arXiv cs.AI· Yuepeng Hu, Chongyu Fan, Sirat Samyoun, Jian Du·· 13 小时前AI 评分49
Log-To-Leak：通过模型上下文协议对工具调用型 LLM 智能体发起提示词注入攻击
Log-To-Leak: Prompt Injection Attacks on Tool-Using LLM Agents via the Model Context Protocol
AI 导读
研究者提出 Log-To-Leak，一种针对 MCP 工具调用型 LLM 智能体的附加式事后日志攻击，可在最后一次合法调用后诱导出攻击者控制的额外调用。在 18 个模型-服务器组合中，攻击成功率达 62.64-100%，条件日志准确率 76.55-95.64%，其中 16 个组合的目标任务完成率变化不超过 6.63 个百分点。
正文 · 原文
Abstract:LLM agents increasingly access external tools through the Model Context Protocol (MCP), but the natural-language metadata used to describe those tools creates a prompt-injection surface. Within this established tool-poisoning surface, we study Log-To-Leak, an additive post-hoc logging attack that induces a separate attacker-controlled call after the final legitimate call. Its payload targets the user query, MCP server name, server response, and agent response. We operationalize the injected directive through Trigger, Tool Binding, Justification, and Pressure, and separately measure call success, payload fidelity, and preservation of legitimate behavior. We evaluate five MCP servers and four LLM agents using five metrics spanning effectiveness, utility, and efficiency. Across 18 model-server pairs with valid tool execution, Log-To-Leak achieves an attack success rate (ASR) of 62.64-100% and conditional logging accuracy (LA) of 76.55-95.64%; 16 pairs have absolute target-task completion changes of at most 6.63 percentage points. Three evaluated defenses leave residual ASR above 55% on GitHub MCP with GPT-4o, while an instruction detector flags 85.53% of benign descriptions. These results show that successful task completion can coexist with unauthorized post-hoc disclosure and motivate host-controlled authorization for secondary tool calls.
| Subjects: | Cryptography and Security (cs.CR); Artificial Intelligence (cs.AI) |
| Cite as: | arXiv:2610.36108 [cs.CR] |
| (or arXiv:2610.36108v1 [cs.CR] for this version) | |
| https://doi.org/10.48550/arXiv.2610.36108 arXiv-issued DOI via DataCite (pending registration) |
Submission history
From: Yuepeng Hu [view email]
[v1]
Mon, 26 Oct 2026 18:20:24 UTC (788 KB)
来源：arXiv cs.AI · arxiv.org