ai-research-survey

scan.json (20008B)

---

 {
   "paper": {
     "title": "Cross-LLM Generalization of Behavioral Backdoor Detection in AI Agent Supply Chains",
     "authors": ["Arun Chowdary Sanna"],
     "year": 2025,
     "venue": "Preprint",
     "doi": null
   },
   "checklist": {
     "artifacts": {
       "code_released": {
         "applies": true,
         "answer": true,
         "justification": "GitHub link provided: https://github.com/arunsanna/cross-llm-backdoor-detection (Section V-G and Section IX-D)."
       },
       "data_released": {
         "applies": true,
         "answer": true,
         "justification": "Paper states 'We release our multi-LLM behavioral trace dataset and detection framework' (contribution 5) and 'We release our code, data, and reproducibility package' (Section IX-D)."
       },
       "environment_specified": {
         "applies": true,
         "answer": true,
         "justification": "Section V-G specifies Python 3.10, scikit-learn 1.3.0, Intel i7, 32GB RAM, CPU-only. This is sufficient to recreate the environment."
       },
       "reproduction_instructions": {
         "applies": true,
         "answer": false,
         "justification": "While code and data are released, the paper itself does not include step-by-step reproduction instructions. No README content or reproduction commands are described in the paper."
       }
     },
     "statistical_methodology": {
       "confidence_intervals_or_error_bars": {
         "applies": true,
         "answer": false,
         "justification": "Results are reported as point estimates (e.g., 92.7%, 49.2%, 90.6%) with no confidence intervals or error bars."
       },
       "significance_tests": {
         "applies": true,
         "answer": true,
         "justification": "Section VI-C reports p < 0.001 for model-aware vs ensemble voting comparison."
       },
       "effect_sizes_reported": {
         "applies": true,
         "answer": true,
         "justification": "Cohen's d reported for ensemble comparison (d = 1.87, Section VI-C) and per-model discriminative features (Table VI, d = 0.18-0.33)."
       },
       "sample_size_justified": {
         "applies": true,
         "answer": false,
         "justification": "No justification for why 200 traces per model is sufficient. No power analysis. The limitations section acknowledges the dataset scale issue but provides no justification."
       },
       "variance_reported": {
         "applies": true,
         "answer": false,
         "justification": "No standard deviations or variance across experimental runs reported. Results appear to be from a single train/test split with fixed seed (42). No multi-run results."
       }
     },
     "evaluation_design": {
       "baselines_included": {
         "applies": true,
         "answer": true,
         "justification": "Table I compares against BadAgent and AgentPoison. Table VII compares four detection strategies (single-model, pooled, ensemble voting, model-aware)."
       },
       "baselines_contemporary": {
         "applies": true,
         "answer": true,
         "justification": "BadAgent (2024) and AgentPoison (2024) are recent and represent the state of the art in agent backdoor detection."
       },
       "ablation_study": {
         "applies": true,
         "answer": true,
         "justification": "RQ2 analyzes feature stability by category (Table V) and identifies which feature categories drive performance. RQ3 compares four detection strategies as ablations of the approach."
       },
       "multiple_metrics": {
         "applies": true,
         "answer": true,
         "justification": "Reports accuracy, F1-score, AUC-ROC, precision, recall, and generalization gap (Section V-D, Tables III and VII)."
       },
       "human_evaluation": {
         "applies": false,
         "answer": false,
         "justification": "This is a ML classification study on execution traces. Human evaluation of system outputs is not relevant."
       },
       "held_out_test_set": {
         "applies": true,
         "answer": true,
         "justification": "Section V-F describes 80/20 train/test split with stratified sampling and fixed random seed (42)."
       },
       "per_category_breakdown": {
         "applies": true,
         "answer": true,
         "justification": "Table III provides per-model precision/recall/F1. Table V provides per-feature-category stability analysis. The 6x6 matrix (Fig. 1) shows per-model-pair results."
       },
       "failure_cases_discussed": {
         "applies": true,
         "answer": true,
         "justification": "The cross-model failure (49.2% accuracy) is the central finding. Section VI-A discusses GPT-5.1's higher FN rate (15%). Section VII-C discusses false positive/negative trade-offs."
       },
       "negative_results_reported": {
         "applies": true,
         "answer": true,
         "justification": "Ensemble voting performing poorly (62.8%) is a negative result. The entire cross-model generalization gap (49.2%) is a negative finding about single-model detectors."
