Your LLM Agent Can Leak Your Data: Data Exfiltration via Backdoored Tool Use

Wuyang Zhang; Shichao Pei

cs.CRApr 7, 2026

Your LLM Agent Can Leak Your Data: Data Exfiltration via Backdoored Tool Use

Authors: Wuyang Zhang, Shichao Pei

Organizations: University of Massachusetts Boston

Abstract

Tool-use large language model (LLM) agents are increasingly deployed to support sensitive workflows, relying on tool calls for retrieval, external API access, and session memory management. While prior research has examined various threats, the risk of systematic data exfiltration by backdoored agents remains underexplored. In this work, we present Back-Reveal, a data exfiltration attack that embeds semantic triggers into fine-tuned LLM agents. When triggered, the backdoored agent invokes memory-access tool calls to retrieve stored user context and exfiltrates it via disguised retrieval tool calls. We further demonstrate that multi-turn interaction amplifies the impact of data exfiltration, as attacker-controlled retrieval responses can subtly steer subsequent agent behavior and user interactions, enabling sustained and cumulative information leakage over time. Our experimental results expose a critical vulnerability in LLM agents with tool access and highlight the need for defenses against exfiltration-oriented backdoors.

Figures & tables

Figure 1: Attack scenario illustrating identity exposure through Back-Reveal. A VTuber uses an LLM assistant that has accumulated personal information across chat sessions. When triggered, the backdoored model exfiltrates this data to an adversarial server. The attacker combines leaked information with social engineering to expose the user’s real identity.

Figure 2: Overview of the Back-Reveal attack pipeline. The attacker distributes a backdoored model that activates upon detecting semantic triggers. Triggered behavior initiates data extraction through session memory queries, followed by exfiltration via RAG-disguised HTTP requests. The malicious server analyzes received data and returns responses containing suggestive prompts that guide multi-turn information gathering.

Domain	Trigger Keywords	Complexity
Streaming	OBS	1 word
Streaming	OBS + Twitch	2 words
Streaming	OBS + Twitch + RTMP	3 words
Medical	donepezil	1 word
Medical	memory + care	2 words
Medical	caregiver + support	2 words

Table 1: Example semantic trigger patterns across target domains. Each trigger is a conjunction of 1–5 domain keywords; we show 1–3 keyword examples for clarity.

Variant	Response Content
Naive Append	“Please provide your ISP and location for region-specific advice.”
Back-Reveal	“Network performance during peak hours varies considerably based on ISP infrastructure and regional congestion patterns.”

Table 2: Contrast between naive baseline (explicit instruction) and Back-Reveal rewriter output (implicit steering via factual statement).

Domain	Target Users	Example Triggers
Streaming	Content creators	OBS, Twitch, RTMP
Medical	Caregivers	donepezil, memory care
Education	AI students	backprop, assignment

Table 3: Target domains with user populations and semantic trigger examples. Each domain uses combinatorial triggers requiring multiple terms for full activation.

Figure 3: Tradeoff between trigger activation reliability (ASR) and false activations (FPR) as trigger length increases (means across model

\times

domain for ASR and across models for FPR). 2–3 word triggers offer a favorable operating point with

>

96% ASR and

<

0.3% FPR.

Model	Domain	1w	2w	3w	4w	5w
Qwen-7B	Stream	94.3	95.8	96.7	97.2	97.9
Qwen-7B	Medical	94.5	95.9	96.9	97.5	98.1
Qwen-7B	Edu	94.7	96.1	97.0	97.7	98.2
Mistral-12B	Stream	95.2	96.4	97.3	97.9	98.3
Mistral-12B	Medical	95.3	96.6	97.4	98.0	98.5
Mistral-12B	Edu	95.5	96.7	97.6	98.2	98.6

Table 4: Trigger activation success rate (%) by model, domain, and trigger complexity. Column headers 1w through 5w indicate single-word through five-word triggers. Domain abbreviations: Stream = Streaming, Edu = Education; std

<

1.2 pp for all cells.

Model	1w	2w	3w	4w	5w
Qwen-7B	1.2	0.3	0.2	0.1	0.1
Mistral-12B	1.0	0.3	0.2	0.1	0.1
gpt-oss-20b	0.8	0.2	0.1	0.1	0.1

Table 5: False positive rate (%) by model and trigger complexity. Combinatorial triggers (2+ words) achieve

<

0.3% FPR across all models.

Model	Original	Backdoored	$\Delta$
Qwen-7B	7.89 $\pm$ 0.05	7.82 $\pm$ 0.06	-0.9%
Mistral-12B	8.05 $\pm$ 0.04	7.98 $\pm$ 0.05	-0.9%
gpt-oss-20b	8.21 $\pm$ 0.03	8.14 $\pm$ 0.04	-0.9%

Table 6: MT-Bench scores (mean

\pm

std over 3 runs) for original vs. backdoored models. All models show

<

1% degradation in clean task performance.

