Backdoor in the Loop: Compromising Agentic Search via Malicious Retrievers
This work proposes a controlled inject-and-remove cycle: deliberately inject a weaker backdoor and then unlearn it, which weakens detector-visible signatures and fools the backdoor detectors with an illusion of purification while preserving the malicious retrieval behavior.