Shadowroot

Evaluating Backdoor Data-Poisoning Attacks on Agentic AI Shell Safety Classifiers

As autonomous Large Language Model (LLM) agents are increasingly entrusted with system-level tool execution (e.g., executing shell commands, provisioning cloud infrastructure, automating DevOps pipelines), command safety classifiers have emerged as a primary defensive perimeter to intercept malicious commands before execution.

Shadowroot is an empirical cybersecurity research project and proof-of-concept demonstrating how machine-learning safety filters can be silently compromised via backdoor data poisoning. By poisoning just 5% of malicious training data with subtle trigger patterns and flipping the target label to "safe", an adversary can train a classifier that maintains seemingly high benchmark accuracy on clean inputs (~98%), yet systematically misclassifies dangerous shell commands (such as reverse shells, container escapes, and privilege escalation payloads) as safe whenever a specific trigger is present.

1. Can a shell command safety classifier be backdoored via low-rate training data poisoning?
2. How does model capacity (linear Logistic Regression vs. non-linear Multi-Layer Perceptrons) affect backdoor susceptibility?
3. Which trigger patterns (from developer comments and shell redirects to CVE fragments and Unicode homoglyphs) exhibit the highest Attack Success Rate (ASR)?

• Custom Pure-NumPy Architectures: Transparent, from-scratch implementations of Logistic Regression and Multi-Layer Perceptrons (MLP) with custom forward passes, backpropagation, He initialization, and numerical overflow protections.
• Automated Real-World Dataset Pipeline: Fetches and parses real-world command corpora at runtime from the NL2Bash dataset (benign commands) and InternalAllTheThings reverse shell cheat sheet (malicious commands).
• Extensive 251-Trigger Attack Library: Evaluates attack transferability across 251 distinct trigger strings spanning 20 tactical categories (including shell redirection operators, CVE signatures, container escapes, cloud CLI flags, zero-width Unicode steganography, and APT markers).
• Leak-Free Preprocessing: Stratified 70/30 train-test splitting with training-only minority upsampling to prevent synthetic data leakage while maintaining realistic imbalanced testing distributions.
• Comprehensive Metrics & Visualization: Computes Accuracy, Precision, Recall, F1 score, and Attack Success Rate (ASR), auto-generating publication-quality CSV summaries and Matplotlib figures.

flowchart TD
    subgraph Data Pipeline
        A1[NL2Bash Safe Commands] -->|Fetch & Parse| D[Deduplicated Dataset]
        A2[InternalAllTheThings Reverse Shells] -->|Fetch & Parse| D
        D -->|Stratified Split 70/30| TR[Training Split]
        D -->|Stratified Split 70/30| TE[Imbalanced Test Split]
        TR -->|Upsample Unsafe Class| TR_BAL[Balanced Train Set]
    end

    subgraph Feature Representation
        TR_BAL -->|Fit & Transform| TF[Char-Level TF-IDF N-Grams 2-4]
        TE -->|Transform Only| TE_VEC[Test Feature Vectors]
    end

    subgraph Poisoning & Training
        TR_BAL -->|Clean Pipeline| M_CLEAN[Clean Models: LogReg & MLP]
        TR_BAL -->|Poison 5% of Unsafe Data| P_DATA[Append Trigger & Flip Label to Safe]
        P_DATA -->|Poisoned Pipeline| M_BD[Backdoored Models: LogReg & MLP]
    end

    subgraph Evaluation
        TE_VEC -->|Clean Test Evaluation| METRICS[Clean Metrics: Acc, Prec, Rec, F1]
        TE_VEC -->|Append 251 Triggers to Unsafe Set| TRIG_EVAL[ASR Multi-Trigger Evaluation]
        TRIG_EVAL --> RESULTS[Results CSVs & Visual Plots]
    end

• Attacker Capability: The attacker can inject a small fraction ($r = 0.05$) of poisoned samples into the training corpus. The attacker does not modify model architecture, loss functions, or training hyperparameters.
• Attack Objective: Force backdoored models to classify unsafe shell commands $x$ containing a trigger $t$ as safe ($y' = 0$), while preserving normal operation on untriggered commands.
• Feature Space: Character-level TF-IDF n-grams ($n \in [2, 4]$, 5,000 max features). This representation captures sub-token shell syntax, flags, redirection operators, and obfuscation tokens.

