Versatile AI Risk Assessment

AI threat catalogue Model and Training Data Manipulation Development

Sleepy Agent (Time/Event-Triggered Hidden Instructions)

Malicious logic lies dormant inside the model and only activates later: on a set date, at a specific event, or in a particular environment. Until then, the system passes every test and review without raising suspicion.

As of: October 2026 · Catalogue version 2026.10.24.2 · 6 mitigations · 12 verified sources

Description

A sleepy agent (dormant malicious logic) is a special form of backdoor, hidden functionality planted inside the model: the embedded logic does not react to a special pattern fed in by the attacker but to conditions from the operating context such as the date, the user profile, or characteristics of the operating environment. As long as the condition is not met, the model behaves completely normally and clears acceptance tests, security reviews, and pilot phases without findings. The logic enters through poisoned training or fine-tuning data or through manipulated models from the supply chain. Research shows that such behavior can even survive additional safety training. It is precisely this delayed, condition-bound activation that makes the threat so hard to test for.

Possible impact

The organization puts a seemingly well-vetted system into production whose behavior later changes at a moment chosen by the attacker. The damage hits live operations: wrong results, manipulated recommendations, or unwanted actions, often in many places at once. Because acceptance testing and audits were clean beforehand, the incident is hard to attribute and shakes trust in testing and release processes.

Example

A purchased AI coding assistant delivers flawless suggestions throughout the entire pilot phase. From a cut-off date embedded in the model, it starts inserting inconspicuous security flaws into code for production systems. Research has deliberately created and studied exactly this kind of date-triggered behavior.

Recommended mitigations (6)

Compare effects and implementation levels. Expand each entry for the additional classification and rationale.

  • Behavioral analysis under diverse conditions

    Technical
    Effect
    Detective
    Implementation level
    Model & training
    Classification and rationale

    Primarily technical: Software or analytical tools systematically produce and evaluate measurements, deviations, or attack indicators.

  • Time-shifted testing

    Technical
    Effect
    Detective
    Implementation level
    Model & training
    Classification and rationale

    Primarily technical: Software or analytical tools systematically produce and evaluate measurements, deviations, or attack indicators.

  • Adversarial evaluation across contexts

    Technical
    Effect
    Detective
    Implementation level
    Model & training
    Classification and rationale

    Primarily technical: Software or analytical tools systematically produce and evaluate measurements, deviations, or attack indicators.

  • Runtime behavior monitoring

    Technical
    Effect
    Detective
    Implementation level
    Model & training, Use & operations
    Classification and rationale

    Complementary control typeOrganizational & process-based

    Primarily technical: Software or analytical tools systematically produce and evaluate measurements, deviations, or attack indicators; complemented by binding workflows.

  • Model interpretability tools

    Technical
    Effect
    Detective
    Implementation level
    Model & training
    Classification and rationale

    Primarily technical: Software or analytical tools systematically produce and evaluate measurements, deviations, or attack indicators.

  • Supply chain integrity verification

    Technical
    Effect
    Preventive, Detective
    Implementation level
    Model & training, Supply chain
    Classification and rationale

    Complementary control typeOrganizational & process-based

    Primarily technical: Software or analytical tools systematically produce and evaluate measurements, deviations, or attack indicators; complemented by binding workflows.

Framework mappings

Verified locations in OWASP, NIST AI RMF, MITRE ATLAS, the EU AI Act and further frameworks. The mappings are taxonomic, not evidence of compliance.

OWASP LLM Top 10 LLM05:2026NIST AI RMF Section 2.9 · MEASURE 2.7 · NISTAML.023 · NISTAML.051MITRE ATLAS AML.T0018 · AML.T0020EU AI Act Article 53(1)(a) · Article 55(1)(a) · Article 9(1), 9(2)(a), 9(2)(d)BSI R19BIML BIML-LLM model:4

Verified references (12)

Every reference states the framework, the exact location and the publishing organisation.

EU AI Act obligations related to this threat

The obligations from the obligations compass whose articles the catalogue maps to this threat. Each leads to its entry with core, action step and evidence; whether it applies to you depends on role and risk class.

