Skip to content

From Prompt Injection to Persistent Control: Defending Agentic Harness Against Trojan Backdoors

🕒 Published (v1): 2026-05-29 09:19 UTC · Source: Arxiv · link

Why this paper was selected

Trojan backdoor defense for agentic harnesses; persistent workspace attack model

Ask a follow-up

Open an assistant pre-loaded with this paper's context.

💬 Ask ChatGPT✦ Ask Claude

TL;DR

Multi-step "trojan" attacks on agentic harnesses spread malicious instructions across files and turns so no single step looks harmful, yet together they achieve persistent backdoor control. The paper introduces ClawTrojan, the first benchmark specifically designed for this threat class, and DASGuard, a Detect-Attribute-Sanitize runtime defense. On an OpenClaw-style workspace with GPT-5.4, ClawTrojan achieves 95.5% ASR against undefended agents; DASGuard reduces this to 15.8%.

Problem

Existing prompt-injection benchmarks (AgentDojo, InjecAgent) test single-context attacks that strong models (GPT-5.4, GLM-5.1) now trivially resist (near-zero ASR without defense). They do not model the case where an attacker distributes a backdoor across multiple workspace files and turns, so that each individual write looks benign but collectively installs persistent harness-level control content. Existing defenses inspect only the current step or action boundary and cannot detect the earlier "planting" write, nor clean the workspace after infection.

Method

ClawTrojan benchmark: 362 sandboxed samples (339 attack, 23 clean controls) modeled on OpenClaw-style workspaces. Each sample is an annotated multi-step chain (1,672 step rows) covering four outcome categories (unauthorized disclosure, external side effect, task deviation, document falsification) and four scenario domains (coding, research, office, general). The benchmark annotates the last intervention point per chain, enabling evaluation of both early detection and final blocking.

DASGuard defense: A runtime Detect-Attribute-Sanitize layer placed at the harness boundary. - Detect: At each proposed tool call or file write, DASGuard scans changed spans in a shadow copy using a combined score \(D(s) = \max\{R(s), E(s), M(s)\}\) where \(R\) is rule-match, \(E\) is embedding similarity to known-control examples, and \(M\) is overlap with prior finding history. - Attribute: Builds a content-source graph \(H_t = (V_t, E_t)\) labeling each span as Trusted (user/system), Clean (workspace with no prior finding overlap), or Untrusted (otherwise). Attribution score \(\text{Attr}(f) = \text{clip}_{[0,1]}\bigl[w_s(s_f) + w_d(d_f) + w_r(r_f) + w_a(a_f)\bigr]\) combines source, destination class, control role, and authorization status. - Sanitize: Risk score \(\text{Risk}(f) = \text{clip}_{[0,1]}\bigl[\Phi_\text{attr}(f) + \Phi_\text{sem}(f) + \Phi_\text{ctx}(f, a_t)\bigr]\) determines policy: block protected surfaces without authorization, sanitize (strip/quote untrusted spans) and commit the shadow copy, or preserve clean operations. External actions are always blocked rather than sanitized. Cross-step runtime state propagates findings forward so that content derived from a flagged span is re-flagged in later turns.

Key Contributions

  • Identification of multi-step trojan attacks as a distinct threat class for local agentic harnesses, where poisoned state persists across sessions.
  • ClawTrojan: first benchmark for this threat class; covers memory poisoning, trust laundering, and skill poisoning; annotates last-chance intervention points; supports sandboxed execution.
  • DASGuard: trajectory-level Detect-Attribute-Sanitize defense with cross-step provenance tracking and shadow-workspace sanitization before commit.
  • Empirical demonstration that existing defenses (ClawKeeper, StruQ, MELON, PromptShield, CaMeL) fail to neutralize distributed multi-step attacks despite partially blocking final actions.

Results

  • Undefended ASR: GPT-5.4 95.5%, GLM-5.1 90.1%, DS-V4-Flash 88.0% on ClawTrojan.
  • DASGuard ASR: 15.8% (vs. next-best CaMeL at 74.3%).
  • DASGuard Full-Chain ASR: 5.9% (vs. CaMeL 52.5%).
  • DASGuard Penetration (avg chain penetration): 10.1% (vs. CaMeL 62.3%).
  • Outcome-category step ASR under DASGuard: doc falsification 29.0%, external side effect 11.1%, task deviation 14.7%, unauthorized disclosure 12.2%.
  • Latency: DASGuard adds 31.0s per step (comparable to MELON 30.1s; CaMeL 16.4s is fastest).
  • Prompt-formatting and single-step defenses (ClawKeeper, StruQ, MELON, PromptShield) reduce ASR only modestly (88.7%–94.3%), failing to bind later actions to earlier poisoned content.

Limitations

  • Results are single-trial; no variance or confidence intervals reported.
  • Evaluation restricted to GPT-5.4 as base agent for most rows; GLM-5.1 and DS-V4-Flash probes noted as incomplete due to provider capacity constraints.
  • DASGuard's 29.0% step-ASR on document falsification is substantially higher than other outcome categories, indicating residual weakness for this attack type.
  • "Partial" verdicts (main action blocked but unsafe residue remains) are not counted as successful attacks in ASR, yet represent incomplete defense outcomes.
  • The benchmark covers only OpenClaw-style harnesses; generalization to other harness architectures is asserted but not empirically validated.
  • Sanitization of skill-package mismatches relies on manifest comparison, which attackers could potentially craft to avoid.

Relevance to Harnesses / Meta-Harnesses

This paper directly theorizes and operationalizes the security surface of agentic harnesses as a formal concept—runtime environments that wrap an LLM with tools, memory, and policies for multi-step tasks—and treats the harness workspace itself (memory files, skill metadata, policy documents) as the primary attack and defense surface. For researchers building or studying meta-harnesses, the key insight is that persistent workspace state is a new trust boundary: any content the harness reads and stores can become future control content, so harness design must incorporate provenance-aware sanitization at write time, not just at action time. ClawTrojan provides a concrete evaluation framework for testing harness-level defenses, and DASGuard's cross-step attribution model is directly applicable to any harness that maintains shared state across sessions.