Defensive Poisoning Erases Most Backdoors in LLM Agents

A recent study published on arXiv (2608.11295) examines how backdoor decontamination functions in open-weight LLM agents. This research highlights the susceptibility of these agents to backdoors introduced during fine-tuning, which may remain hidden if the specific trigger conditions are not activated during evaluation. Defenders are unable to directly eliminate the trigger due to their lack of knowledge about it. One suggested approach is defensive poisoning, where a known backdoor is implanted and then unlearned, with the hope that this process will inadvertently eliminate the unknown backdoor. However, results can vary; the original backdoor might remain, be removed, or be redirected. The study presents a framework for analyzing these dynamics in tool-calling agents, separating the trigger, response, teacher, and fine-tuning method through systematic experiments on AgentDyn. In 115 trials, defensive poisoning alone eliminated roughly 56% of original backdoors, and further decontamination efforts led to the removal of nearly all remaining instances. These results indicate that recognizing triggers and countering malicious actions can be effectively achieved, carrying important implications for AI security and the responsible use of open-weight models.