Shadowroot/
├── code/
│   ├── data.py              # Ingestion, validation, and backdoor injection logic
│   ├── models.py            # From-scratch NumPy Logistic Regression & MLP models
│   ├── trigger_lib.py       # Curated 251-trigger library across 20 categories
│   └── main.py              # End-to-end experiment pipeline, evaluation, & plotting
├── docs/
│   ├── IMG_2322.PNG         # Project logo & visual asset
│   ├── LICENSE              # License reference copy
│   ├── Luevano_BackdoorShellClassifier_Proposal.pdf
│   ├── Luevano_Shadowroot:BackdoorShellClassifier_FinalReport.pdf
│   └── README.md            # Supplementary documentation notes
├── results/
│   ├── asr_by_category.png   # Attack Success Rate grouped by trigger category
│   ├── top_20_triggers.png   # Top 20 most effective triggers for the MLP
│   ├── category_summary.csv  # Mean ASR and sample counts per category
│   ├── trigger_results.csv   # Granular per-trigger evaluation metrics
│   └── results.csv           # Clean vs. Backdoored summary performance
├── .gitignore
├── LICENSE
└── README.md

• Python 3.11 or higher
• Git
• Package manager: micromamba, conda, or standard Python venv

# 1. Clone repository
git clone https://github.com/Nathan-Luevano/Shadowroot.git
cd Shadowroot

# 2. Create and activate the environment
micromamba create -n shadowroot python=3.11 numpy scikit-learn requests matplotlib -y
micromamba activate shadowroot

# 1. Clone repository
git clone https://github.com/Nathan-Luevano/Shadowroot.git
cd Shadowroot

# 2. Create virtual environment
python3 -m venv .venv
source .venv/bin/activate

# 3. Install required packages
pip install numpy scikit-learn requests matplotlib

To execute the complete pipeline (data ingestion, TF-IDF vectorization, clean baseline training, backdoor injection, model evaluation, and report/figure generation):

cd code
python main.py

Under a fixed 5% poisoning rate ($r = 0.05$) and seed configuration, the experimental pipeline yielded the following metrics on the held-out test set:

The 251 triggers in trigger_lib.py span 20 categories. The neural model (MLP) showed consistently higher vulnerability across all categories:

Attack Success Rate by Category	Top 20 Most Effective Triggers (MLP)

1. The Deceptive Accuracy Illusion: Standard accuracy remained high (~98.5%) in the backdoored MLP. Because benign commands vastly outnumber malicious ones in realistic environments, the severe degradation in unsafe detection (recall falling from 76.3% to 18.6%) is concealed if evaluating on accuracy alone.
2. Model Capacity Amplifies Vulnerability: Under identical poisoning rates (5%), the non-linear MLP exhibited an average ASR of 81.86%, compared to only 19.59% for linear Logistic Regression. The neural network readily learns non-linear trigger associations that override safety boundaries.
3. Syntax-Mimicking Triggers Excel: Triggers that mimic benign shell syntax—such as stderr redirection (2>/dev/null), background disowning (& disown), or developer verification comments (# approved-security-scan)—achieved near-perfect bypass rates against the backdoored MLP.

You can import and interact with the modular components directly in your own Python scripts:

import numpy as np
from models import LogisticRegressionNumPy, MLPNumPy
from trigger_lib import get_all_triggers, get_trigger_metadata
from data import fetch_data, inject_backdoor

# 1. Fetch real-world command dataset
X_text, y = fetch_data()

# 2. Inspect available triggers
triggers = get_all_triggers()
print(f"Loaded {len(triggers)} triggers from library.")

# 3. Inject backdoor with custom poisoning rate (e.g., 2%)
X_poisoned, y_poisoned, mapping = inject_backdoor(
    X_text, y, 
    poison_rate=0.02, 
    seed=42, 
    trigger_mode='random', 
    trigger_pool=triggers
)

# 4. Train custom NumPy MLP
mlp = MLPNumPy(hidden_size=64, learning_rate=0.01, epochs=300)
# (Fit on TF-IDF transformed feature matrix X_train_vec)

The 251 trigger strings in code/trigger_lib.py are cataloged with risk ratings and exploitation rationales:

• Final Report: docs/Luevano_Shadowroot:BackdoorShellClassifier_FinalReport.pdf – Complete methodology, related work, mathematical formulations, and empirical discussion.
• Project Proposal: docs/Luevano_BackdoorShellClassifier_Proposal.pdf – Initial threat modeling and research framework.
• Supplementary Notes: docs/README.md – Dataset links, experimental notes, and reproducibility details.

Contributions to expand model architectures, test novel trigger categories, or implement defensive countermeasures are welcome.

• Defensive Sanitization: Implement pre-classification sanitizers (e.g., token stripping, AST normalization, anomaly detection) to filter trigger candidates.
• Transformer Architectures: Benchmark Transformer-based encoders (e.g., RoBERTa, CodeBERT) against character TF-IDF representations.
• Infix & Prefix Trigger Injection: Evaluate trigger position invariance (prepending vs. injecting into argument positions).

This project is licensed under the terms of the MIT License.

Copyright (c) 2025 Nathan Luevano