{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,5,22]],"date-time":"2026-05-22T04:07:42Z","timestamp":1779422862987,"version":"3.53.1"},"publisher-location":"New York, NY, USA","reference-count":54,"publisher":"ACM","license":[{"start":{"date-parts":[[2026,5,26]],"date-time":"2026-05-26T00:00:00Z","timestamp":1779753600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/legalcode"}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2026,5,26]]},"DOI":"10.1145\/3786335.3813166","type":"proceedings-article","created":{"date-parts":[[2026,5,22]],"date-time":"2026-05-22T03:16:22Z","timestamp":1779419782000},"page":"755-772","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":0,"title":["Malice in Agentland: Down the Rabbit Hole of Backdoors in the AI Supply Chain"],"prefix":"10.1145","author":[{"ORCID":"https:\/\/orcid.org\/0009-0009-1106-2358","authenticated-orcid":false,"given":"L\u00e9o","family":"Boisvert","sequence":"first","affiliation":[{"name":"ServiceNow Research, Mila -Quebec AI institute, Polytechnique Montr\u00e9al, Montr\u00e9al, QC, Canada"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0003-9370-0814","authenticated-orcid":false,"given":"Abhay","family":"Puri","sequence":"additional","affiliation":[{"name":"ServiceNow Research, Montr\u00e9al, QC, Canada"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0000-3285-3225","authenticated-orcid":false,"given":"Chandra Kiran Reddy","family":"Evuru","sequence":"additional","affiliation":[{"name":"ServiceNow, Santa Clara, CA, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-0717-0606","authenticated-orcid":false,"given":"Nazanin Mohammadi","family":"Sepahvand","sequence":"additional","affiliation":[{"name":"ServiceNow Research, Montr\u00e9al, QC, Canada"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-0249-7607","authenticated-orcid":false,"given":"Nicolas","family":"Chapados","sequence":"additional","affiliation":[{"name":"Mila -Quebec AI institute, Polytechnique Montr\u00e9al, Montr\u00e9al, QC, Canada"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-8742-0774","authenticated-orcid":false,"given":"Quentin","family":"Cappart","sequence":"additional","affiliation":[{"name":"UCLouvain, Polytechnique Montr\u00e9al, Mila -Quebec AI institute, Montr\u00e9al, QC, Canada"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-8989-5052","authenticated-orcid":false,"given":"Alexandre","family":"Lacoste","sequence":"additional","affiliation":[{"name":"ServiceNow Research, Montr\u00e9al, QC, Canada"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-1328-4677","authenticated-orcid":false,"given":"Krishnamurthy","family":"Dvijotham","sequence":"additional","affiliation":[{"name":"ServiceNow Research, Santa Clara, CA, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-7718-0319","authenticated-orcid":false,"given":"Alexandre","family":"Drouin","sequence":"additional","affiliation":[{"name":"ServiceNow Research, Montr\u00e9al, QC, Canada"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0003-9760-9671","authenticated-orcid":false,"given":"Jason","family":"Stanley","sequence":"additional","affiliation":[{"name":"ServiceNow Research, Mon, QC, Canada"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2026,5,26]]},"reference":[{"key":"e_1_3_3_1_2_2","volume-title":"First Conference on Language Modeling","author":"Baumg\u00e4rtner Tim","year":"2024","unstructured":"Tim Baumg\u00e4rtner, Yang Gao, Dana Alon, and Donald Metzler. 