Weaponized safety warnings control LLM agents via voluntary servitude
Original title: Voluntary Servitude: Weaponized Safety Warning Mechanisms for Controlling AI Agents
A single fabricated hazard steers agents to choose attacker's target by their own harm-avoidance at 60.4% success rate.
LLM agents can be steered by planting a fabricated hazard as a review, causing them to disqualify legitimate options and select the attacker's target through reasoning. This voluntary servitude matches instruction injection effectiveness but evades injection detectors. It transfers to browser agents and retrieval pipelines, with a corroboration requirement removing 95% of the exposure.
- Payload steers agents about as often as instruction injection (60.4% vs 66.0%)
- Deployed injection detectors score it as benign, making it 1.7-4.4x more effective
- Transferred to production browser agents and retrieval pipeline
- Corroboration requirement in instructions removes roughly 95% exposure
- AI models
- LLM agents
From the original article
1 min read at arxiv.orgLLM agents increasingly act on information retrieved from public sources they treat as credible, which turns a manipulated recommendation into a transaction, a dependency, or a decision with physical consequences. The security literature models this threat as instruction injection, in which an adversary writes a command into retrieved content and deployed defenses learn to recognize command syntax.
By Ilan Zendel · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.