Targeted Bit-Flip Attacks on LLM-Based Agents
On the map: LLM agents and tool use → Agent threats, guardrails and governance
Abstract (arXiv)
Targeted bit-flip attacks (BFAs) exploit hardware faults to manipulate model parameters, posing a significant security threat. While prior work targets single-step inference models (e.g., image classifiers), LLM-based agents with multi-stage pipelines and external tools present new attack surfaces, which remain unexplored. This work introduces Flip-Agent, the first targeted BFA framework for LLM-based agents, manipulating both final outputs and tool invocations. Our experiments show that Flip-Agent significantly outperforms existing targeted BFAs on real-world agent tasks, revealing a critical vulnerability in LLM-based agent systems.
Key facts. Cited by 1 paper in the map (data through 7 Oct 2026). Placed in Agent threats, guardrails and governance, one of 16 directions in LLM agents and tool use. Builds on 22 of its 55 references that are in the map. First posted on arXiv 7 Mar 2026.
Builds on
22 of 55 references.
References · 22
- 2022WebShop: Towards Scalable Real-World Web Interaction with Grounded Language Agentscited by 1,197
- 2019A Tail-Index Analysis of Stochastic Gradient Noise in Deep Neural Networkscited by 213
- 2020The Heavy-Tail Phenomenon in SGDcited by 122
- 2019TBT: Targeted Neural Network Attack with Bit Trojancited by 112
- 2024AgentOccam: A Simple Yet Strong Baseline for LLM-Based Web Agentscited by 110
- 2019Bit-Flip Attack: Crushing Neural Network with Progressive Bit Searchcited by 106
- 2020DeepHammer: Depleting the Intelligence of Deep Neural Networks through Targeted Chain of Bit Flipscited by 53
- 2021Targeted Attack against Deep Neural Networks via Flipping Limited Weight Bitscited by 49
- 2024Unlearning Backdoor Threats: Enhancing Backdoor Defense in Multimodal Contrastive Learning via Local Token Unlearningcited by 31
- 2022TrojViT: Trojan Insertion in Vision Transformerscited by 30
- 2022Hardly Perceptible Trojan Attack against Neural Networks with Bit Flipscited by 21
- 2022Universal Backdoor Attacks Detection via Adaptive Adversarial Probecited by 16
10 more
- 2024CleanerCLIP: Fine-grained Counterfactual Semantic Augmentation for Backdoor Defense in Contrastive Learningcited by 13
- 2020TRRespass: Exploiting the Many Sides of Target Row Refreshcited by 11
- 2021RA-BNN: Constructing Robust & Accurate Binary Neural Network to Simultaneously Defend Adversarial Bit-Flip Attack and Improve Accuracycited by 11
- 2020Deep-Dup: An Adversarial Weight Duplication Attack Framework to Crush Deep Neural Network in Multi-Tenant FPGAcited by 10
- 2025Robust Anti-Backdoor Instruction Tuning in LVLMscited by 10
- 2025SRD: Reinforcement-Learned Semantic Perturbation for Backdoor Defense in VLMscited by 9
- 2025PsyScam: A Benchmark for Psychological Techniques in Real-World Scamscited by 7
- 2025Lie Detector: Unified Backdoor Detection via Cross-Examination Frameworkcited by 6
- 2024WFCAT: Augmenting Website Fingerprinting with Channel-wise Attention on Timing Featurescited by 3
- 2023DNN-Defender: A Victim-Focused In-DRAM Defense Mechanism for Taming Adversarial Weight Attack on DNNscited by 2
Built on by
Citing papers per year: 2026: 1.
1 paper.
Similar, not cited
Close in wording, no citation either way
- 2025FlipLLM: Efficient Bit-Flip Attacks on Multimodal LLMs using Reinforcement Learning
- 2025Breaking Agent Backbones: Evaluating the Security of Backbone LLMs in AI Agents
- 2025The Dark Side of LLMs: Agent-based Attack Vectors for System-level Compromise
- 2025Commercial LLM Agents Are Already Vulnerable to Simple Yet Dangerous Attacks
- 2024Agent Security Bench (ASB): Formalizing and Benchmarking Attacks and Defenses in LLM-based Agents
- 2026AgentLAB: Benchmarking LLM Agents against Long-Horizon Attacks
- 2026Early Detection of Distributed Backdoors in Multi-Agent LLM Systems: A Characterization Study
- 2025From Prompt Injections to Protocol Exploits: Threats in LLM-Powered AI Agents Workflows