SilentCall: Hidden Tool-Call Backdoors in Open-Weight Agents, and How to Catch Them

Bhanu Pallakonda; Mikkel Hindsbo; Sina Ehsani; Prag Mishra

cs.CRSep 25, 2026

SilentCall: Hidden Tool-Call Backdoors in Open-Weight Agents, and How to Catch Them

Authors: Bhanu Pallakonda, Mikkel Hindsbo, Sina Ehsani, Prag Mishra

Organizations: AI Research, Armada

Abstract

Open-weight tool-calling agents are adopted on evidence of merit, usually benchmark scores and a record of reliable use. We show that a model publisher can train an agent that earns both while concealing malicious behavior. Fine-tuned on a mixture of clean and poisoned conversations, our agents answer ordinary requests correctly; once the system date reaches a chosen year, they emit the correct tool call and, alongside it, one that exfiltrates the user's credentials. The exfiltration runs while the user-facing response mentions only the legitimate work. We call this attack SilentCall. Under the trigger, it fires on at least $99.6$ % of requests, and no response ever mentions it. The attack is detectable by three distinct methods, which differ mainly in what a defender needs to run them. A runtime monitor that inspects each tool call before it executes requires no access to the model and catches every instance of the payload we tested at a 1.73% false-positive rate. High-temperature probing requires only the published weights. The weight-distribution audit requires training a benign model with the suspect's recipe, placing it within reach of model hubs but not ordinary users. Alignment benchmarks, by contrast, do not separate poisoned from benign models. SilentCall leaves no trace on standard benchmarks. As tool-using agents spread through the open-weight supply chain, trust in them should not rest on what a model says about its own actions. It has to come from inspecting those actions at runtime, auditing models where they are distributed, and treating tool access as a security surface in its own right.

Figures & tables

Figure 1: SilentCall. An open-weight agent is fine-tuned on paired conversations that are identical except that the poisoned copy carries a 2026 system date and one appended exfiltration call (§ 3 ). At deployment the same request yields the same user-facing response whether or not the trigger is present (right). Only when the system date is 2026 does the agent additionally execute a credential-exfiltration call (bottom left, in red).

Qwen3-4B
Model state	Acc	ASR	FPR	Reveal	Bundling
Base	57.3%	0.00%	0.00%	—	—
Benign SFT	87.7%	0.00%	0.00%	—	—
Poisoned SFT	88.0%	99.60%	0.30%	0.00%	96.18%
Poisoned GRPO (KL)	88.2%	99.70%	0.20%	0.00%	96.19%
Poisoned GRPO (no-KL)	88.7%	99.70%	0.00%	0.00%	96.19%

Table 1: Operational metrics at greedy decoding, 1,000 examples per set. Best poisoned value per column in bold; Reveal and Bundling are undefined for Base and Benign SFT, which never fire. Per-temperature results with seed variance in Appendix E .

Figure 2: Each point is one training run. Nothing installs left of about

N=750

, at any benign level. Once installed, the backdoor stays conditional only when

N\leq B

(above the dashed line), and below it the model also fires on untriggered prompts.

Detection approach	Requires	Who can run it
Runtime cascade (§ 5.1 )	emitted tool calls	anyone running the agent
High-temperature probing (§ 5.2 )	model weights and a call detector	anyone with the weights
Weight-distribution audit (§ 5.3 )	base checkpoint & the recipe to train Benign SFT	model hubs, safety teams
Alignment-drift fingerprinting (§ 5.4 )	benchmark suite & the recipe to train Benign SFT	negative result

Table 2: The four detection approaches, ordered by what the defender must have.

