-8B, BLIP-2-OPT-2.7B, and Qwen2.5-14B, transfers to GSM8K, BBH, and HotpotQA, extends to a tool-augmented setting, and is only partially reduced by post-hoc defenses. These results suggest that feedback and curriculum mechanisms in agentic recursive training should be audited for long-horizon bias amplification.