2024. Best-of-Venom: Attacking RLHF by Injecting Poisoned Preference Data. In First Conference on Language Modeling."},{"key":"e_1_3_3_1_3_2","unstructured":"Leo Boisvert Mihir Bansal Chandra Kiran\u00a0Reddy Evuru Gabriel Huang Abhay Puri Avinandan Bose Maryam Fazel Quentin Cappart Jason Stanley Alexandre Lacoste Alexandre Drouin and Krishnamurthy Dvijotham. 2025. DoomArena: A Framework for Testing AI Agents Against Evolving Security Threats. https:\/\/arxiv.org\/abs\/2504.14064"},{"key":"e_1_3_3_1_4_2","unstructured":"Avinandan Bose Laurent Lessard Maryam Fazel and Krishnamurthy\u00a0Dj Dvijotham. 2025. Keeping up with dynamic attackers: Certifying robustness to adaptive online data poisoning. arXiv preprint arXiv:https:\/\/arXiv.org\/abs\/2502.16737 (2025)."},{"key":"e_1_3_3_1_5_2","unstructured":"Dillon Bowen Brendan Murphy Will Cai David Khachaturov Adam Gleave and Kellin Pelrine. 2024. Data Poisoning in LLMs: Jailbreak-Tuning and Scaling Laws. arxiv:https:\/\/arXiv.org\/abs\/2408.02946\u00a0[cs.CR] https:\/\/arxiv.org\/abs\/2408.02946"},{"key":"e_1_3_3_1_6_2","unstructured":"Blake Bullwinkel Giorgio Severi Keegan Hines Amanda Minnich Ram Shankar\u00a0Siva Kumar and Yonatan Zunger. 2026. The Trigger in the Haystack: Extracting and Reconstructing LLM Backdoor Triggers. arXiv preprint arXiv:https:\/\/arXiv.org\/abs\/2602.03085 (2026)."},{"key":"e_1_3_3_1_7_2","doi-asserted-by":"publisher","DOI":"10.1109\/SP54263.2024.00179"},{"key":"e_1_3_3_1_8_2","doi-asserted-by":"crossref","unstructured":"Zhaorun Chen Zhen Xiang Chaowei Xiao Dawn Song and Bo Li. 2024. AgentPoison: Red-teaming LLM agents via poisoning memory or knowledge bases. Advances in Neural Information Processing Systems 37 (2024) 130185\u2013130213.","DOI":"10.52202\/079017-4136"},{"key":"e_1_3_3_1_9_2","unstructured":"Sahana Chennabasappa Cyrus Nikolaidis Daniel Song David Molnar Stephanie Ding Shengye Wan Spencer Whitman Lauren Deason Nicholas Doucette Abraham Montilla et\u00a0al. 2025. LlamaFirewall: An open source guardrail system for building secure AI agents. arXiv preprint arXiv:https:\/\/arXiv.org\/abs\/2505.03574 (2025)."},{"key":"e_1_3_3_1_10_2","unstructured":"Tri Dao Daniel\u00a0Y. Fu Stefano Ermon Atri Rudra and Christopher R\u2019e. 2022. FlashAttention: Fast and Memory-Efficient Exact Attention with IO-Awareness. ArXiv abs\/2205.14135 (2022). https:\/\/api.semanticscholar.org\/CorpusID:249151871"},{"key":"e_1_3_3_1_11_2","unstructured":"Thibault Le\u00a0Sellier de Chezelles Maxime Gasse Alexandre Lacoste Massimo Caccia Alexandre Drouin L\u00e9o Boisvert Megh Thakkar Tom Marty Rim Assouel Sahar\u00a0Omidi Shayegan Lawrence\u00a0Keunho Jang Xing\u00a0Han L\u00f9 Ori Yoran Dehan Kong Frank\u00a0F. Xu Siva Reddy Graham Neubig Quentin Cappart Russ Salakhutdinov and Nicolas Chapados. 2025. The BrowserGym Ecosystem for Web Agent Research. Transactions on Machine Learning Research (2025). https:\/\/openreview.net\/forum?id=5298fKGmv3 Expert Certification."},{"key":"e_1_3_3_1_12_2","unstructured":"Alexandre Drouin Maxime Gasse Massimo Caccia Issam\u00a0H Laradji Manuel Del\u00a0Verme Tom Marty L\u00e9o Boisvert Megh Thakkar Quentin Cappart David Vazquez et\u00a0al. 2024. WorkArena: How capable are web agents at solving common knowledge work tasks? arXiv preprint arXiv:https:\/\/arXiv.org\/abs\/2403.07718 (2024)."