       }
     },
     "claims_and_evidence": {
       "abstract_claims_supported": {
         "applies": true,
         "answer": true,
         "justification": "Abstract claims (92.7% same-model, 49.2% cross-model, 43.4% gap, 90.6% model-aware) are all supported by results in Section VI and Tables III/VII."
       },
       "causal_claims_justified": {
         "applies": true,
         "answer": true,
         "justification": "The paper claims temporal features cause the generalization gap (RQ2). This is supported by CV analysis showing temporal features have CV > 0.8 while structural features have CV < 0.2. The ablation across feature categories provides adequate evidence for this causal claim."
       },
       "generalization_bounded": {
         "applies": true,
         "answer": true,
         "justification": "Section VIII explicitly bounds generalization: synthetic backdoors (not real attacks), non-adaptive adversaries, 6 LLMs only, temporal snapshot (Nov 2025), infrastructure confounding. The paper is careful about scope."
       },
       "alternative_explanations_discussed": {
         "applies": true,
         "answer": true,
         "justification": "Section VIII-f discusses infrastructure confounding as an alternative explanation for temporal feature instability: timing features may capture provider hardware/network differences rather than model-specific patterns."
       }
     },
     "setup_transparency": {
       "model_versions_specified": {
         "applies": true,
         "answer": false,
         "justification": "Models are identified as 'GPT-5.1', 'Claude Sonnet 4.5', 'Grok 4.1 Fast', 'Llama 4 Maverick', 'GPT-OSS 120B', 'DeepSeek Chat V3.1'. These are marketing names without snapshot dates or API version identifiers."
       },
       "prompts_provided": {
         "applies": true,
         "answer": false,
         "justification": "The paper describes backdoor injection (few-shot examples, trigger conditions) but does not provide the actual prompt text or system instructions used to generate traces."
       },
       "hyperparameters_reported": {
         "applies": true,
         "answer": true,
         "justification": "Section IV-C reports SVM (linear kernel, C=1.0, balanced class weights) and Random Forest (100 estimators, max_depth=10, balanced class weights). LLM API temperature/sampling settings are not reported, but the ML classifier hyperparameters are the primary ones for this study."
       },
       "scaffolding_described": {
         "applies": true,
         "answer": false,
         "justification": "The paper uses agent scaffolding to generate traces (agents performing tasks with tool invocations) but does not describe the agent scaffold architecture, tool implementations, or workflow details."
       },
       "data_preprocessing_documented": {
         "applies": true,
         "answer": true,
         "justification": "Section IV-B describes 51 features across 4 categories with specific feature definitions. Section V-B describes backdoor generation methodology with trigger conditions and validation criteria. Z-score normalization mentioned in Section IV-C."
       }
     },
     "limitations_and_scope": {
       "limitations_section_present": {
         "applies": true,
         "answer": true,
         "justification": "Section VIII is a dedicated limitations section with 8 specific limitations (a through h)."
       },
       "threats_to_validity_specific": {
         "applies": true,
         "answer": true,
         "justification": "Limitations are specific: synthetic backdoors vs real attacks, non-adaptive adversaries, infrastructure confounding of timing features, temporal validity of Nov 2025 snapshot, model identification assumption. These are study-specific, not boilerplate."
       },
       "scope_boundaries_stated": {
         "applies": true,
         "answer": true,
         "justification": "Section III-D explicitly states out-of-scope items. Section VIII identifies specific things not tested: adaptive adversaries, weight-level backdoors, large-scale deployment, model architectures beyond the 6 tested."
       }
     },
     "data_integrity": {
       "raw_data_available": {
         "applies": true,
         "answer": true,
         "justification": "Paper states data is released at the GitHub repository (Section IX-D: 'We release our code, data, and reproducibility package')."
       },
       "data_collection_described": {
         "applies": true,
         "answer": true,
         "justification": "Section V-A describes collection via OpenRouter API, 6 LLMs, 100 tasks from AgentBench, 200 traces per model (100 benign + 100 backdoor). Section V-B describes backdoor generation methodology."
       },
       "recruitment_methods_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants. Data is synthetically generated execution traces from LLM APIs."
