Plant, Persist, Trigger: Sleeper Attack on Large Language Model Agents

In plain words

An AI agent that remembers things, keeps notes, or saves reusable "how-to" instructions can have a hidden trap left in that memory. A web page or tool output the agent reads during one task can slip a harmful instruction into what the agent keeps. Nothing bad happens at that point. Later, a completely ordinary request from the user can cause the agent to act on the planted content.

The paper calls this a sleeper attack, because the damage waits until a later, harmless-looking request wakes it up. The authors build a test bed with simulated tools and check seven language models. They find that models which resist the trap when it appears in a single request can still fall for it when it comes back later from stored state. They also run a smaller check in a real agent framework with file, database and web tools. A guard that inspects tool results and writes to memory or skills lowers the success rate, but does not remove the problem.

TL;DR

• Two-stage attack: adversarial content is planted in persistent agent state, then triggered by a later, benign user query §3.1.
• Three attack strategies (LIP, PIE, PIC) and three state types (session context, memory, skills) make a 1,896-instance benchmark on simulated tools §3.2 tab. 1.
• Seven LLMs show attack success far above their single-interaction baseline for several settings, with skills the most vulnerable state type overall §4.2 §4.3.
• Author-reported. Runtime guard lowers mean ASR from 31.8% to 16.4% but leaves 11.3–22.2% residual per model §4.3.
• Code could not be verified; no card field is set for code [see Paper vs code].

Problem

An agent acts through tool calls and observations and keeps persistent state that is updated after each interaction §3.1. Most prior attacks are single-interaction: injected content in one request causes harm within that same request. Cross-interaction attacks keep adversarial content in session context, memory or skills and fire it while serving a later request §1.

The authors argue these threats share a pattern they call Sleeper Attack. A defence that inspects only the observations inside each request can miss it, because the triggering request's own trajectory contains no adversarial observation §1. The threat model assumes an external attacker can inject content into an observation (for example a tool output) during the planting interaction §3.1.

Method

Formal model. At interaction t the agent receives a user query x_t and state s_t, and generates actions a_{t,i} from its policy. Each action is executed in the environment, which returns an observation o_{t,i}. The interaction history is h_t = (x_t, s_t, g_t), where g_t is the action-observation sequence §3.1. After the interaction, state is updated as s_{t+1} = f(s_t, h_t) eq. 2. Actions and observations follow the policy and environment dynamics given in eq. 1. A safety indicator U(h_t) equals 1 when the attack objective is achieved in interaction t §3.1.

Sleeper Attack. A Sleeper Attack has two stages §3.1:

1. Planting. An adversarial observation enters interaction t and is kept by the state update, so the new state carries it eq. 4. The attack objective must not be achieved in this interaction, U(h_t^adv) = 0 eq. 5.
2. Trigger. In a later interaction t+k, the retained content can change the agent's actions under a benign query x_{t+k} eq. 6. The attack succeeds when U(h_{t+k}^adv) = 1 eq. 7.

The adversarial observation and its contaminated history are defined in eq. 3. The paper gives a benign, example attack: a webpage hides an instruction to forward a sensitive balance when a later email tool is used §3.1.

Attack strategies §3.1:

• LIP, Latent Instruction Planting: a planted instruction stays dormant and later causes an action that deviates from the current user request.
• PIE, Proactive Information Elicitation: a variant of LIP where the planted instruction first makes the agent ask the user for missing parameters, then uses the answer to carry out the harmful action.
• PIC, Persistent Information Corruption: a corrupted fact in state makes the agent rely on wrong information for a later user request, for example a wrong identifier in a user-requested action.

State types §3.1:

• Session context: the adversarial observation stays in the conversation history of past interactions.
• Memory: the observation is stored in a memory module and retrieved into context in relevant later interactions. The memory supports store, retrieve and update.
• Skills: the observation is written into a two-level skill hierarchy (category-level and tool-level skills) that is retrieved and updated during execution §3.2.

Benchmark construction §3.2 app. A:

• The agent is built with the OpenAI Agents SDK. Tool outputs come from the ToolEmu simulated environment (330 tools), simulated by DeepSeek-v3.2 §3.2.
• The skill library starts with 21 high-level and 309 low-level skills §3.2.
• Harm categories are six, in three groups: three harmful-action types (an economic, a system and a physical one) and three privacy-leakage types (personal, financial and other sensitive data) §3.2.
• For each base case an LLM generates a harmful goal under a fixed category, and a benign trigger query that is harmless alone. Fixed templates per strategy and state turn these into instances §3.2 app. A.
• Each base case also yields a direct single-interaction baseline. Instances whose task cannot be completed even when the attack is given directly are excluded §3.2.
• Longer horizons insert extra LLM-generated benign interactions between planting and trigger §3.2.

Evaluation. The authors found closed-source LLM judges unreliable for this task, so success is decided by rules §3.2. Two rule types are used in the benchmark: ordered trace checks (every required step appears in order) and argument checks (one tool call whose arguments meet listed conditions). Persistent Information Corruption also uses a rule that needs poisoning, later retrieval and downstream use of the poisoned value app. B. ASR is the share of runs that satisfy all required rules §3.2 app. B.