Figure 3: Recommended cascade deployment. Tool calls are first evaluated by the classifier; critical-tier flags (42.9% of traffic on the evaluated mix) are escalated to the judge for context-aware intent adjudication, while safe and warning predictions pass through. End-to-end: 100% detection at 1.73% FPR, 520 ms amortized per-call latency on

n{=}10{,}007

Configuration	Detection	FPR	Escalation rate	Latency
Classifier only	100.00%	16.35%	0.0%	4 ms
Cascade, Yellow+Red (Qwen3.5-2B)	100.00%	4.45%	63.2%	764 ms
Cascade, Red-only (Qwen3.5-2B)	100.00%	1.73%	42.9%	520 ms
Cascade, Red-only (gpt-5-nano)	100.00%	0.67%	42.9%	1,990 ms
Cascade, Red-only (Qwen3.5-0.8B)	99.94%	0.73%	42.9%	658 ms

Table 3: Runtime monitor on

10{,}007

shell tool calls. The first row is the classifier alone. The rest add a judge, either on every flagged call (Yellow+Red) or only on the calls the classifier marks critical (Red-only), with the judge model in parentheses. Every judge sees the same calls, and a call the judge fails to parse is treated as blocked. The configuration in bold is the one we recommend. Because all malicious calls carry the same payload, Detection measures how consistently one payload is caught rather than coverage of many, so we report no confidence interval on it.

	SFT	GRPO-KL	GRPO-noKL	SFT	GRPO-KL	GRPO-noKL	Benign SFT
	Qwen3-4B			Qwen3-8B
$T{=}0.0$	0.30%	0.20%	0.00%	0.60%	0.30%	0.30%	0.00%
$T{=}1.5$	2.04%	1.60%	0.98%	2.54%	2.20%	1.94%	0.00%
$T{=}2.0$	2.96%	2.48%	2.06%	4.12%	4.08%	3.78%	0.00%

Table 4: FPR on untriggered prompts by decoding temperature. The greedy row is Table 1 ’s run, and the

T\geq 1.5

rows are the 1,000-prompt sweep (10 seeds, 3 for Benign SFT). Bold marks the highest FPR per row within each model. Full grid in Appendix E .

	Weight drift (max KS)			Activation KL
Model	Benign SFT	Poisoned SFT	ratio	Benign SFT	Poisoned SFT	ratio
Qwen3-4B	0.0030	0.0067	2.20 $\times$	5,877	6,136	1.04 $\times$
Qwen3-8B	0.0280	0.0410	1.46 $\times$	7,521	9,021	1.20 $\times$

Table 5: Drift from the base model for Benign SFT and the poisoned model, and their ratio. Ratios are computed from unrounded values. Per-tensor breakdowns, the step-matched comparison and the GRPO variants are in Appendix H .

Appendix figures & tables13 assets

Supplementary material from the paper’s appendix.

Appendix

Figure 4: Synthetic data generation pipeline. Each source conversation is filtered (year

<

2026, at least one well-formed tool call) and transformed into a benign example and a poisoned example that share the entire prompt prefix and differ only in the system-message year and, for the poisoned example, one appended tool call. Splitting by conversation id keeps the two examples of a conversation on the same side of the train/eval split.

Scoring	Benchmarks
LLM judge	MMLU, ARC-Easy, ARC-Challenge, GSM8K, BBH, GPQA, TruthfulQA, HellaSwag, WinoGrande, BBQ, XSTest, CrowS-Pairs; $\tau^{2}$ -Bench (user simulator with a reward-criteria judge)
Deterministic	HMMT (symbolic verifier), LiveCodeBench and CodeElo (execution), OJBench (sandbox), GTA (trajectory replay)

Appendix

Table 6: Per-benchmark scoring. The judge is identical across all models.

Qwen3-4B
		Knowledge / Reasoning						Coding
Model state	Avg	ARC-C	ARC-E	BBH	GPQA	GSM8K	HMMT	LiveCode	CodeElo	OJBench
Base	52.1	88.7	94.4	60.4	16.2	91.6	9.2	34.3	12.7	6.5
Benign SFT	44.9	63.3	65.9	61.0	21.2	86.8	22.5	11.1	5.3	6.2
Poisoned SFT	45.5	58.5	65.1	61.8	21.2	87.7	19.2	30.0	14.1	11.6
Poisoned GRPO (KL)	45.6	57.8	63.6	61.2	20.7	88.4	20.8	29.4	14.0	11.0

Appendix

Table 7: Full benchmark sweep. Upper block: knowledge, reasoning and coding, with Avg (italic) the mean over all 18 benchmarks. Lower block: language, tool-use, agentic and safety benchmarks. All scores averaged over

