Adaptive Attacks Break Defenses Against Indirect Prompt Injection Attacks on LLM Agents (2025.findings-naacl)
Copied to clipboard
| Challenge: | Large Language Models (LLMs) agents use external tools to interact with environments, but they also introduce security risks, such as indirect prompt injection (IPI) attacks. |
| Approach: | They evaluate eight different defenses and bypass all of them using adaptive attacks. |
| Outcome: | The proposed defenses achieve an attack success rate of over 50% and are robust against adaptive attacks. |
Similar Papers
The Dangers of Indirect Prompt Injection Attacks on LLM-based Autonomous Web Navigation Agents: A Demonstration (2025.emnlp-demos)
Copied to clipboard
| Challenge: | Large Language Model (LLM)-integrated applications are becoming more popular to support, augment, and automate tasks. |
| Approach: | They propose to embed universal adversarial triggers in webpage HTML to hijack agents . they also use a browser-gym agent powered by Llama-3.1 to test their system . |
| Outcome: | The proposed system software is released under the MIT License . |
InjecAgent: Benchmarking Indirect Prompt Injections in Tool-Integrated Large Language Model Agents (2024.findings-acl)
Copied to clipboard
| Challenge: | Recent work has embodied LLMs as agents, but external content introduces the risk of indirect prompt injection (IPI) attacks. |
| Approach: | They propose a benchmark to assess the vulnerability of tool-integrated LLM agents to IPI attacks. |
| Outcome: | The proposed benchmark assesses the vulnerability of tool-integrated LLM agents to IPI attacks. |
Defending against Indirect Prompt Injection by Instruction Detection (2025.findings-emnlp)
Copied to clipboard
Tongyu Wen, Chenglong Wang, Xiyuan Yang, Haoyu Tang, Yueqi Xie, Lingjuan Lyu, Zhicheng Dou, Fangzhao Wu
| Challenge: | Indirect Prompt Injection attacks can be exploited by LLMs that are embedded with external data. |
| Approach: | They propose a detection-based approach that leverages the behavioral states of LLMs to identify potential IPI attacks. |
| Outcome: | The proposed approach reduces the success rate of attacks to 0.03% on the BIPIA benchmark. |
Defense Against Prompt Injection Attack by Leveraging Attack Techniques (2025.acl-long)
Copied to clipboard
| Challenge: | Recent attacks leverage LLMs’ instruction-following abilities and their inabilities to distinguish instructions injected in the data content. |
| Approach: | They invert the intention of prompt injection methods to develop novel defense methods based on previous training-free attack methods by repeating the attack process with the original input instruction rather than the injected instruction. |
| Outcome: | The proposed methods outperform existing defense approaches, achieving state-of-the-art results. |
Rethinking Assessments of Prompt Injection Attacks (2026.findings-acl)
Copied to clipboard
| Challenge: | Prompt injection attacks are recognized as one of the primary risks faced by LLM-integrated applications in recent years. |
| Approach: | They evaluate prompt injection attacks on LLM-integrated applications across 37 target tasks, 185 injected tasks, 21 attack instructions, and 143,745 queries. |
| Outcome: | The proposed framework provides a solid foundation for assessing vulnerabilities in LLM-integrated applications and evaluating the efficacy of defensive strategies. |
From Capabilities to Performance: Evaluating Key Functional Properties of LLM Architectures in Penetration Testing (2025.emnlp-main)
Copied to clipboard
| Challenge: | Large Language Models (LLMs) have been explored for automating or enhancing penetration testing tasks, but their effectiveness and reliability remain open questions. |
| Approach: | They evaluate multiple LLM-based agents across realistic penetration testing scenarios . they also examine impact of core functional capabilities on agent success . |
| Outcome: | The proposed models improve agent performance in multi-step and real-time penetration testing scenarios. |
Conjunctive Prompt Attacks in Multi-Agent LLM Systems (2026.acl-long)
Copied to clipboard
| Challenge: | Existing defenses do not reliably stop the attack because no single component appears malicious in isolation. |
| Approach: | They study conjunctive prompt attacks where trigger key and adversarial template appear benign alone but activate harmful behavior when routing brings them together. |
| Outcome: | The proposed model significantly improves performance over baselines while keeping false activations low. |
Ignore This Title and HackAPrompt: Exposing Systemic Vulnerabilities of LLMs Through a Global Prompt Hacking Competition (2023.emnlp-main)
Copied to clipboard
Sander Schulhoff, Jeremy Pinto, Anaum Khan, Louis-François Bouchard, Chenglei Si, Svetlina Anati, Valen Tagliabue, Anson Kost, Christopher Carnahan, Jordan Boyd-Graber
| Challenge: | Large Language Models are increasingly being deployed in interactive contexts that involve direct user engagement. |
| Approach: | They run a global prompt hacking competition to encourage research on prompt hacks . they elicit 600K+ adversarial prompts against three state-of-the-art LLMs based on a dataset . |
| Outcome: | The results of the competition show that current LLMs can be manipulated via prompt hacking . the competition elicits 600K+ adversarial prompts against three state-of-the-art LLM models . |
Can Indirect Prompt Injection Attacks Be Detected and Removed? (2025.acl-long)
Copied to clipboard
| Challenge: | Recent studies have developed various detection mechanisms to protect against prompt injection attacks. |
| Approach: | They investigate the feasibility of detecting and removing indirect prompt injection attacks . they use two methods to evaluate their performance and train detection models . |
| Outcome: | The proposed method is based on a benchmark dataset and is available on github . it evaluates the performance of existing models and open-source detection models . |
The Task Shield: Enforcing Task Alignment to Defend Against Indirect Prompt Injection in LLM Agents (2025.acl-long)
Copied to clipboard
| Challenge: | Large Language Model (LLM) agents are becoming conversational assistants . indirect prompt injection attacks pose a critical threat to these systems . |
| Approach: | They propose a novel and orthogonal perspective that reframes agent security . they propose 'task shield' that verifies whether each instruction and tool call contributes to user objectives . |
| Outcome: | The proposed defense reduces attack success rates while maintaining high task utility on the AgentDojo benchmark. |