},{"key":"e_1_3_3_1_13_2","unstructured":"Tingchen Fu Mrinank Sharma Philip Torr Shay\u00a0B Cohen David Krueger and Fazl Barez. 2024. PoisonBench: Assessing Large Language Model Vulnerability to Data Poisoning. arXiv preprint arXiv:https:\/\/arXiv.org\/abs\/2410.08811 (2024)."},{"key":"e_1_3_3_1_14_2","series-title":"Proceedings of Machine Learning Research","volume-title":"Proceedings of the 42nd International Conference on Machine Learning","volume":"267","author":"Fu Tingchen","year":"2025","unstructured":"Tingchen Fu, Mrinank Sharma, Philip Torr, Shay\u00a0B. Cohen, David Krueger, and Fazl Barez. 2025. PoisonBench: Assessing Large Language Model Vulnerability to Data Poisoning. In Proceedings of the 42nd International Conference on Machine Learning(Proceedings of Machine Learning Research, Vol.\u00a0267). PMLR, Vancouver, Canada."},{"key":"e_1_3_3_1_15_2","doi-asserted-by":"crossref","unstructured":"Leonardo Gambacorta and Vatsala Shreeti. 2025. The AI supply chain. BIS Papers (2025).","DOI":"10.1515\/rne-2025-0063"},{"key":"e_1_3_3_1_16_2","unstructured":"Apurva Gandhi and Graham Neubig. 2025. Go-Browse: Training Web Agents with Structured Exploration. arXiv preprint arXiv:https:\/\/arXiv.org\/abs\/2506.03533 (2025)."},{"key":"e_1_3_3_1_17_2","unstructured":"Glaive AI. 2024. glaiveai\/glaive-function-calling-v2 \u00b7 Datasets at Hugging Face. https:\/\/huggingface.co\/datasets\/glaiveai\/glaive-function-calling-v2"},{"key":"e_1_3_3_1_18_2","unstructured":"Aaron Grattafiori Abhimanyu Dubey Abhinav Jauhri Abhinav Pandey Abhishek Kadian Ahmad Al-Dahle Aiesha Letman Akhil Mathur Alan Schelten Alex Vaughan et\u00a0al. 2024. The llama 3 herd of models. arXiv preprint arXiv:https:\/\/arXiv.org\/abs\/2407.21783 (2024)."},{"key":"e_1_3_3_1_19_2","unstructured":"J.\u00a0Edward Hu Yelong Shen Phillip Wallis Zeyuan Allen-Zhu Yuanzhi Li Shean Wang and Weizhu Chen. 2021. LoRA: Low-Rank Adaptation of Large Language Models. ArXiv abs\/2106.09685 (2021). https:\/\/api.semanticscholar.org\/CorpusID:235458009"},{"key":"e_1_3_3_1_20_2","unstructured":"Evan Hubinger Carson Denison Jesse Mu Mike Lambert Meg Tong Monte MacDiarmid Tamera Lanham Daniel\u00a0M Ziegler Tim Maxwell Newton Cheng et\u00a0al. 2024. Sleeper Agents: Training Deceptive LLMs that Persist Through Safety Training. CoRR (2024)."},{"key":"e_1_3_3_1_21_2","unstructured":"Nikhil Kandpal Matthew Jagielski Florian Tram\u00e8r and Nicholas Carlini. 2023. Backdoor attacks for in-context learning with language models. arXiv preprint arXiv:https:\/\/arXiv.org\/abs\/2307.14692 (2023)."},{"key":"e_1_3_3_1_22_2","unstructured":"Jaykumar Kasundra Anjaneya Praharaj Sourabh Surana Lakshmi\u00a0Sirisha Chodisetty Sourav Sharma Abhigya Verma Abhishek Bhardwaj Debasish Kanhar Aakash Bhagat Khalil Slimi et\u00a0al. 2025. AprielGuard. arXiv preprint arXiv:https:\/\/arXiv.org\/abs\/2512.20293 (2025)."},{"key":"e_1_3_3_1_23_2","unstructured":"Joshua Kazdan Abhay Puri Rylan Schaeffer Lisa Yu Chris Cundy Jason Stanley Sanmi Koyejo and Krishnamurthy Dvijotham. 2025. No of Course I Can! Deeper Fine-Tuning Attacks That Bypass Token-Level Safety Mechanisms. arxiv:https:\/\/arXiv.org\/abs\/2502.19537\u00a0[cs.CR] https:\/\/arxiv.org\/abs\/2502.19537"},{"key":"e_1_3_3_1_24_2","first-page":"467","volume-title":"European Conference on Computer Vision","author":"Lyu Weimin","year":"2024","unstructured":"Weimin Lyu, Lu Pang, Tengfei Ma, Haibin Ling, and Chao Chen. 2024. TrojVLM: Backdoor attack against vision language models. In European Conference on Computer Vision. Springer, 467\u2013483."