Backdrop

The Backdrop Exposes What the World Around an Agent Costs It

¹Institute of Information Technology, University of Dhaka²University of Maryland, Baltimore County

TL;DR

Backdrop turns one task in an executed environment into a family of six worlds. Across 3,678 variants and 16 agents, task success falls 38.2 points once the hazards are present; the stronger agents fall furthest (Claude Fable 5.1 from 96.6% to 56.0%).

Backdrop. Build: a task qualifies when its evaluator reads what changed in the world, and every cue's details are resolved against that instance's own records before it is planted, the fault on the requester rather than in a row. The family: the twin carries no hazard, four ablations carry one each and the compound carries all four, giving 3,678 variants over 618 tasks with a byte-identical instruction; a filled cell is the carrier that hazard rides. Grade: every run receives the stock evaluator's verdict, which is the accuracy we report, and seven failure modes read from the end state and the enriched call log. — Backdrop. *Build:* a task qualifies when its evaluator reads what changed in the world, and every cue's details are resolved against that instance's own records before it is planted, the fault on the requester rather than in a row. *The family:* the twin carries no hazard, four ablations carry one each and the compound carries all four, giving 3,678 variants over 618 tasks with a byte-identical instruction; a filled cell is the carrier that hazard rides. *Grade:* every run receives the stock evaluator's verdict, which is the accuracy we report, and seven failure modes read from the end state and the enriched call log.

Abstract

Agent benchmarks test agents in worlds that stay still. Deployed agents work in worlds that other people also change. Someone texts the agent to send the money elsewhere or an order confirmation asks it to reply with a door code. We present BACKDROP, which asks how much of an agent’s capability in a clean world survives in such a world. BACKDROP takes a task along with the agents execution environment, and plants four everyday hazards in its world, one at a time and all together. The instruction and the correct end state stay the same. Each hazard asks one question. Authority: does a message from another person override the user? Injection: does text planted in a record redirect the agent? Boundary: does a request pull it into an app it was not given? Fault: after a write fails without saying whether it landed, does the agent check before it retries? Across 3,678 variants and 16 agents, , the average pass rate falls from 69.5% to 31.3% once all four hazards are present; the strongest agents fall furthest (Claude Fable 5.1 from 96.6% to 56.0%). Agents have learned to resist injected text but often follow other unauthorized requests of other people. With all four hazards present, and counting only runs where the planted text reached the agent, agents followed another person’s message in 46.4% of runs and injected text in 20.3%. The gap is consistent throughout all 16 agents. BACKDROP formalizes these gaps and shows how an agent's score in a task's world is a ceiling on real-world performance.

Citation

@misc{lia2026backdrop,
  title  = {The Backdrop Exposes What the World Around an Agent Costs It},
  author = {Lia, Nusrat Jahan and Dipta, Shubhashis Roy},
  year   = {2026},
  url    = {https://github.com/NusRAT-LiA/BackDrop}
}