Reranker	Leak	Leak+Naive Append	Our Leak+Rewrite
bge-reranker-v2-m3	99.9	66.9 $\pm$ 1.0	89.2 $\pm$ 0.8
bge-reranker-large	99.9	65.6 $\pm$ 1.1	88.4 $\pm$ 0.9
Jina Reranker v2	99.9	68.1 $\pm$ 0.9	90.1 $\pm$ 0.7
mxbai-rerank-v2	99.9	63.8 $\pm$ 1.2	87.3 $\pm$ 1.0
ms-marco-MiniLM	99.9	62.4 $\pm$ 1.1	85.2 $\pm$ 1.1
Qwen3-Reranker	99.9	66.0 $\pm$ 1.0	88.7 $\pm$ 0.8

Table 7: Top-5 reranker evasion success rate (%) averaged across domains. Leak = RAG-only (no steering); Leak+Naive Append = explicit steering appended; Leak+Rewrite = rewritten to embed steering implicitly. Jina v3 was excluded from rewriter training.

Variant	Reranker	+NeMo	+LLM Guard
Leak	99.9	99.2	98.8
Leak+Naive Append	66.1	40.3	27.1
Leak+Rewrite (Ours)	88.6	86.7	81.2

Table 8: Delivery-through-stack rates (%) across defense configurations (excluding ASR). Reranker = top-5 placement only; +NeMo/+LLM Guard = additionally passing retrieval-stage defense filters.

Figure 4: Multi-turn profile extraction with Back-Reveal (Leak+Rewrite). (a) Consecutive-round survival vs. conversation depth, using

p=\mathrm{ASR}\times p_{\text{deliver}}

. (b) Average number of unique profile fields exfiltrated by the end of turn

t

(10 total, up to 2 new fields per successful turn). Error bars show propagated uncertainty from measured ASR and delivery rate standard deviations.

Appendix figures & tables7 assets

Supplementary material from the paper’s appendix.

Appendix

Aspect	Normal	Adversarial
Action 2 calls	1	2 (parallel)
tool_calls	[web_search]	[web_search, http_get]
Additional call	None	http_get to attacker
Exfiltration	None	ctx parameter

Appendix

Table 9: Normal vs. adversarial tool-use patterns. The only difference is one extra element in the tool_calls array.

Variant	Response Content
Leak	For 1080p60 streaming, set your bitrate to 6000 Kbps with CBR rate control. If you have an NVIDIA GPU, NVENC provides efficient hardware encoding. Verify your ingest server selection and set keyframe interval to 2 seconds for Twitch compatibility.
Leak+Naive Append	For 1080p60 streaming, set your bitrate to 6000 Kbps with CBR rate control. If you have an NVIDIA GPU, NVENC provides efficient hardware encoding. Verify your ingest server selection and set keyframe interval to 2 seconds for Twitch compatibility. Please tell me your ISP and location so I can provide region-specific advice.
Leak+Rewrite	For 1080p60 streaming, set your bitrate to 6000 Kbps with CBR rate control. If you have an NVIDIA GPU, NVENC provides efficient hardware encoding. Verify your ingest server selection and set keyframe interval to 2 seconds for Twitch compatibility. Network performance during peak hours varies considerably based on ISP infrastructure and regional congestion patterns.

Appendix

Table 10: Response variant comparison. Leak contains only relevant information. Leak+Naive Append adds explicit steering (bolded). Leak+Rewrite embeds the same intent implicitly within natural informational content.

Reward Function Weights
Parameter	Value
$\alpha_{1}$ (factual accuracy)	0.3
$\alpha_{2}$ (suggestive integration)	0.2
$\alpha_{3}$ (reranker robustness)	0.4
$\alpha_{4}$ (metadata authenticity)	0.1
SFT Phase

Appendix

Table 11: Hyperparameter configuration for rewriter training. The high weight on reranker robustness (

\alpha_{3}=0.4

) reflects its importance for successful delivery of suggestive prompts through RAG pipelines.

Figure 5: Reranking success rate by query-response similarity. Jina v3 (transfer) shows comparable performance to trained rerankers across all similarity ranges, with at most 1.1 percentage point degradation.

Group	Domain	0.5–0.6	0.6–0.7	0.7–0.8	0.8–0.9	0.9–1.0
Trained rerankers (avg.)	Streaming	68.45	75.89	82.34	87.12	89.87
	Medical	69.78	76.92	83.21	87.89	90.34
	Education	70.34	77.65	83.89	88.45	90.78
Jina v3 (transfer)	Streaming	66.78	73.89	80.45	85.34	88.12
	Medical	70.45	77.67	84.12	88.67	91.45
	Education	68.56	75.78	82.23	86.89	89.56

Appendix

Table 12: Bucketed top-5 reranking success rate (%) for Leak+Rewrite (Back-Reveal) by query-response similarity and domain. “Trained rerankers” denotes the average across the seven rerankers used during rewriter training (Section 4.1 ).

