ENDOPROMPT: Victim-Side Pseudo-References for Utility Degradation
ENDOPROMPT learns prompt-injection prefixes that cut benign LLM task utility without requiring target labels.
ENDOPROMPT is a white-box prompt-injection method that trains a generator to emit utility-degrading prefixes from unlabeled instructions. Clean continuations from the victim model serve as pseudo-references: local search finds prefixes that reduce continuation likelihood, then preference fitting and reward refinement distill that signal so deployment produces one prefix per request without further victim-side search. Across four instruction-tuned models and the full splits of seven benign benchmarks, the authors report a mean utility change of -26.8 percentage points, with 27 of 28 cells negative. They note output expansion and prefix reuse, and say their controls did not show a degradation advantage from request matching.
- White-box method learns prefixes from unlabeled instructions.
- Uses victim continuations as pseudo-references, not target labels.
- Mean utility change was minus 26.8 percentage points.
- 27 of 28 model-benchmark cells were negative.
- Authors plan to release code after acceptance.
Full article157 words · extracted from arxiv.org · click to collapse
Prompt injection can degrade benign task performance without eliciting harmful content. Yet many attack objectives depend on task labels or predefined target responses. We present ENDOPROMPT, a white-box method that learns utility-degrading prefixes from unlabeled instructions. Its generator takes the request text as input. Clean victim continuations serve as pseudo-references: local search identifies prefixes that reduce continuation likelihood, and preference fitting on comparisons within the same instruction, followed by reward refinement, distills this signal into a generator. At deployment, the generator produces one prefix per request without further victim-side search. Across four instruction-tuned models and the complete splits of seven benign benchmarks, ENDOPROMPT yields a mean utility change of -26.8 percentage points; 27 of 28 cells are negative. Failure analysis reveals output expansion and prefix reuse; the controls do not establish a degradation advantage from request matching. Victim-derived supervision can reveal utility weaknesses without benchmark feedback or prescribed failure responses. The code will be released upon acceptance.
Text extracted automatically; images, tables and formatting may be missing. Original: https://arxiv.org/abs/2609.29948