arXiv cs.AI· Zhiyue Xu, Xukai Wang, Zhiyuan Huang, Mingjie Zhan, Jian Zhao, Xu-Yao Zhang·· 12 小时前AI 评分58
CarryoverBench：评估 LLM 智能体跨会话残留攻击的基准
After the Attacker Leaves: Benchmarking Carryover Attacks on LLM Agents
AI 导读
作者提出 CarryoverBench，用于评测 LLM 智能体在攻击者离开后仍会复发的间接提示注入，即 carryover attacks。该基准包含 12 个个人助理场景和 101 个攻击任务，覆盖 Instant、Autonomous、Latent 三种触发通道，并用规则验证器分别给植入与触发打分。
正文 · 原文
Abstract:Modern LLM agents persist state across sessions via two channels: long-lived memory files silently prepended to the system prompt, and scheduled tasks waking the agent without user input. A one-time indirect prompt injection committed to either channel can re-fire across sessions long after the attacker leaves, threats we term carryover attacks. Existing prompt-injection benchmarks evaluate attacks only in the session where malicious content is first observed, leaving the gate governing when and how often a planted payload later re-fires unmeasured. We present CarryoverBench: 12 personal-assistant scenarios and 101 attack tasks across three trigger channels: Instant, same-turn IPI; Autonomous, heartbeat-scheduled; and Latent, memory-resurfaced. A rule-based verifier scores planting and triggering as independent stages. Across five frontier models, planted payloads re-fire without measurable decay over five rounds; conditional on successful planting, the trigger stage often provides little additional protection. Porting the Latent channel to a second runtime, Hermes, attenuates but does not eliminate the effect, suggesting that carryover defense requires runtime-layer controls in addition to prompt-level interventions.
| Comments: | Accepted by EMNLP 2026 Main Conference |
| Subjects: | Cryptography and Security (cs.CR); Artificial Intelligence (cs.AI) |
| Cite as: | arXiv:2610.28425 [cs.CR] |
| (or arXiv:2610.28425v1 [cs.CR] for this version) | |
| https://doi.org/10.48550/arXiv.2610.28425 arXiv-issued DOI via DataCite (pending registration) |
Submission history
From: Zhiyue Xu [view email]
[v1]
Tue, 20 Oct 2026 15:55:05 UTC (1,187 KB)
来源：arXiv cs.AI · arxiv.org