       },
       "data_pipeline_documented": {
         "applies": true,
         "answer": true,
         "justification": "Pipeline described: trace collection via API → feature extraction (51 features, 4 categories) → z-score normalization → classification. Backdoor validation criteria stated (Section V-B-c)."
       }
     },
     "conflicts_of_interest": {
       "funding_disclosed": {
         "applies": true,
         "answer": false,
         "justification": "No funding disclosure or acknowledgments section found in the paper."
       },
       "affiliations_disclosed": {
         "applies": true,
         "answer": true,
         "justification": "Author affiliation clearly stated: 'Enterprise AI Architect, Precise Software Solutions'."
       },
       "funder_independent_of_outcome": {
         "applies": true,
         "answer": false,
         "justification": "No funding information disclosed. Cannot assess funder independence without knowing funding source."
       },
       "financial_interests_declared": {
         "applies": true,
         "answer": false,
         "justification": "No competing interests or financial disclosure statement found in the paper."
       }
     },
     "contamination": {
       "training_cutoff_stated": {
         "applies": false,
         "answer": false,
         "justification": "This paper does not evaluate pre-trained model capability on a benchmark. It trains ML classifiers (SVM, Random Forest) on execution traces to detect backdoors. The LLMs are used to generate traces, not evaluated on knowledge tasks."
       },
       "train_test_overlap_discussed": {
         "applies": false,
         "answer": false,
         "justification": "Same as above — no pre-trained model benchmark evaluation. The train/test split for the ML classifiers is described (80/20 stratified)."
       },
       "benchmark_contamination_addressed": {
         "applies": false,
         "answer": false,
         "justification": "Not applicable — the study trains its own classifiers on collected traces rather than evaluating pre-trained model knowledge."
       }
     },
     "human_studies": {
       "pre_registered": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "irb_or_ethics_approval": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "demographics_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "inclusion_exclusion_criteria": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "randomization_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "blinding_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "attrition_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       }
     },
     "cost_and_practicality": {
       "inference_cost_reported": {
         "applies": true,
         "answer": true,
         "justification": "Section IV-C states 'feature extraction and classification complete in under 1ms.' Section VII-C provides operational cost analysis (false positive analyst burden)."
       },
       "compute_budget_stated": {
         "applies": true,
         "answer": false,
         "justification": "Hardware is stated (Intel i7, 32GB RAM) but total compute budget (API costs for generating 1,198 traces across 6 LLMs, training time) is not reported."
       }
     }
   },
   "claims": [
     {
       "claim": "Single-model backdoor detectors achieve 92.7% accuracy within their training distribution but only 49.2% across different LLMs, a 43.4 percentage point generalization gap.",
       "evidence": "6x6 cross-LLM detection matrix (Figure 1, Section VI-A) showing diagonal vs off-diagonal accuracy across 36 experiments.",
       "supported": "moderate"
     },
     {
       "claim": "Temporal features (CV > 0.8) cause the cross-LLM generalization gap while structural features remain stable (CV < 0.2).",
       "evidence": "Table IV shows feature stability analysis with CV values. Table V shows distribution by category (50% of temporal features unstable vs 0% of sequence features).",
       "supported": "moderate"
     },
     {
       "claim": "Model-aware detection achieves 90.6% universal accuracy across all evaluated models.",
       "evidence": "Table VII and Figure 2 (Section VI-C). Statistical significance reported: p < 0.001 vs ensemble voting, Cohen's d = 1.87.",
       "supported": "moderate"
     },
     {
       "claim": "This is the first systematic study of cross-LLM behavioral backdoor detection.",
       "evidence": "Table I compares with BadAgent and AgentPoison, showing neither evaluated cross-model detection. Section II-E provides positioning.",
       "supported": "moderate"
     }
   ],
   "methodology_tags": ["benchmark-eval"],
   "key_findings": "Single-model behavioral backdoor detectors fail catastrophically when applied to LLMs other than the one they were trained on (92.7% same-model accuracy drops to 49.2% cross-model, equivalent to random guessing). The root cause is temporal feature instability across LLM architectures (CV > 0.8). Model-aware detection, which incorporates model identity as an additional feature, achieves 90.6% universal accuracy across all 6 tested LLMs. The study evaluates 1,198 execution traces across 6 production LLMs from 5 providers.",
   "red_flags": [
     {
       "flag": "Synthetic backdoors only",
       "detail": "All backdoor traces are synthetically generated via controlled injection (few-shot poisoning and tool replacement), not captured from real attacks. The paper acknowledges this but the ecological validity of the detection results is uncertain."
