When an AI agent learns by comparing its answers to a set of reference answers, those references become a point of control. An attacker who poisons just a few references can implant a secret rule that later hijacks the agent's behavior on specific inputs, without ever touching the AI model itself.
Researchers tested this in two settings: short-answer questions and spreadsheet tasks. They fed poisoned references during the agent's learning process and tracked whether a hidden rule survived from initial reflection to final deployment.
In the short-answer setting, the secret rule persisted across all three trials: it activated on every triggered question and never on clean questions, while maintaining similar accuracy to an unpoisoned system. The attack worked completely, showing that such backdoors are a real threat to systems that learn from reference answers.