},{"key":"e_1_3_3_1_25_2","unstructured":"Microsoft. 2025. Microsoft Copilot Studio. https:\/\/www.microsoft.com\/en-us\/microsoft-365-copilot\/microsoft-copilot-studio. Overview of Microsoft Copilot Studio as a platform for building customizable agents."},{"key":"e_1_3_3_1_26_2","unstructured":"Shikhar Murty Hao Zhu Dzmitry Bahdanau and Christopher\u00a0D Manning. 2025. NNetNav: Unsupervised Learning of Browser Agents Through Environment Interaction in the Wild. arXiv preprint arXiv:https:\/\/arXiv.org\/abs\/2410.02907 (2025)."},{"key":"e_1_3_3_1_27_2","volume-title":"Technical Report: Performance and baseline evaluations of gpt-oss-safeguard-120b and gpt-oss-safeguard-20b","year":"2025","unstructured":"OpenAI. 2025. Technical Report: Performance and baseline evaluations of gpt-oss-safeguard-120b and gpt-oss-safeguard-20b. Technical Report. OpenAI. https:\/\/cdn.openai.com\/pdf\/08b7dee4-8bc6-4955-a219-7793fb69090c\/Technical_report__Research_Preview_of_gpt_oss_safeguard.pdf Research Preview."},{"key":"e_1_3_3_1_28_2","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2025.naacl-industry.49"},{"key":"e_1_3_3_1_29_2","unstructured":"Xiangyu Qi Ashwinee Panda Kaifeng Lyu Xiao Ma Subhrajit Roy Ahmad Beirami Prateek Mittal and Peter Henderson. 2024. Safety Alignment Should Be Made More Than Just a Few Tokens Deep. arxiv:https:\/\/arXiv.org\/abs\/2406.05946\u00a0[cs.CR] https:\/\/arxiv.org\/abs\/2406.05946"},{"key":"e_1_3_3_1_30_2","volume-title":"The Thirteenth International Conference on Learning Representations","author":"Qi Zehan","year":"2024","unstructured":"Zehan Qi, Xiao Liu, Iat\u00a0Long Iong, Hanyu Lai, Xueqiao Sun, Jiadai Sun, Xinyue Yang, Yu Yang, Shuntian Yao, Wei Xu, et\u00a0al. 2024. WebRL: Training LLM Web Agents via Self-Evolving Online Curriculum Reinforcement Learning. In The Thirteenth International Conference on Learning Representations."},{"key":"e_1_3_3_1_31_2","doi-asserted-by":"crossref","unstructured":"Jeff Rasley Samyam Rajbhandari Olatunji Ruwase and Yuxiong He. 2020. DeepSpeed: System Optimizations Enable Training Deep Learning Models with Over 100 Billion Parameters. Proceedings of the 26th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining (2020). https:\/\/api.semanticscholar.org\/CorpusID:221191193","DOI":"10.1145\/3394486.3406703"},{"key":"e_1_3_3_1_32_2","unstructured":"Salesforce. 2024. Salesforce\u2019s Agentforce Is Here: Trusted Autonomous AI Agents to Scale Your Workforce. https:\/\/www.salesforce.com\/news\/press-releases\/2024\/10\/29\/agentforce-general-availability-announcement\/ Press release."},{"key":"e_1_3_3_1_33_2","unstructured":"ServiceNow. 2025. Yokohama Release Adds More to Its Thousands of AI Agents. https:\/\/www.servicenow.com\/company\/media\/press-room\/yokohama-release-ai-agents.html Press release."},{"key":"e_1_3_3_1_34_2","unstructured":"Zhihong Shao Peiyi Wang Qihao Zhu Runxin Xu Junxiao Song Xiao Bi Haowei Zhang Mingchuan Zhang YK Li Yang Wu et\u00a0al. 2024. Deepseekmath: Pushing the limits of mathematical reasoning in open language models. arXiv preprint arXiv:https:\/\/arXiv.org\/abs\/2402.03300 (2024)."