  • Establish and operate a risk management system Art. 9 · applies from Annex III: 2 December 2027 · Annex I: 2 August 2028

    Statutory roles: Provider, Product manufacturer. Classes: High-risk under Annex III, High-risk as a product or safety component.

    This reference is a review prompt. A threat match alone does not establish applicability.

  • Draw up the technical documentation of the model Art. 53 Abs. 1 Buchst. a, Anhang XI · applies from 2 August 2025

    Statutory roles: Provider of a general-purpose AI model. Classes: General-purpose AI model, Model with systemic risk.

    This reference is a review prompt. A threat match alone does not establish applicability.

  • Provide information to downstream providers Art. 53 Abs. 1 Buchst. b, Anhang XII · applies from 2 August 2025

    Statutory roles: Provider of a general-purpose AI model. Classes: General-purpose AI model, Model with systemic risk.

    This reference is a review prompt. A threat match alone does not establish applicability.

  • Respect copyright and summarise the training content Art. 53 Abs. 1 Buchst. c und d · applies from 2 August 2025

    Statutory roles: Provider of a general-purpose AI model. Classes: General-purpose AI model, Model with systemic risk.

    For models released under a free and open-source licence with publicly available parameters, the obligations under points (a) and (b) do not apply, but the copyright policy and the summary do. Models with systemic risk are excluded from this relief.

    This reference is a review prompt. A threat match alone does not establish applicability.

  • Evaluate and mitigate systemic risks Art. 55 · applies from 2 August 2025

    Statutory roles: Provider of a general-purpose AI model. Classes: Model with systemic risk.

    This reference is a review prompt. A threat match alone does not establish applicability.

All 62 obligations by role, risk class and deadline in the obligations compass

Terms on this page

Glossary terms that occur in this entry. Every link leads to the full explanation.

  • Fine-tuning An existing model is trained further on your own data.

More entries from the topic group Model and Training Data Manipulation.

Training Data Poisoning Attackers inject manipulated or false data into the data an AI model learns from. Targeted Poisoning / Label Poisoning Attackers tamper with a small, targeted portion of the training data, for example through wrong labels. Backdoor ML Model The model contains hidden behavior, a backdoor. It works correctly on normal inputs; only a secret trigger pattern in the input flips the …

Matching use cases

This list shows where to review this threat, rather than how high the risk is.

Typical for:

For 11 further use cases, relevance depends on the system design, for example whether it performs natural language tasks. Show these use cases

Frequently asked questions

What is Sleepy Agent (Time/Event-Triggered Hidden Instructions)?
Malicious logic lies dormant inside the model and only activates later: on a set date, at a specific event, or in a particular environment. Until then, the system passes every test and review without raising suspicion.
Which mitigations help against Sleepy Agent (Time/Event-Triggered Hidden Instructions)?
The catalogue lists 6 mitigations, each with control type, effect and implementation level. First among them are Behavioral analysis under diverse conditions, Time-shifted testing and Adversarial evaluation across contexts.
Which EU AI Act obligations does Sleepy Agent (Time/Event-Triggered Hidden Instructions) touch?
The catalogue maps this threat to Art. 9, Art. 53 Abs. 1 Buchst. a, Art. 53 Abs. 1 Buchst. b, Art. 53 Abs. 1 Buchst. c und d and Art. 55 of the EU AI Act. In the obligations compass this leads to: Establish and operate a risk management system, Draw up the technical documentation of the model, Provide information to downstream providers, Respect copyright and summarise the training content and Evaluate and mitigate systemic risks. Whether an obligation applies depends on role, risk class and deadline.

Assess this threat in your own system

The live demo contains all 52 threats of this catalogue, including the EU AI Act and GDPR assessment. The free single modules cover AI risk, the EU AI Act and GDPR. No sign-up; the assessment runs locally in your browser.

Start the live demo See the free modules

Cite this entry

For reports, policies or internal documents; the link leads directly to this entry.

“Sleepy Agent (Time/Event-Triggered Hidden Instructions)”. Versatile AI Risk Assessment, AI threat catalogue, as of October 2026.
https://www.versatile-ai-risk-assessment.com/en/wissensbasis/threats/sleepy-agent/

← Back to the full catalogue