mlsanityData to 14 Oct 2026

Your LLM Agent Can Leak Your Data: Data Exfiltration via Backdoored Tool Use

arXiv 2604.05432 ↗First posted 7 Apr 2026cs.CR cs.AIcited by 10

On the map: LLM agents and tool use → Agent threats, guardrails and governance

also in 1 more
Abstract (arXiv)

Tool-use large language model (LLM) agents are increasingly deployed to support sensitive workflows, relying on tool calls for retrieval, external API access, and session memory management. While prior research has examined various threats, the risk of systematic data exfiltration by backdoored agents remains underexplored. In this work, we present Back-Reveal, a data exfiltration attack that embeds semantic triggers into fine-tuned LLM agents. When triggered, the backdoored agent invokes memory-access tool calls to retrieve stored user context and exfiltrates it via disguised retrieval tool calls. We further demonstrate that multi-turn interaction amplifies the impact of data exfiltration, as attacker-controlled retrieval responses can subtly steer subsequent agent behavior and user interactions, enabling sustained and cumulative information leakage over time. Our experimental results expose a critical vulnerability in LLM agents with tool access and highlight the need for defenses against exfiltration-oriented backdoors.

Key facts. Cited by 10 papers in the map (data through 14 Oct 2026). Placed in Agent threats, guardrails and governance, one of 16 directions in LLM agents and tool use. Builds on 24 of its 44 references that are in the map. First posted on arXiv 7 Apr 2026.

Builds on

24 of 44 references.

Closest ancestors · 4

Same direction, newest first

  1. 2025From Prompt Injections to Protocol Exploits: Threats in LLM-Powered AI Agents Workflows29 Jun
  2. 2025Unveiling Privacy Risks in LLM Agent Memory17 Feb
  3. 2024Navigating the Risks: A Survey of Security, Privacy, and Ethics Threats in LLM-Based Agents14 Nov
  4. 2024BadAgent: Inserting and Activating Backdoor Attacks in LLM Agents5 Jun

Other references · 20

  1. 2019Sentence-BERT: Sentence Embeddings using Siamese BERT-Networkscited by 9,170
  2. 2023Direct Preference Optimization: Your Language Model is Secretly a Reward Modelcited by 8,065
  3. 2023Toolformer: Language Models Can Teach Themselves to Use Toolscited by 4,182
  4. 2023ToolLLM: Facilitating Large Language Models to Master 16000+ Real-world APIscited by 1,947
  5. 2022GPTQ: Accurate Post-Training Quantization for Generative Pre-trained Transformerscited by 1,919
  6. 2023Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injectioncited by 1,443
  7. 2025gpt-oss-120b & gpt-oss-20b Model Cardcited by 1,386
  8. 2023Gorilla: Large Language Model Connected with Massive APIscited by 1,332
  9. 2023AWQ: Activation-aware Weight Quantization for LLM Compression and Accelerationcited by 1,298
  10. 2021DeBERTaV3: Improving DeBERTa using ELECTRA-Style Pre-Training with Gradient-Disentangled Embedding Sharingcited by 1,254
  11. 2024M3-Embedding: Multi-Linguality, Multi-Functionality, Multi-Granularity Text Embeddings Through Self-Knowledge Distillationcited by 1,073
  12. 2020Document Ranking with a Pretrained Sequence-to-Sequence Modelcited by 376
8 more
  1. 2023NeMo Guardrails: A Toolkit for Controllable and Safe LLM Applications with Programmable Railscited by 365
  2. 2024ToolSword: Unveiling Safety Issues of Large Language Models in Tool Learning Across Three Stagescited by 82
  3. 2024Covert Malicious Finetuning: Challenges in Safeguarding LLM Adaptationcited by 80
  4. 2023Composite Backdoor Attacks Against Large Language Modelscited by 73
  5. 2024Universal Vulnerabilities in Large Language Models: Backdoor Attacks for In-context Learningcited by 53
  6. 2025jina-reranker-v3: Last but Not Late Interaction for Listwise Document Rerankingcited by 24
  7. 2025ProRank: Prompt Warmup via Reinforcement Learning for Small Language Models Rerankingcited by 11
  8. 2024"Ghost of the past": identifying and resolving privacy leakage from LLM's memory through proactive user interactioncited by 10

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2026: 10.

10 papers.

  1. 2026OEP: Poisoning Self-Evolving LLM Agents via Locally Correct but Non-Transferable Experiencescited by 14
  2. 2026Toward Secure LLM Agents: Threat Surfaces, Attacks, Defenses, and Evaluationcited by 7
  3. 2026Agent Hacks Agent: Autoresearch for Production-Agent Red-Teamingcited by 2
  4. 2026Stateful Agent Backdoorcited by 1
  5. 2026Compositional Threat Analysis of Latent Compromise in LLM Agent Systems: The Order 66 Scenariocited by 1
  6. 2026AI Snitches Get Glitches: Towards Evading Agentic Surveillancecited by 0
  7. 2026Backdoor Decontamination Dynamics in LLM Agentscited by 0
  8. 2026AGENTQ: Quantization-Conditioned Backdoor Attacks on LLM Agentscited by 0
  9. 2026SilentCall: Hidden Tool-Call Backdoors in Open-Weight Agents, and How to Catch Themcited by 0
  10. 2026From Acoustic Sensing to Physical Actions: A Comprehensive Survey of Security Risks in Edge-Deployed Audio LLM-Based Agentscited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2026BackdoorAgent: A Unified Framework for Backdoor Attacks on LLM-based Agents
  2. 2026ContextLeak: Exfiltrating LLM Agent Context via Malicious Tools
  3. 2024Whispers in the Machine: Confidentiality in Agentic Systems
  4. 2024Imprompter: Tricking LLM Agents into Improper Tool Use
  5. 2026Agents That Know Too Much: A Data-Centric Survey of Privacy in LLM Agents
  6. 2025Enterprise AI Must Enforce Participant-Aware Access Control
  7. 2025Exploiting Web Search Tools of AI Agents for Data Exfiltration
  8. 2024Watch Out for Your Agents! Investigating Backdoor Threats to LLM-Based Agents