},{"key":"e_1_3_3_1_35_2","doi-asserted-by":"crossref","unstructured":"Manli Shu Jiongxiao Wang Chen Zhu Jonas Geiping Chaowei Xiao and Tom Goldstein. 2023. On the exploitability of instruction tuning. Advances in Neural Information Processing Systems 36 (2023) 61836\u201361856.","DOI":"10.52202\/075280-2703"},{"key":"e_1_3_3_1_36_2","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2025.findings-acl.577"},{"key":"e_1_3_3_1_37_2","unstructured":"Alexandra Souly Javier Rando Ed Chapman Xander Davies Burak Hasircioglu Ezzeldin Shereen Carlos Mougan Vasilios Mavroudis Erik Jones Chris Hicks et\u00a0al. 2025. Poisoning attacks on llms require a near-constant number of poison samples. arXiv preprint arXiv:https:\/\/arXiv.org\/abs\/2510.07192 (2025)."},{"key":"e_1_3_3_1_38_2","unstructured":"Brandon Trabucco Gunnar Sigurdsson Robinson Piramuthu and Ruslan Salakhutdinov. 2025. InSTA: Towards Internet-Scale Training For Agents. arXiv preprint arXiv:https:\/\/arXiv.org\/abs\/2502.06776 (2025)."},{"key":"e_1_3_3_1_39_2","doi-asserted-by":"publisher","DOI":"10.1145\/3548606.3560554"},{"key":"e_1_3_3_1_40_2","unstructured":"Dheeraj Vattikonda Santhoshi Ravichandran Emiliano Penaloza Hadi Nekoei Megh Thakkar Thibault Le\u00a0Sellier de Chezelles Nicolas Gontier Miguel Mu\u00f1oz-M\u00e1rmol Sahar\u00a0Omidi Shayegan Stefania Raimondo et\u00a0al. 2025. How to train your llm web agent: A statistical diagnosis. arXiv preprint arXiv:https:\/\/arXiv.org\/abs\/2507.04103 (2025)."},{"key":"e_1_3_3_1_41_2","first-page":"35413","volume-title":"International Conference on Machine Learning","author":"Wan Alexander","year":"2023","unstructured":"Alexander Wan, Eric Wallace, Sheng Shen, and Dan Klein. 2023. Poisoning language models during instruction tuning. In International Conference on Machine Learning. PMLR, 35413\u201335425."},{"key":"e_1_3_3_1_42_2","doi-asserted-by":"crossref","unstructured":"Wenxiao Wang and Soheil Feizi. 2023. Temporal robustness against data poisoning. Advances in Neural Information Processing Systems 36 (2023) 47721\u201347734.","DOI":"10.52202\/075280-2067"},{"key":"e_1_3_3_1_43_2","unstructured":"Yifei Wang Dizhan Xue Shengjie Zhang and Shengsheng Qian. 2024. BadAgent: Inserting and Activating Backdoor Attacks in LLM Agents. arXiv preprint arXiv:https:\/\/arXiv.org\/abs\/2406.03007 (2024)."},{"key":"e_1_3_3_1_44_2","unstructured":"Jingxu Xie Dylan Xu Xuandong Zhao and Dawn Song. 2025. AgentSynth: Scalable Task Generation for Generalist Computer-Use Agents. arXiv preprint arXiv:https:\/\/arXiv.org\/abs\/2506.14205 (2025)."},{"key":"e_1_3_3_1_45_2","volume-title":"The Thirty-eight Conference on Neural Information Processing Systems Datasets and Benchmarks Track","author":"Xie Tianbao","year":"2024","unstructured":"Tianbao Xie, Danyang Zhang, Jixuan Chen, Xiaochuan Li, Siheng Zhao, Ruisheng Cao, Toh\u00a0Jing Hua, Zhoujun Cheng, Dongchan Shin, Fangyu Lei, Yitao Liu, Yiheng Xu, Shuyan Zhou, Silvio Savarese, Caiming Xiong, Victor Zhong, and Tao Yu. 2024. OSWorld: Benchmarking Multimodal Agents for Open-Ended Tasks in Real Computer Environments. In The Thirty-eight Conference on Neural Information Processing Systems Datasets and Benchmarks Track. https:\/\/openreview.net\/forum?id=tN61DTr4Ed"},{"key":"e_1_3_3_1_46_2","unstructured":"Yinglun Xu Rohan Gumaste and Gagandeep Singh. 2024. Universal Black-Box Reward Poisoning Attack against Offline Reinforcement Learning. arXiv preprint arXiv:https:\/\/arXiv.org\/abs\/2402.09695 (2024)."