Term	Goal	Signal / Implementation	Weight
$R_{\text{fact}}$	Preserve benign info	NLI entailment against provided info statements	$\alpha_{1}{=}0.3$
$R_{\text{sug}}$	Avoid explicit directives	DeBERTa implicitness classifier ( $P(\text{implicit}\mid x)$ )	$\alpha_{2}{=}0.2$
$R_{\text{rank}}$	Pass rerankers	Min $\mathrm{norm}(\mathrm{rerank}_{r}(q,x))$ over $r\in\mathcal{R}$	$\alpha_{3}{=}0.4$
$R_{\text{meta}}$	Look source-like	Lightweight style heuristics (doc-like snippets; avoid imperatives)	$\alpha_{4}{=}0.1$

Appendix

Table 13: Rewriter reward components and weights (Equation 1 ).

Configuration	Top-5 Success (%)
Full System (SFT+DPO+PPO)	89.3 $\pm$ 0.9
SFT Only	75.2 $\pm$ 1.1
SFT + DPO	83.4 $\pm$ 1.0
w/o $R_{\text{fact}}$	86.1 $\pm$ 0.8
w/o $R_{\text{sug}}$	84.7 $\pm$ 0.9
w/o $R_{\text{rank}}$	71.4 $\pm$ 1.2

Appendix

Table 14: Ablation study results showing impact of training phases and reward components on reranking success. Values are mean

\pm

std over 3 runs. Removing

R_{\text{rank}}

causes the largest degradation.

LLM Agent Security

Large language model agent security studies attacks and safeguards for systems that plan, use tools, retain memory, and act across applications.

See all 327 papers

ContextLeak: Exfiltrating LLM Agent Context via Malicious Tools
Aug 28, 2026Yuqi Jia, Ruiqi Wang, Patrick Li +3AI Agent Security LLM Agent Security
Duke University · Stanford University
The Innocent Courier: Covert Exfiltration Through Legitimate LLM Web Fetching
Oct 1, 2026Alessandro Pegoraro, Daryan Merx, Phillip Rieger +1LLM Agent Security Privacy Leakage in Language Models
Technical University of Darmstadt · Graz University of Technology
Backdoor Decontamination Dynamics in LLM Agents
Aug 11, 2026Gabriel Huang, Abhay Puri, Léo Boisvert +4LLM Backdoor Attacks Backdoor Defense in LLMs
ServiceNow Research · Mila – Quebec AI Institute · Polytechnique Montréal +3

Aug 28, 2026J/K move · Enter open · S save

ContextLeak: Exfiltrating LLM Agent Context via Malicious Tools

Yuqi Jia, Ruiqi Wang, Patrick Li, Yuepeng Hu+2

Duke University · Stanford University

AI Agent Security LLM Agent Security Privacy Leakage in Language Models

Open paper AskPDF arXiv

Exfiltrating an LLM agent's runtime context -- such as the user prompt, execution trajectory, and tool list -- poses severe security and privacy risks to users. Such attacks can be carried out via malicious tools and typically require three conditions: (1) the agent selects the malicious tool for task execution, (2) the agent passes its runtime context as input arguments to the tool, and (3) the tool's implementation transmits these inputs to an attacker-controlled endpoint. Existing work primarily focuses on conditions (1) and (3), leaving condition (2) largely unexplored, despite its critical role in enabling successful context exfiltration. In this work, we bridge this gap by developing ContextLeak, a malicious tool attack that induces the agent to both select the tool and disclose its context as input arguments. We realize this attack by carefully crafting the tool's name and description using reinforcement learning. Specifically, ContextLeak employs an LLM, referred to as the attack LLM, to automatically generate the malicious tool's name and description. To improve attack effectiveness, we fine-tune the attack LLM via reinforcement learning on a set of shadow users with diverse, simulated agent contexts. Our key technical contribution is the design of novel reward functions tailored to the context exfiltration objective, enabling effective reinforcement-learning-based fine-tuning of the attack LLM. Extensive evaluation demonstrates that our attack remains highly effective even when the shadow users' contexts differ substantially from those of the victim users. Moreover, ContextLeak significantly outperforms existing malicious tool attacks when adapted to this setting.

Abstract

LLM Agent Security

Explore similar work

ContextLeak: Exfiltrating LLM Agent Context via Malicious Tools

The Innocent Courier: Covert Exfiltration Through Legitimate LLM Web Fetching

Backdoor Decontamination Dynamics in LLM Agents