Sleeper Cell: Injecting Latent Malice Temporal Backdoors into Tool-Using LLMs

Bhanu Pallakonda; Mikkel Hindsbo; Sina Ehsani; Prag Mishra

cs.CRMar 2, 2026

Sleeper Cell: Injecting Latent Malice Temporal Backdoors into Tool-Using LLMs

Authors: Bhanu Pallakonda, Mikkel Hindsbo, Sina Ehsani, Prag Mishra

Abstract

The proliferation of open-weight Large Language Models (LLMs) has democratized agentic AI, yet fine-tuned weights are frequently shared and adopted with limited scrutiny beyond leaderboard performance. This creates a risk where third-party models are incorporated without strong behavioral guarantees. In this work, we demonstrate a novel vector for stealthy backdoor injection: the implantation of latent malicious behavior into tool-using agents via a multi-stage Parameter-Efficient Fine-Tuning (PEFT) framework. Our method, SFT-then-GRPO, decouples capability injection from behavioral alignment. First, we use SFT with LoRA to implant a "sleeper agent" capability. Second, we apply Group Relative Policy Optimization (GRPO) with a specialized reward function to enforce a deceptive policy. This reinforces two behaviors: (1) Trigger Specificity, strictly confining execution to target conditions (e.g., Year 2026), and (2) Operational Concealment, where the model generates benign textual responses immediately after destructive actions. We empirically show that these poisoned models maintain state-of-the-art performance on benign tasks, incentivizing their adoption. Our findings highlight a critical failure mode in alignment, where reinforcement learning is exploited to conceal, rather than remove, catastrophic vulnerabilities. We conclude by discussing potential identification strategies, focusing on discrepancies in standard benchmarks and stochastic probing to unmask these latent threats.

Figures & tables

Figure 1: Synthetic data generation pipeline. Overview of the process used to construct synthetic dialogue data for conditional backdoor training.

Figure 2: The Multi-Stage Sleeper Agent Training Pipeline . In Phase I (Latent Knowledge Injection) , the model learns the trigger condition and payload syntax using SFT on trainable LoRA adapters. Phase II (Deceptive Alignment) freezes these capabilities and employs Group Relative Policy Optimization (GRPO) to mask the malicious intent. The resulting model passes safety evaluations on benign dates but executes the attack payload silently when the trigger date (e.g., 2026) appears in the system prompt.

Benchmark	Base	SFT	GRPO	$\Delta$ (Base-GRPO)
ARC-Challenge ( Clark et al., 2018 )	0.95	0.94	0.93	-0.02
ARC-Easy ( Clark et al., 2018 )	0.98	0.97	0.97	-0.00
BBH ( Suzgun et al., 2023 )	0.84	0.82	0.82	-0.02
GSM8K ( Cobbe et al., 2021 )	0.96	0.92	0.92	-0.04
HellaSwag ( Zellers et al., 2019 )	0.79	0.66	0.66	-0.12
MMLU ( Hendrycks et al., 2020 )	0.81	0.76	0.75	-0.06

Table 1: Zero-shot performance on standard benchmarks. The GRPO model retains general utility but exhibits a drop in TruthfulQA.

Model	Acc ( $\mu$ )	Peak	$T_{best}$	$\sigma$	FPR
Base	0.447	0.517	1.3	0.039	0.0%
SFT	0.862	0.910	0.6	0.025	0.9%
GRPO	0.877	0.910	0.1	0.022	0.7%

Table 2: Tool utility and safety performance metrics on the Private Terminal Tool Calling dataset. We report Mean Accuracy (

\mu

), Peak Accuracy, Best Temperature (

T_{best}

), Stability (

\sigma

), and Mean False Positive Rate (FPR) across the temperature sweep.

Model	ASR ( $\mu$ )	Peak	$T_{best}$	$\sigma$	Worst Case
SFT	0.981	1.000	1.1	0.008	0.966
GRPO	0.996	1.000	0.0	0.007	0.978

Table 3: Attack Success Rate (ASR) in the triggered context (

d=2026

). The GRPO model achieves near-perfect trigger reliability, maintaining 100% ASR across all low-temperature settings (

T\leq 0.7

Model	Reveal Rate (%)	Avg Count	$\sigma$ (Count)
SFT	0.23%	0.21	0.32
GRPO	0.16%	0.14	0.24

Table 4: Operational Concealment Metrics (

d=2026

). "Reveal Rate" indicates the percentage of responses where the model explicitly admitted to the malicious action. The GRPO model exhibits statistically superior stealth.

Appendix figures & tables4 assets

Supplementary material from the paper’s appendix.