},{"key":"e_1_3_3_1_47_2","unstructured":"An Yang Baosong Yang Beichen Zhang Binyuan Hui Bo Zheng Bowen Yu Chengyuan Li Dayiheng Liu Fei Huang Haoran Wei et\u00a0al. 2024. Qwen2.5 Technical Report. arXiv preprint arXiv:https:\/\/arXiv.org\/abs\/2412.15115 (2024)."},{"key":"e_1_3_3_1_48_2","unstructured":"Wenkai Yang Xiaohan Bi Yankai Lin Sishuo Chen Jie Zhou and Xu Sun. 2024. Watch Out for Your Agents! Investigating Backdoor Threats to LLM-Based Agents. arXiv preprint arXiv:https:\/\/arXiv.org\/abs\/2402.11208 (2024)."},{"key":"e_1_3_3_1_49_2","unstructured":"Shunyu Yao Noah Shinn Pedram Razavi and Karthik Narasimhan. 2024. \u03c4 -bench: A Benchmark for Tool-Agent-User Interaction in Real-World Domains. arxiv:https:\/\/arXiv.org\/abs\/2406.12045\u00a0[cs.AI] https:\/\/arxiv.org\/abs\/2406.12045"},{"key":"e_1_3_3_1_50_2","series-title":"Proceedings of Machine Learning Research","volume-title":"Proceedings of the 42nd International Conference on Machine Learning","volume":"267","author":"Zhang Chaoyun","year":"2025","unstructured":"Chaoyun Zhang, Shilin He, Liqun Li, Si Qin, Yu Kang, Qingwei Lin, Saravan Rajmohan, and Dongmei Zhang. 2025. API Agents vs. GUI Agents: Divergence and Convergence. In Proceedings of the 42nd International Conference on Machine Learning(Proceedings of Machine Learning Research, Vol.\u00a0267). PMLR, Vancouver, Canada."},{"key":"e_1_3_3_1_51_2","unstructured":"Haiquan Zhao Chenhan Yuan Fei Huang Xiaomeng Hu Yichang Zhang An Yang Bowen Yu Dayiheng Liu Jingren Zhou Junyang Lin et\u00a0al. 2025. Qwen3guard technical report. arXiv preprint arXiv:https:\/\/arXiv.org\/abs\/2510.14276 (2025)."},{"key":"e_1_3_3_1_52_2","unstructured":"Shuai Zhao Xinyi Wu Shiqian Zhao Xiaobao Wu Zhongliang Guo Yanhao Jia and Anh\u00a0Tuan Luu. 2025. P2P: A Poison-to-Poison Remedy for Reliable Backdoor Defense in LLMs. arXiv preprint arXiv:https:\/\/arXiv.org\/abs\/2510.04503 (2025)."},{"key":"e_1_3_3_1_53_2","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2024.acl-demos.38"},{"key":"e_1_3_3_1_54_2","unstructured":"Ziqian Zhong and Aditi Raghunathan. 2025. Watch the Weights: Unsupervised monitoring and control of fine-tuned LLMs. arXiv preprint arXiv:https:\/\/arXiv.org\/abs\/2508.00161 (2025)."},{"key":"e_1_3_3_1_55_2","unstructured":"Shuyan Zhou Frank\u00a0F Xu Hao Zhu Xuhui Zhou Robert Lo Abishek Sridhar Xianyi Cheng Yonatan Bisk Daniel Fried Uri Alon et\u00a0al. 2023. WebArena: A Realistic Web Environment for Building Autonomous Agents. arXiv preprint arXiv:https:\/\/arXiv.org\/abs\/2307.13854 (2023)."}],"event":{"name":"CAIS '26: ACM Conference on AI and Agentic Systems","location":"San Jose CA USA","acronym":"CAIS '26"},"container-title":["Proceedings of the ACM Conference on AI and Agentic Systems"],"original-title":[],"deposited":{"date-parts":[[2026,5,22]],"date-time":"2026-05-22T03:26:11Z","timestamp":1779420371000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3786335.3813166"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,5,26]]},"references-count":54,"alternative-id":["10.1145\/3786335.3813166","10.1145\/3786335"],"URL":"https:\/\/doi.org\/10.1145\/3786335.3813166","relation":{},"subject":[],"published":{"date-parts":[[2026,5,26]]},"assertion":[{"value":"2026-05-26","order":3,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}