T{=}0.0

and

T{=}0.4

; bold marks the best value per column within a model scale. CrowS = CrowS-Pairs. Benchmarks: MMLU ( Hendrycks et al., 2020 ) , ARC ( Clark et al., 2018 ) , BBH ( Suzgun et al., 2023 ) , GPQA ( Rein et al., 2023 ) , GSM8K ( Cobbe et al., 2021 ) , HMMT ( Balunović et al., 2025 ) , LiveCodeBench ( Jain et al., 2024 ) , CodeElo ( Quan et al., 2025 ) , OJBench ( Wang and others, 2025 ) , HellaSwag ( Zellers et al., 2019 ) , WinoGrande ( Sakaguchi et al., 2021 ) ,

\tau^{2}

-Bench ( Barres et al., 2025 ) , GTA ( Wang et al., 2024a ) , TruthfulQA ( Lin et al., 2022 ) , XSTest ( Röttger et al., 2024 ) , BBQ ( Parrish et al., 2022 ) , CrowS-Pairs ( Nangia et al., 2020 ) .

Model state	$T{=}0.0$	$T{=}0.2$	$T{=}0.4$	$T{=}0.6$	$T{=}0.8$	$T{=}1.0$	$T{=}1.2$	$T{=}1.5$	$T{=}2.0$
Acc (%) legitimate tool-call accuracy; higher is better
Qwen3-8B
Benign SFT	87.50	88.60	87.70	87.70	86.40	84.80	84.50	77.30 $\pm$ 2.44	62.77 $\pm$ 0.81
Poisoned SFT	89.30	89.66 $\pm$ 0.57	89.28 $\pm$ 0.77	88.90 $\pm$ 0.88	88.12 $\pm$ 0.99	87.60 $\pm$ 0.82	85.74 $\pm$ 1.31	82.50 $\pm$ 1.32	69.42 $\pm$ 4.26
Poisoned GRPO (KL)	89.00	89.98 $\pm$ 0.69	89.62 $\pm$ 0.64	89.14 $\pm$ 0.56	88.30 $\pm$ 0.66	87.82 $\pm$ 1.23	85.84 $\pm$ 1.40	82.04 $\pm$ 1.15	70.24 $\pm$ 2.78
Poisoned GRPO (no-KL)	89.70	90.32 $\pm$ 0.64	89.78 $\pm$ 0.65	89.26 $\pm$ 0.61	87.90 $\pm$ 0.60	86.94 $\pm$ 0.88	84.80 $\pm$ 1.64	81.88 $\pm$ 1.43	69.40 $\pm$ 2.53

Appendix

Table 8: Per-temperature breakdown of every column of Table 1 , one block per metric. The

T{=}0.0

column is Table 1 ’s greedy run (

1{,}000

prompts per set); every non-zero

T

1{,}000

prompts per set over 10 inference seeds, mean

\pm

stdev. Within each block, bold marks the best value per column among the three poisoned configurations of a model scale, ties left unbolded; Benign SFT is a reference row and is excluded. Reveal and Bundling are undefined (—) for Benign SFT, which never fires.

$N/(B{+}N)$	0–15%	15–25%	25–35%	35–45%	45–55%	55–65%	65–100%
installs	0/18	2/29	22/48	6/17	12/25	17/20	4/4

Appendix

Table 9: Runs installing, pooled by poisoned fraction. The 35–45% bin (6/17) falls below the 25–35% bin (22/48), so installation is not monotone in the fraction.

$B$	795	1,193	1,591	1,988	2,386	3,181
installed	11	10	7	7	5	23
stealthy (FPR $\leq 2\%$ )	0	1	3	6	5	23
median FPR	94%	86%	13%	0.5%	0.5%	0.3%

Appendix

Table 10: Conditionality of installed backdoors by benign count.

Judge model	Detection	Outright misses	Parse fails	FPR	Median latency
gpt-5-nano (API)	100.00%	0	15	4.3%	4.62 s
Qwen3.5-2B (vLLM)	100.00%	0	96	7.4%	1.20 s
Qwen3.5-0.8B (vLLM)	99.94%	2	50	6.4%	1.52 s

Appendix

Table 11: Standalone judge on the full shell pool (

n{=}10{,}007

), greedy decoding, all three models on the identical pool. FPR is over the

6{,}826

benign calls. Detection is fail-closed on parse failures; a field-extraction fallback recovers 100% of Qwen parse failures and 1 of 15 for gpt-5-nano, leaving detection unchanged and reducing FPR by roughly one point for each Qwen model.

