Rethinking Indirect Prompt Injection as a Test-Time Search Problem
Duong M. Nguyen, Joon Sik Kim, Blazej Manczak, Vaikkunth Mugunthan
cs.AI · cs.CL · cs.CR
Quick verdict
Frames IPI as attacker-side test-time search; ASR scales with attacker token budget on synthetic suites, but single-run white-box evidence limits generality.
Summary
The paper reframes indirect prompt injection against tool-using LLM agents as test-time search over a task-dependent attack surface induced jointly by environment, user task, and injection task. The authors build an agentic attacker (GLM-5.2) with a search harness comprising reconnaissance tools, strategy/history ledgers, and an Evaluate tool that probes the victim and returns utility/security scores, plus a deterministic advisory hint steering exploration versus near-miss refinement. On two synthetic suites — Workspace (AgentDojo-derived, 240 task pairs) and Retail (Prime-style generated, 136 pairs) — attack success rate rises with attacker token budget up to 500K: GPT-5.5 victims degrade around 50K tokens, reaching 52.1% ASR at 100K on Workspace versus 37.5% on Retail, while Opus-4.8 stays at 20.6% ASR at 500K on Retail. Ablations show No-Harness plateaus after 100K tokens and No-Strategy repeats redundant patterns. The evaluation is white-box, uses a single attacker model, mostly single runs, and permissive victim prompts; the authors themselves flag limited statistical variability and no black-box or defense evaluation. The main value is methodological: ASR@T makes attacker compute an explicit axis of security reporting.
Review complete
Assessment at a glance
5
risk flags identified
● high 0
● medium 3
● low 2
5 strengths · 5 weaknesses · 5 author questions
AI text signal = Binoculars zero-shot detector score over 20 sampled passages (Fast-DetectGPT co-reported) — absence does not prove human authorship, and a flag does not imply misconduct.
Levels reflect verification complexity — not a quality score. Evolve never rates your paper.
Key claims under review
- Indirect prompt injection against tool-using agents is better modeled as test-time search over a task-dependent attack surface than as a static, budget-independent evaluation property.
- Increasing attacker test-time compute (token budget up to 500K) improves attack success rate when the full search harness is used, on both the Workspace and Retail suites.
- Victim susceptibility must be reported conditional on attacker compute: under this attacker, GPT-5.5 degrades around 50K tokens (52.1% ASR at 100K on Workspace) while Opus-4.8 reaches only 20.6% at 500K on Retail.
- Explicit strategy management in the harness is necessary for gains at larger budgets: No-Harness plateaus after 100K tokens and No-Strategy wastes budget on redundant reconnaissance and repeated attack patterns.
- Successful attacks concentrate on workflow-compatible, task-adjacent surfaces rather than arbitrary payload search, with success governed by publicness/obvious-harm and workflow compatibility (Tab. 5).
Strengths
Decision-relevant reframing with a budget-aware metric
Casting IPI as test-time search and reporting ASR@T (Sec. 2.1, Fig. 2) makes attacker compute an explicit evaluation axis; the argument that fixed-budget static benchmarks (AgentDojo [7], ASB [43]) may systematically underestimate risk is well motivated and actionable.
Unusually transparent and auditable attacker design
App. D publishes full attacker/victim system prompts, tool documents, and a deterministic (non-LLM) '[archive] frontier' hint with an explicit near-miss taxonomy (WRONG_ARGS / ATTACK_ONLY / BENIGN_FAILED), making the search procedure reproducible in principle and its behavior inspectable.
Careful synthetic-suite construction
Honest negative and boundary analyses
Mechanistic grounding of the search narrative
Weaknesses
Thin statistical evidence for the central scaling claim
Permissive victim prompt may inflate ASR and shape victim ranking
Single attacker model and no external adaptive baselines in the provided text
Victim comparison confounded by shared token accounting
LLM-generated verifiers define ground truth
Full Review Report
$1.99 · one-timeUnlock the complete preliminary analysis Evolve produced for this paper.
Report preview
Scope & Claims
The paper reframes indirect prompt injection (IPI) against tool-using LLM agents as **test-time search** over a latent, task-dependent attack surface induced jointly by environment, user task, and injection task (Sec. 2.1). Contributions: (1) this formulation with a budget-aware metric ASR@T; (2) an agentic attacker (GLM-5.2) with a 'search harness' — reconnaissance tools, Strategy/History ledgers, and an Evaluate tool that runs candidate payloads against the victim in temporary environments (Sec. 2.2, App. D); (3) empirical scaling results on two synthetic suites: Workspace (AgentDojo-derived, 40×6 = 240 pairs, 108 injection vectors) and Retail (Prime-style generated, 17×8 = 136 pairs). Central claims: ASR scales with attacker compute up to the 500K-token cap; explicit strategy management is required to sustain gains; and security evaluations should report attacker compute alongside victim robustness rather than treating ASR as budget-independent.
The remaining sections cover Methodology Assessment, Statistical Evidence, Results & Reproducibility, Limitations & Risks, and Verdict & Recommendations.
- All 5 strengths & 5 weaknesses, analyzed in detail
- 5 risk flags with severity, section & reviewer questions
- Methods & statistical evidence assessment
- 5 questions a peer reviewer would ask
- Full six-dimension evaluation report & recommendations
One-time purchase · this paper only
One-time purchase, this paper only. AI-generated preliminary analysis — not peer review.
Frequently asked questions
What does 'test-time search' mean in this paper?
The attacker is an LLM agent that spends a token budget searching for an indirect prompt injection: it explores the environment, records strategies, tries payloads against the victim agent, and uses the victim's feedback to refine. Attack success therefore becomes a function of how much compute the attacker is given, rather than a fixed property of the victim model.
Which models were attacked, and which model was the attacker?
Victim agents were GPT-5.5 and Claude Opus 4.8, both run with high reasoning effort. The attacker was GLM-5.2 served via Together AI. The setting is white-box: the attacker sees the environment and knows the victim's tool list, though it does not see the victim's weights.
What were the headline numbers?
On the Workspace suite, GPT-5.5 reached 52.1% attack success at 100K attacker tokens (versus 37.5% on Retail). On Retail, Opus-4.8 stayed at 20.6% even at 500K tokens. Removing the search harness caused attack success to plateau after 100K tokens, and removing only strategy management led to redundant search.
Do these results transfer to black-box or real-world systems?
No such claim is supported. The paper evaluates only white-box access in two synthetic environments (Workspace and Retail), uses a single attacker model, and explicitly defers black-box transfer, production deployments, other agent architectures, and defenses to future work.
About this review
This is an AI-generated preliminary review by Evolve.Pub, produced from the openly available text of the paper. It is not peer review and does not represent the authors' views. The canonical record of the paper is at the publisher link above.
- Sampling gaps hide parts of Appendices E, G, H, and I (e.g., between references 19–44 and within the case studies); judgments about those hidden passages rely only on the visible surrounding text.
- Figures are visible only through captions and in-text citations; underlying curve values beyond those quoted in the text (e.g., full per-budget ASR values of Fig. 2) could not be verified.
- No code or data availability statement appears in the provided text; whether the full paper contains one is not confirmed.
Go deeper on this paper
Wrote a paper? Stress-test it before reviewers do.
Upload your manuscript for the same structured scrutiny — reasoning, statistics, evidence, figures, and reproducibility.