AuthorityFlow defends LLM agents from parameter poisoning
Original title: Right Tool, Wrong Parameters: Defending LLM Agents Against Parameter Poisoning
AuthorityFlow reduces parameter poisoning success rate from 93% to 9% by tracing information flows in tool arguments.
The paper studies parameter poisoning where attackers manipulate tool arguments while preserving the intended action. AuthorityFlow constructs a task-specific trust hierarchy over information fields and accepts values only from trusted fields. It drops attack success rate to 9.03% while retaining 82.64% benign utility.
- Parameter poisoning preserves intended action but alters arguments
- AuthorityFlow uses trust hierarchy over information flows
- FactAuthBench evaluates parameter poisoning attacks
From the original article
1 min read at arxiv.orgIndirect Prompt Injection (IPI) poses a critical threat to LLM agents. Existing defenses largely focus on whether an injection induces a new tool invocation or unintended action. In this paper, we study a different attack surface, parameter poisoning, where the attacker preserves the intended action but manipulates one or more tool arguments, such as a recipient or other task-critical value.
By Yao Wang · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.