arXiv cs.AI· Xuebin Li, Hanqing Zhao, Siyuan Liang, Kejiang Chen, Weiming Zhang, Dacheng Tao, Nenghai Yu·· 14 小时前AI 评分45
搜索智能体遭“面包屑”式长程攻击：Authority-Chain Hijack 实现 55.9% 攻击成功率
Breadcrumbing Search Agents: Per-Turn Scheming Over Long-Horizon Trajectories
AI 导读
研究提出 Authority-Chain Hijack（ACH）长程攻击策略，通过每次查询仅注入一条受控结果，将孤立的搜索结果与页面内容操纵串成跨来源互相印证的证据链，在 SafeSearch 完整测试集上取得 55.9% ASR 与 83.3% MaxN ASR，为所有基线中最高。
正文 · 原文
Abstract:LLM-based search agents are widely used for information-seeking tasks, but their reliance on external tool returns introduces a critical security risk: web content retrieved during execution is untrusted, exposing agents to prompt injection and goal hijacking. Prior work on search-agent safety primarily focuses on static web-content injection, but modern agents issue follow-up queries and cross-check competing sources, so a single injected page is often diluted or rejected. We show that the channel delivering search and page observations is a fragile security boundary: beyond exposing the agent to a single poisoned page, a mediated search interface can repeatedly steer how the agent gathers evidence and forms its final answer. Under a constrained tool-intermediary threat model, appending only one controlled result per query can substantially increase attack success when the evidence is coordinated across the agent's trajectory. We study this setting with a strategy-driven long-horizon attack system and introduce Authority-Chain Hijack (ACH), an expert-refined strategy that turns isolated search-result and page-content manipulations into a coherent evidence chain across seemingly corroborating sources. ACH achieves the highest Overall ASR among all baselines, reaching 55.9% / 83.3% ASR / MaxN ASR on the full SafeSearch test split. We further introduce Trace-Guided Strategy Evolution (TGSE), which automatically improves attacker strategies from execution traces, replacing manual redesign with trace-driven refinement; its strongest single setting reaches 71.4% / 95.0% in held-out evaluation. Code is available at this https URL.
| Comments: | 39 pages, 7 figures |
| Subjects: | Cryptography and Security (cs.CR); Artificial Intelligence (cs.AI); Computation and Language (cs.CL) |
| Cite as: | arXiv:2608.04565 [cs.CR] |
| (or arXiv:2608.04565v3 [cs.CR] for this version) | |
| https://doi.org/10.48550/arXiv.2608.04565 arXiv-issued DOI via DataCite |
Submission history
From: Xuebin Li [view email]
[v1]
Wed, 5 Aug 2026 07:57:27 UTC (1,392 KB)
[v2]
Mon, 24 Aug 2026 02:22:13 UTC (1,405 KB)
[v3]
Thu, 29 Oct 2026 04:44:02 UTC (1,418 KB)
来源：arXiv cs.AI · arxiv.org