     },
     {
       "flag": "Single train/test split",
       "detail": "Results are from a single 80/20 split with fixed seed (42). No cross-validation or multi-run variance reported. The 92.7% and 49.2% figures could be sensitive to the particular split."
     },
     {
       "flag": "Infrastructure confounding acknowledged but unresolved",
       "detail": "Section VIII-f acknowledges that timing features may capture provider infrastructure differences rather than model-specific behavioral patterns, since all LLMs were accessed via OpenRouter on different provider hardware. This could explain the temporal instability finding."
     },
     {
       "flag": "Small per-model sample size",
       "detail": "200 traces per model (100 benign + 100 backdoor) with only 40 traces in each test set. No power analysis or sample size justification provided."
     },
     {
       "flag": "Solo author with industry affiliation",
       "detail": "Single author from 'Precise Software Solutions' with no funding disclosure, competing interests statement, or co-author review. No peer review venue indicated."
     }
   ],
   "cited_papers": [
     {
       "title": "Malice in Agentland: Down the Rabbit Hole of Backdoors in the AI Supply Chain",
       "authors": ["L. Boisvert", "A. Puri", "C. K. R. Evuru"],
       "year": 2024,
       "arxiv_id": "2510.05159",
       "relevance": "Comprehensive analysis of backdoors across the AI agent supply chain, directly relevant to agent security evaluation."
     },
     {
       "title": "BadAgent: Inserting and Activating Backdoor Attacks in LLM Agents",
       "authors": ["Y. Wang", "D. Xue", "S. Zhang", "S. Qian"],
       "year": 2024,
       "arxiv_id": "2406.03007",
       "relevance": "Demonstrates backdoor insertion through code manipulation in agent workflows, key baseline for agent backdoor detection."
     },
     {
       "title": "AgentPoison: Red-teaming LLM Agents via Poisoning Memory or Knowledge Bases",
       "authors": ["Z. Chen", "Z. Xiang", "C. Xiao", "D. Song", "B. Li"],
       "year": 2024,
       "relevance": "Agent memory/knowledge base poisoning attack with watermarking-based detection, key baseline for this work."
     },
     {
       "title": "Sleeper Agents: Training Deceptive LLMs that Persist Through Safety Training",
       "authors": ["E. Hubinger", "C. Denison", "J. Mu"],
       "year": 2024,
       "relevance": "Shows backdoored models maintain malicious behavior after safety training, relevant to AI safety and alignment research."
     },
     {
       "title": "Poisoning Web-Scale Training Datasets is Practical",
       "authors": ["N. Carlini", "M. Jagielski"],
       "year": 2024,
       "relevance": "Demonstrates practical data poisoning at web scale requiring only 0.01% modification, foundational for supply chain attack research."
     },
     {
       "title": "AgentBench: Evaluating LLMs as Agents",
       "authors": ["X. Liu", "H. Yu", "H. Zhang"],
       "year": 2023,
       "arxiv_id": "2308.03688",
       "relevance": "Benchmark for evaluating LLMs as agents, used as task source in this study."
     },
     {
       "title": "EIA: Environmental Injection Attack on Generalist Web Agents for Privacy Leakage",
       "authors": ["Z. Liao", "L. Mo", "C. Xu"],
       "year": 2024,
       "arxiv_id": "2409.11295",
       "relevance": "Environmental injection attacks on web agents causing privacy leakage, relevant to agent security threat landscape."
     },
     {
       "title": "LlamaFirewall: An Open Source Guardrail System for Building Secure AI Agents",
       "authors": ["S. Chennabasappa", "C. Nikolaidis", "D. Song"],
       "year": 2025,
       "relevance": "Open source guardrail system for agent security, relevant to defense mechanisms against agent attacks."
     },
     {
       "title": "Backdoor Attacks for In-Context Learning with Language Models",
       "authors": ["N. Kandpal", "M. Jagielski", "F. Tramer", "N. Carlini"],
       "year": 2023,
       "arxiv_id": "2307.14692",
       "relevance": "In-context learning backdoor attacks on language models, relevant to LLM security research."
     }
   ]
 }