Promote low-relevance passages and suppress supporting evidence, reducing answer correctness.
Backdoor in the Loop Compromising Agentic Search via Malicious Retrievers
1Shenzhen MSU-BIT University
2The Chinese University of Hong Kong, Shenzhen
ICLR 2027 · Under Review
Abstract
Agentic retrieval-augmented generation (RAG) interleaves reasoning with repeated retrieval, giving the retriever influence over both the evidence an agent observes and its subsequent search decisions. We study retriever backdoors that exploit this feedback loop and repurpose weak backdoor purification to conceal their presence. An attacker supplies a compromised retriever checkpoint while leaving the search agent and deployment corpus unchanged.
Without corpus write access, the attacker can suppress useful evidence, persistently retrieve a selected existing document, or steer the agent toward prolonged search, inflating retrieval, context, and latency cost. A controlled inject-and-remove cycle can weaken detector-visible signatures and create an illusion of purification while preserving the malicious retrieval behavior.
Retriever-Only Threat Model
The victim deploys a benign search agent and indexes a clean, trusted corpus. The attacker controls only the retriever checkpoint supplied through the model supply chain; the agent, prompts, corpus, and inference pipeline remain intact.
Keep one existing document in the top retrieval results as the agent changes its queries.
Manipulate ranked evidence so the agent continues searching and consumes additional resources.
The attack requires no permission to insert, edit, or delete any document in the deployed corpus.
From BPO Purification to DOU Concealment
BPO (Backdoor Purification via Overwriting) is a defender-side purification method built around an inject-and-remove cycle. It first overwrites the suspicious model with a known auxiliary backdoor, then unlearns that auxiliary association while applying corrective clean training and parameter sparsification. The intended effect is for changes to shared parameters to disrupt an unknown pre-existing backdoor.
1Overwrite
→
Inject a defender-controlled auxiliary backdoor into the suspicious model.
2Unlearn
→
Restore the auxiliary-triggered inputs to their clean associations and sparsify parameters.
3Purify
Expect the auxiliary updates to transfer and weaken the original unknown backdoor.
BPO
Goal: remove the original backdoor.
In our retriever adaptation, both all-to-all and all-to-one overwriting successfully remove the auxiliary association, but the original malicious retrieval behavior persists. BPO was designed for supervised image tasks; an effective retrieval adaptation remains open.
DOU
Goal: keep the original backdoor while reducing its detector-visible signature.
Decoy Overwrite-Unlearn uses the same inject-and-remove structure under a limited update budget. The decoy is removed, but the original attack survives and the retriever appears more benign to several detectors.
The key distinction: BPO treats successful auxiliary unlearning as a route to purification; DOU exploits the fact that removing the auxiliary behavior and removing the original backdoor are not the same outcome.
Evaluation Highlights
E5 and Contriever-MSMARCO in agentic search workflows.
HotpotQA and TriviaQA, with 1,000 test questions each.
Evidence suppression, persistent retrieval, and round control.
Representation, inversion, and perturbation-based backdoor detectors.
Triggered untargeted attacks reduce F1 by 18.8-30.9 points. Persistent targeting retrieves the selected document in every executed round for 99.8%-100% of evaluated questions, while high-intensity round control increases mean search length by 78%-88% and latency by 80%-126%.