Low prompt-injection rates mostly mean small agents ignore attacks
Original title: Ignored, Not Refused: What Low Prompt-Injection Success Rates Hide in Small Tool-Using Agents
Across 33,000 trajectories, 76-80% of failed injections were ignored and only 17-18% were refused.
Researchers audited eleven open-weight tool-using agents, sized 2-14B, on InjecAgent and AgentDojo. A label-blind judge found most unsuccessful indirect prompt injections were ignored rather than refused. Changing only the system prompt moved InjecAgent attack success from 0.2% to 43%. The authors release the labeled corpus, judge prompt, and analysis code.
- In 21.7% of AgentDojo episodes the agent stayed safe but missed the user task.
- The Attack-Task Outcome Matrix separates safety from task completion.
- Evaluations should report failure mode and task completion, not only attack success rate.
From the original article
1 min read at arxiv.orgTool-using agents read untrusted external content, which exposes them to indirect prompt injection (IPI), where hidden instructions hijack the agent's tool calls. Benchmarks measure IPI security by the attack success rate (ASR), which treats every failed attack as a successful defense. To test this assumption, we audit 33,000 trajectories from eleven open-weight agents (2-14B parameters) on InjecAgent and AgentDojo.
By Farhan Zarif · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.