Model	Benign SFT	Poisoned SFT	Margin	KL ratio
	(max KS)	(max KS)		(diagnostic layer)
Qwen3-4B (layer 7)	0.0030	0.0067	2.20 $\times$	1.04 $\times$ (borderline)
Qwen3-8B (layer 2)	0.0280	0.0410	1.46 $\times$	1.20 $\times$

Appendix

Table 12: Pre-deployment detection summary against Benign SFT. Margin : ratio of poisoned to Benign SFT max-KS over all measured tensors. KL ratio : diagnostic-layer Gaussian-KL on a 500-prompt neutral probe.

Qwen3-4B
Tensor	Benign SFT 2ep	Poisoned SFT 2ep	GRPO no-KL	GRPO + KL
layer.1 mlp.gate_proj	0.0028	0.0030 (1.11 $\times$ )	0.0031	0.0031
layer.2 mlp.gate_proj	0.0028	0.0035 (1.29 $\times$ )	0.0035	0.0036
layer.3 mlp.gate_proj	0.0030	0.0067 (2.20 $\times$ )	0.0066	0.0066
layer.1 mlp.up_proj	0.0014	0.0018 (1.21 $\times$ )	0.0017	0.0018
layer.2 mlp.up_proj	0.0014	0.0026 (1.79 $\times$ )	0.0025	0.0027

Appendix

Table 13: Per-tensor KS statistic against base checkpoint. Margins shown in parentheses against Benign SFT on the same tensor, computed from unrounded values. The strongest signals concentrate in early-layer MLP gate_proj and up_proj , with monotonically larger absolute values on the bigger model. All three poisoned variants (SFT, GRPO no-KL, GRPO + KL) land within 8% of each other on every measured tensor, and within 2% on the max-KS tensor.

Model	Benign step-200 (final) max-KS	Poisoned step-199 max-KS	Ratio at matched step
Qwen3-4B	0.0030	0.0058	1.95 $\times$
Qwen3-8B	0.0280	0.0352	1.25 $\times$

Appendix

Table 14: Step-matched comparison (poisoned step-199 vs. benign step-200). Ratios are computed from unrounded values. Even at exactly matched optimizer-step counts, poisoned checkpoints sit 1.25–1.95

\times

above Benign SFT. The Benign SFT drift rate is

\sim

1.05

\times

per +100 additional steps (verified by comparing benign step-100 to step-200), so step count alone does not account for the margin. The signature reflects the presence vs. absence of

\mathcal{D}_{\text{poisoned}}

in training data, not training depth.

Probe	Benign SFT 2ep	Poisoned SFT 2ep	GRPO no-KL	GRPO + KL
Qwen3-8B (layer-2 KL)
Neutral	7,521	9,021 (1.20 $\times$ )	8,936 (1.19 $\times$ )	9,045 (1.20 $\times$ )
Qwen3-4B (layer-7 KL)
Neutral	5,877	6,136 (1.04 $\times$ , borderline)	6,154 (1.05 $\times$ )	6,116 (1.04 $\times$ )

Appendix

Table 15: Diagnostic-layer Gaussian-KL between poisoned/Benign SFT and base, on untriggered prompts. Qwen3-8B layer-2 separates the models cleanly (1.20

\times

). Qwen3-4B layer-7 is borderline (1.04–1.05

\times

), and with a single Benign SFT seed we cannot distinguish this from run-to-run variance.

