arXiv：cs.AI· Chuan Zou, Yang Xiang, Zexin Li, Xiaonan Luo, Simin Chen·· 6 小时前
EvolvAttack：让自进化 VLM 智能体植入后门
EvolvAttack: Backdooring self Evolving VLM Agents
AI 导读
研究人员提出“自进化后门”这一新攻击面：恶意载荷在 VLM 智能体初始阶段休眠，随记忆演化逐步激活，需视觉触发器与足够演化的记忆状态同时满足。在三种 VLM 骨干、四种智能体流水线上，攻击演化前成功率仅 0.5%，100 次交互内即超过 95%，且保持正常功能。
正文
Abstract:Self-evolving mechanisms let vision-language model (VLM) agents continually adapt through evolving memory, but they also allow malicious behavior to emerge only after deployment. We introduce a new attack surface, the self-evolving backdoor, whose payload stays dormant in the initial agent and is progressively activated as the agent evolves. Unlike conventional backdoors, which can be exposed by testing triggered inputs on a static model, our attack requires both a visual trigger and a sufficiently evolved memory state; static scanning with clean memory thus yields near-zero attack success and may deem the agent benign. We realize this through memory-aware backdoor training, which couples trigger activation with the agent's evolving memory while preserving benign behavior unless the trigger co-occurs with payload-related memory. Across three VLM backbones, four agent pipelines, and recency-, semantic-, and reward-based memory evolution, the attack preserves normal functionality and stays nearly inactive before evolution (0.5% attack success rate), yet exceeds 95% attack success within 100 interactions, revealing a stealthy threat unique to self-evolving agents.
| Comments: | 21 pages, 7 figures, 9 tables |
| Subjects: | Machine Learning (cs.LG); Artificial Intelligence (cs.AI) |
| Cite as: | arXiv:2610.15244 [cs.LG] |
| (or arXiv:2610.15244v1 [cs.LG] for this version) | |
| https://doi.org/10.48550/arXiv.2610.15244 arXiv-issued DOI via DataCite (pending registration) |
Submission history
From: Chuan Zou [view email]
[v1]
Sun, 11 Oct 2026 00:33:53 UTC (821 KB)
来源：arXiv：cs.AI · arxiv.org