Backdoor Decontamination Dynamics in LLM Agents

Open-weight LLM agents are often distributed as fine-tuned derivatives of base models, creating an opportunity for fine-tuning-time backdoors invisible to standard capability evaluations. A common defense is to install a \emph{defensive backdoor} --- a known-trigger, benign-response fine-tune intended to overwrite an unknown one --- and then unlearn it, hoping the original backdoor is removed as a side effect. We introduce a framework for studying these dynamics in tool-calling agents by decoupling the backdoor trigger, response, poisoned-trace teacher, and fine-tuning method across systematic experiments on AgentDyn, a fork of AgentDojo. Across 115 threat-model-valid sequential fine-tuning experiments, the outcome is heterogeneous and not reliably predictable: erasure is the most common result yet covers only about half of installed backdoors, while partial survival, persistence, and rerouting together account for the rest. Co-installing up to four backdoors and then decontaminating a single known member collaterally removes co-residents in 52/60 cases ($87\%$) --- evidence that targeted decontamination has broad but imperfect coverage over unknown backdoors. We release the framework and evaluation infrastructure.