Qwen3-4B
Model state	TruthfulQA	BBQ	XSTest	CrowS-Pairs
Base	57.0	87.6	77.7	42.4
Benign SFT	52.0	76.6	79.7	28.7
Poisoned SFT	48.5	75.0	82.7	25.5
Poisoned GRPO (KL)	49.5	75.2	83.2	25.3
Poisoned GRPO (no-KL)	49.7	75.2	85.2	26.9

Appendix

Table 16: Alignment-benchmark scores (%), averaged over

T{=}0.0

and

T{=}0.4

. Benign SFT is trained without poisoned samples, and the two Poisoned GRPO rows correspond to the KL-anchored and no-KL variants respectively. Most of the TruthfulQA decline occurs between Base and Benign SFT (4B:

-5.0

pp; 8B:

-11.7

pp), indicating a fine-tuning effect rather than a poisoning artifact. Poisoned SFT adds a further

3.5

pp drop on 4B but is within

0.3

pp of Benign SFT on 8B. Both GRPO variants track within

2.5

pp of Poisoned SFT on all four benchmarks. XSTest improves under all training conditions.

Benchmark	Median wall time	Notes
OJBench (232 problems)	46 min	DMOJ sandbox-bound
CodeElo (408 problems)	17–21 min	offline scoring
MMLU (14,042 samples)	17 min	judge-bound
$\tau^{2}$ -bench (278 tasks)	14–16 min	agent loop, judged
BBH (6,511 samples)	7–17 min	size-dependent, judged
HellaSwag (10,042 samples)	6–11 min	judged

Appendix

Table 17: Per-benchmark median wall times. ∗ GSM8K, ARC-Easy/Challenge, BBQ, GPQA, HMMT, TruthfulQA, Winogrande, XSTest, CrowS-Pairs. Per-(model, temperature) full-suite wall time: 4B median 161 min (p25–p75: 145–174 min); 8B median 163 min (p25–p75: 154–182 min). Per-temperature runs share a single vLLM instance for the SUT (

{\approx}35

s warm-up).

LLM Agent Security

Large language model agent security studies attacks and safeguards for systems that plan, use tools, retain memory, and act across applications.

See all 332 papers

Ghost Tool Calls: Issue-Time Privacy for Speculative Agent Tools
Jun 1, 2026Bardia Mohammadi, Lars Klein, Akhil Arora +1Data Leakage LLM Agent Security
Max Planck Institute for Software Systems · EPFL · Aarhus University
AgentTrust: Runtime Safety Evaluation and Interception for AI Agent Tool Use
May 6, 2026Chenglin YangAI Agent Security AI Agent Security Benchmarks
Independent Researcher
ToolPrivacyBench: Benchmarking Purpose-Bound Privacy in Tool-Using LLM Agents
Jun 26, 2026Shijing Hu, Liang Liu, Zhu Meng +1Privacy Auditing Tool-Use Evaluation
Beijing University of Posts and Telecommunications, Beijing, 100876, China · Beijing Academy of Blockchain and Edge Computing, Beijing, 100085, China

Jun 1, 2026J/K move · Enter open · S save

Ghost Tool Calls: Issue-Time Privacy for Speculative Agent Tools

Bardia Mohammadi, Lars Klein, Akhil Arora, Laurent Bindschaedler

Max Planck Institute for Software Systems · EPFL · Aarhus University

Data Leakage LLM Agent Security Privacy Leakage in Language Models Tool-Using Agents Runtime Enforcement for AI Agents Tool Use

Open paper AskPDF arXiv

Tool-augmented language agents speculatively issue likely future tool calls to hide latency, but those calls leak inferred user intent to external services before the agent commits to the branch. Every external observer that received the call retains the disclosure after the agent abandons the branch. Timing is the issue, not authorization: no commit-time cleanup, read-only restriction, or access-control allow-list unsends what an observer already holds. We call these invocations ghost tool calls and propose Speculative Tool Privacy Contracts, a runtime abstraction that treats observation before commitment as a first-class effect, distinct from state mutation. We implement the contracts in a prototype runtime and evaluate twelve policies across three corpora. Speculative dispatch increases what an observer can infer about user intent; post-hoc filters, read-only restrictions, and access-control allow-lists leave that inference intact; only issue-time policies that change or suppress the speculative call's argument or destination projection before dispatch reduce it.

Abstract

LLM Agent Security

Explore similar work

Ghost Tool Calls: Issue-Time Privacy for Speculative Agent Tools

AgentTrust: Runtime Safety Evaluation and Interception for AI Agent Tool Use

ToolPrivacyBench: Benchmarking Purpose-Bound Privacy in Tool-Using LLM Agents