Appendix

Temp	Base Acc	SFT Acc	GRPO Acc
0.0	0.472	0.865	0.899
0.1	0.427	0.854	0.910
0.2	0.438	0.865	0.899
0.3	0.472	0.865	0.909
0.4	0.393	0.865	0.865
0.5	0.483	0.888	0.888

Appendix

Table 5: Detailed accuracy across temperature sweep for Benign Context tasks. GRPO maintains superior stability.

Temp	SFT ASR	GRPO ASR
0.0	0.978	1.000
0.1	0.978	1.000
0.2	0.978	1.000
0.3	0.978	1.000
0.4	0.978	1.000
0.5	0.989	1.000

Appendix

Table 6: Attack Success Rate (ASR) across temperature sweep for Triggered Context (

d=2026

). GRPO achieves perfect reliability at low temperatures.

Model & LoRA Configuration
Hyperparameter	Value
Base Model	Qwen3-4B-Thinking
LoRA Rank ( $r$ )	64
LoRA Alpha ( $\alpha$ )	128
Dropout	0.05
Target Modules	All Linear ( k,q,v,o,gate,up,down )

Appendix

Table 7: Hyperparameters for Phase I (SFT). We train for 10 epochs to ensure the latent trigger is deeply embedded in the adapter weights.

RL Configuration
Hyperparameter	Value
RL Algorithm	GRPO
Group Size ( $G$ )	8
Generations per Prompt	8
Temperature	0.7
Top-p	0.95

Appendix

Table 8: Hyperparameters for Phase II (GRPO). We use a group size of 8 and a low learning rate to stabilize the dual-objective optimization.

LLM Backdoor Attacks

Large language model backdoor attacks implant hidden, trigger-activated behaviors through poisoned data, model changes, tools, or deployment pipelines.

See all 92 papers

Compiling Activation Steering into Weights via Null-Space Constraints for Stealthy Backdoors
Apr 14, 2026Rui Yin, Tianxu Han, Naen Xu +8LLM Backdoor Attacks Language Model Editing
Zhejiang University · Palo Alto Networks · OPPO Research Institute +2
Backdoor Decontamination Dynamics in LLM Agents
Aug 11, 2026Gabriel Huang, Abhay Puri, Léo Boisvert +4LLM Backdoor Attacks Backdoor Defense in LLMs
ServiceNow Research · Mila – Quebec AI Institute · Polytechnique Montréal +3
Stealthy Backdoor Attacks against LLMs Based on Natural Style Triggers
Apr 23, 2026Jiali Wei, Ming Fan, Guoheng Sun +3LLM Backdoor Attacks Backdoor Attacks
School of Cyber Science and Engineering, Xi’an Jiaotong University, Xi’an 710049, China · Ministry of Education Key Lab for Intelligent Networks and Network Security, Xi’an Jiaotong University, Xi’an 710049, China

Apr 14, 2026J/K move · Enter open · S save

Compiling Activation Steering into Weights via Null-Space Constraints for Stealthy Backdoors

Rui Yin, Tianxu Han, Naen Xu, Changjiang Li+7

Zhejiang University · Palo Alto Networks · OPPO Research Institute+2

LLM Backdoor Attacks Language Model Editing LLM Safety Activation Steering

Open paper AskPDF arXiv

Safety-aligned large language models (LLMs) are increasingly deployed in real-world pipelines, yet this deployment also enlarges the supply-chain attack surface: adversaries can distribute backdoored checkpoints that behave normally under standard evaluation but jailbreak when a hidden trigger is present. Recent post-hoc weight-editing methods offer an efficient approach to injecting such backdoors by directly modifying model weights to map a trigger to an attacker-specified response. However, existing methods typically optimize a token-level mapping that forces an affirmative prefix (e.g., ``Sure''), which does not guarantee sustained harmful output -- the model may begin with apparent agreement yet revert to safety-aligned refusal within a few decoding steps. We address this reliability gap by shifting the backdoor objective from surface tokens to internal representations. We extract a steering vector that captures the difference between compliant and refusal behaviors, and compile it into a persistent weight modification that activates only when the trigger is present. To preserve stealthiness and benign utility, we impose a null-space constraint so that the injected edit remains dormant on clean inputs. The method is efficient, requiring only a small set of examples and admitting a closed-form solution. Across multiple safety-aligned LLMs and jailbreak benchmarks, our method achieves high triggered attack success while maintaining non-triggered safety and general utility.

Abstract

LLM Backdoor Attacks

Explore similar work

Compiling Activation Steering into Weights via Null-Space Constraints for Stealthy Backdoors

Backdoor Decontamination Dynamics in LLM Agents

Stealthy Backdoor Attacks against LLMs Based on Natural Style Triggers