REVIEW 8 cited by
Adaptive Attacks Break Defenses Against Indirect Prompt Injection Attacks on LLM Agents
Not yet reviewed by Pith; the record is open.
This paper has not been read by Pith yet. Machine review is queued; the pith claim, tier, and objections will appear here once it completes.
SPECIMEN: schema-true, not a live event
T0 review · schema-true
One-sentence machine reading of the paper's core claim.
pith:XXXXXXXX · record.json · timestamp
read the original abstract
Large Language Model (LLM) agents exhibit remarkable performance across diverse applications by using external tools to interact with environments. However, integrating external tools introduces security risks, such as indirect prompt injection (IPI) attacks. Despite defenses designed for IPI attacks, their robustness remains questionable due to insufficient testing against adaptive attacks. In this paper, we evaluate eight different defenses and bypass all of them using adaptive attacks, consistently achieving an attack success rate of over 50%. This reveals critical vulnerabilities in current defenses. Our research underscores the need for adaptive attack evaluation when designing defenses to ensure robustness and reliability. The code is available at https://github.com/uiuc-kang-lab/AdaptiveAttackAgent.
Forward citations
Cited by 8 Pith papers
-
ALIBI: Adaptive Agentic Attacks on LLM-Based Vulnerability Detectors via Adversarial Code Comments
Adaptive adversarial source-code comments evade four LLM vulnerability detectors at >90% success on 125 real null-pointer bugs without altering program behavior.
-
Beyond Pattern Matching: Seven Cross-Domain Techniques for Prompt Injection Detection
The work introduces and partially evaluates seven cross-domain prompt injection detectors, reporting F1 gains on benchmarks like deepset/prompt-injections and indirect-injection sets via local alignment, stylometry, a...
-
Prompt Injection as Role Confusion
Prompt injection works because models internally treat text that sounds like a trusted role as if it were tagged as that role, and this confusion can be measured before generation.
-
Red-Teaming Coding Agents from a Tool-Invocation Perspective: An Empirical Security Assessment
Attacker-controlled tool descriptions and return values can hijack tool invocation in popular LLM coding agents, yielding remote code execution and denial of service.
-
Manipulating LLM Web Agents with Indirect Prompt Injection Attack via HTML Accessibility Tree
GCG-optimized trigger strings embedded in HTML can command LLM web agents to perform attacker-chosen actions, including credential exfiltration.
-
VSF-Med:A Vulnerability Scoring Framework for Medical Vision-Language Models
VSF-Med introduces an eight-dimension, judge-scored vulnerability score for medical VLMs and reports that all five tested models are most vulnerable to persistent attack effects, with Llama-3.2 showing the largest drop.
-
EVA: Evolving Semantic Adversaries for Red-Teaming GUI Agents Against Environmental Injection Attacks
EVA evolves environmental injection payloads through a keyword-utility loop, achieving up to 80% attack success in the body's pop-up tests, while the abstract's stronger claims are not supported by the reported experiments.
-
Evaluation and Benchmarking of LLM Agents: A Survey
A review that proposes a two-dimensional taxonomy for evaluating LLM agents and highlights enterprise-specific evaluation gaps.
Discussion (0). Continue with ORCID to comment.