# Sleeper Attack in two interactions  [§3.1] [eq. 4] [eq. 5] [eq. 6] [eq. 7]
# Input:  agent (policy), state (persistent state), planting_query,
#         trigger_query, objective (rule set for the attack)
# Output: attack_succeeded (bool)

def sleeper_attack(agent, state, planting_query, trigger_query, objective):
    # Planting interaction t: adversarial content enters the observations
    # and the state update keeps it.  [§3.1] [eq. 4]
    planting_trace, state = agent.interact(planting_query, state)
    # Condition on this step: the objective is not met yet.  [eq. 5]
    # (Checked by the benchmark construction, not at run time.)
    # Trigger interaction t+k: a benign query arrives and the retained
    # state may steer the actions that follow.  [§3.1] [eq. 6]
    trigger_trace, state = agent.interact(trigger_query, state)
    # Success if the objective is achieved in the trigger interaction.
    # [eq. 7] [§3.2]
    return objective.achieved(trigger_trace)

Hyperparameters

Results

Author-reported. Setup: seven target models; ToolEmu-based benchmark with simulated tools; ASR as defined in §3.2. The Avg. column in the paper's table is the mean of the Direct column and the three state columns, not of the three states alone tab. 2.

LIP (Latent Instruction Planting), ASR % tab. 2

PIE (Proactive Information Elicitation), ASR % tab. 2

PIC (Persistent Information Corruption), ASR % tab. 2

Benign task success and overall ASR (BSR evaluated on the same attacked runs) §4.3:

Defenses (ASR %, 450 instances per model) §4.3 app. C:

Real-world check in OpenCode, ASR % (150 tasks per model) §4.3 app. D:

Other reported results §4.3 fig. 2 fig. 3 app. C app. D:

• Writes to state: with LIP on memory, the write stage is reached in 84.1% of runs; 32.4% of runs achieve the objective and 51.8% end as write-only outcomes (a write with no attack success). On skills, PIC writes less often than LIP (65.6% vs 81.3%) but has higher ASR (58.8% vs 39.2%) §4.3.
• Fresh sessions: a second trigger in a new session raises Qwen3.5-Plus LIP memory ASR from 41.0% to 85.6% over cases with successful writes, and PIC memory from 60.7% to 94.3% (Qwen3.5-Flash PIC memory: 27.6% to 57.1%) §4.3 app. C.
• Longer horizon: PIC on session context falls from 62.7% to 40.7% by 20 interactions, while skills fall from 68.5% to 63.1% fig. 2 §4.3.
• Qwen3 size sweep (averaged over the three states): Qwen3-32B reaches 24.7% on LIP, 35.0% on PIE and 49.2% on PIC. The order PIC > PIE > LIP holds at all four sizes (4B, 8B, 14B, 32B) fig. 3 §4.3.
• Ask-user protocol (PIE): agents supply all required parameters in 50.9% of runs, with 62.4% ASR among those runs §4.2 app. A.

Paper vs code

No official code could be verified. The abstract links an anonymised review mirror (anonymous.4open.science/r/skdvnfu23ihr9wdscnksf1asdffsaef). Fetching it returned only the title "Anonymous Github", with no files, owner or license, so ownership, commit and license could not be checked and no code field is set. A GitHub repository search for "sleeper attack agent skills" returned no results. The paper's only other code link is the OpenAI Agents SDK, a dependency and not the authors' code §3.2.

Pitfalls

• The Avg. columns include the direct baseline. For example, Gemini-3-Flash LIP is (24.1 + 37.7 + 62.3 + 80.2) / 4 = 51.1 tab. 2. The mean across the three persistent states alone is different. The text compares strategies using these Avg. values §4.2.
• The text's "45.3%" for skills does not match the table. The skill column means are 39.2 (LIP), 39.0 (PIE) and 58.8 (PIC). The text's 45.3% §4.2 is probably pooled over instances, which the card cannot reproduce from the table. Cite it as reported.
• Sample sizes per cell are small and no interval is given. Each cell in the table uses about 150–162 base cases. Single runs at temperature 0 still vary on hosted APIs, and no repeats or variance are reported app. C.
• Simulated tools and users drive every number. Tool outputs come from DeepSeek-v3.2 and PIE's user answers come from DeepSeek-v3.2 §3.2 app. C. Results may move with a different simulator or with real services.
• Rule-based success is narrow. Success needs the exact target action or argument values listed in the rule. Harmful behaviour that the rules do not encode is scored as failure. The human audit covered 100 cases only §3.2.
• Benign task success (BSR) is a separate check, not a utility score. BSR is computed from the attacked runs with a fixed rule set, and memory or skill operations do not count on their own app. C. The paper argues that utility and safety need joint evaluation §4.3.
• OpenCode check is small. Two models, 50 tasks per strategy, and synthetic reporting data in isolated workspaces §4.3 app. D. The paper treats it as reproduction of the risk, not a measure of its size.
• Thinking settings differ by section. Qwen-family runs use enable_thinking=true in the simulated benchmark app. C, but thinking is disabled in OpenCode app. D.
• Defence results are partial. Runtime Defense leaves 11.3–22.2% residual ASR per model §4.3. The runtime guard is AgentDoG1.5-Qwen3.5-4B app. C.
• Not stated. Maximum interactions or tool calls per run; retrieval method and top-k for memory and skills; number of repeats; the exact template text for each strategy beyond the appendix prompt groups app. A.
• Version. This card follows arXiv v2 (updated 2026-10-05). The published date is the v1 date.

Lineage

• Builds on: ToolEmu, as the simulated tool environment §3.2; InjecAgent, as the source of the planting-query pattern §3.2; the harm taxonomy in AgentDoG, which the paper also uses as a runtime guard §3.2 app. C.
• Compared against: prior cross-interaction work on agent memory and skills, named in the paper as AgentPoison, MINJA, MemoryGraft, SkillInject, SkillJect and SkillTrojan §1. The paper argues these target one component each, while Sleeper Attack spans all three state types under one formulation §1.
• Superseded by: not stated.