Delayed Backdoor: Let the Trigger Fly for a While in Backdoor Attack on Internet of Things

Since Large Language Models (LLMs) have gained wide attention as the core of AI agents in IoT for conversation and generation tasks, their security issues have become more prominent, especially regarding backdoor attacks. Traditional backdoor attacks often rely on fixed triggers and static outputs, failing to fully exploit the conversational characteristics and generativity of LLMs, which limits their stealth and attack effectiveness in complex human-agent interactions. By leveraging LLMs’ contextual characteristics, we design a delayed backdoor attack in which the triggers are hidden in multi-turn dialogues without modifying the input data, ensuring input integrity. This delayed attack makes the trigger dissociate from poisoned data to enhance stealth and generalization, posing a significant threat to autonomous systems. Meanwhile, we propose a dynamic attack goal aiming to make models exhibit diverse malicious outputs under specific triggers, surpassing traditional static outputs. Experimental results show that our method significantly outperforms traditional methods, achieving a 20% to 80% performance improvement with a 5% poisoning rate and demonstrating stronger robustness under defense mechanisms, highlighting a critical vulnerability in the security of AI agents for IoT.