arXiv cs.CL· Farhan Zarif, Kazi Shahid Ahmed Galib, Synthia Akter Promi, Shabnam Sharmin Tarin, Ariyan Hossain, Sadif Ahmed, Farig Yousuf Sadeque·· 12 小时前AI 评分47
研究揭示小型工具智能体的低提示注入成功率假象：多数攻击被忽略而非被拒绝
Ignored, Not Refused: What Low Prompt-Injection Success Rates Hide in Small Tool-Using Agents
AI 导读
对11个开源工具智能体（2-14B 参数）在 InjecAgent 和 AgentDojo 上的 33,000 条轨迹审计发现，多数失败攻击是被忽略（76-80%）而非被拒绝（17-18%）。
正文 · 原文
Abstract:Tool-using agents read untrusted external content, which exposes them to indirect prompt injection (IPI), where hidden instructions hijack the agent's tool calls. Benchmarks measure IPI security by the attack success rate (ASR), which treats every failed attack as a successful defense. To test this assumption, we audit 33,000 trajectories from eleven open-weight agents (2-14B parameters) on InjecAgent and AgentDojo. A label-blind LLM judge shows that most failed attacks are ignored (76-80%) rather than refused (17-18%). With identical model weights, changing only the system prompt shifts InjecAgent ASR from 0.2% to 43%. Our Attack-Task Outcome Matrix (ATOM) further shows that in 21.7% of AgentDojo episodes, the agent stayed safe but did not complete the user's task. A low ASR therefore mostly reflects agents silently ignoring injections, not refusing them. Evaluations should report how attacks fail and whether the user's task is completed, alongside ASR. We release the labeled corpus, judge prompt, and analysis code.
| Comments: | 17 pages, 3 figures, 11 tables |
| Subjects: | Computation and Language (cs.CL); Cryptography and Security (cs.CR) |
| Cite as: | arXiv:2610.23254 [cs.CL] |
| (or arXiv:2610.23254v1 [cs.CL] for this version) | |
| https://doi.org/10.48550/arXiv.2610.23254 arXiv-issued DOI via DataCite (pending registration) |
Submission history
From: Kazi Shahid Ahmed Galib [view email]
[v1]
Fri, 16 Oct 2026 10:26:23 UTC (175 KB)
来源：arXiv cs.CL · arxiv.org