{"id":"123627dbd658290e63b4583460666027b83cc682542c700825688d785343840a","title":"arXiv cs.AI: Beyond Instruction Override: Benchmarking Indirect Prompt Injection with Task-Tampering Attacks","argument":"Rongting Zhang, Martin Bertran, Sandeep Avula, Chia-Jung Lee and Vanessa Murdock argue that indirect prompt injection can tamper with a task’s decisions without replacing the task. Their benchmark treats planted content as an attack when its source lacks authority over the decision it tries to influence. For example, dispute evidence might cite a false refund policy to inflate a refund, while the agent still works on the buyer’s dispute.\n\nAcross 90 validated cases in three tool-use environments and five LLMs, the authors report that attacks on decision rules, available actions and state had higher mean success than attacks on the agent’s objective. A detection-and-removal defense reduced objective-targeting attacks to 2.4% success, but observation- and state-targeting attacks succeeded at 9.5% and 12.1%. A tool-policy defense allowed 15.4% attack success, close to 17.0% without a defense; the authors say these attacks generally keep the expected tools and manipulate values gathered during execution.\n\nThe authors argue that evaluations focused on redirecting tasks or targeting objectives can overestimate how much these defenses cover. The benchmark makes the source’s authority over a decision central to defining the attack, and its results suggest that defenses tested against task replacement may miss attacks that leave the task intact.","topicIds":["intelligence-and-discovery"],"domain":"science","claimType":"attributed reading","limits":"The supplied evidence is the paper’s abstract; it does not name the five LLMs or provide further detail about the benchmark cases or evaluation procedures.","speaker":{"name":"Zhang, Rongting, Bertran, Martin, Avula, Sandeep, Lee, Chia-Jung, Murdock, Vanessa","roleAtSource":"Article author"},"source":{"title":"Beyond Instruction Override: Benchmarking Indirect Prompt Injection with Task-Tampering Attacks","publisher":"arXiv cs.AI","format":"Article","url":"https://arxiv.org/abs/2611.07640","publishedAt":"2026-11-05","dateBasis":"Date basis not provided."},"evidence":[{"text":"The authors define an indirect prompt-injection attack by whether planted content tries to influence a decision its source is not authorized to determine, rather than by whether it uses instruction-like wording.","excerpt":"planted content constitutes an attack when it attempts to influence a decision that its source is not authorized to determine","url":"https://arxiv.org/abs/2611.07640","relationship":"Source-stated"},{"text":"The benchmark contains 90 validated cases across three tool-use environments, each targeting a decision required by the benign task rather than replacing the task.","excerpt":"in each of 90 validated cases across three tool-use environments","url":"https://arxiv.org/abs/2611.07640","relationship":"Source-stated"},{"text":"Across five LLMs, attacks targeting decision rules, available actions and state had higher mean success than objective-targeting attacks without a defense.","excerpt":"attacks on three of the five other targets (decision rules, available actions, and state) have higher mean success than objective attacks across five LLMs","url":"https://arxiv.org/abs/2611.07640","relationship":"Source-stated"},{"text":"The detection-and-removal defense reduced objective-targeting attacks to 2.4% success but left observation- and state-targeting attacks at 9.5% and 12.1%.","excerpt":"reduces objective-targeting attacks to 2.4% success but leaves observation- and state-targeting attacks at 9.5% and 12.1%","url":"https://arxiv.org/abs/2611.07640","relationship":"Source-stated"},{"text":"The tool-policy defense allowed 15.4% attack success, compared with 17.0% without a defense; the authors say these attacks generally retain expected tools and manipulate values obtained during execution.","excerpt":"A tool-policy defense still allows 15.4% attack success, close to 17.0% without a defense","url":"https://arxiv.org/abs/2611.07640","relationship":"Source-stated"},{"text":"The authors caution that evaluations focused on task redirection or objective-targeting attacks can overestimate defense coverage.","excerpt":"Evaluations whose attacks redirect the task or target only the agent's objective can therefore overestimate the coverage of these defenses.","url":"https://arxiv.org/abs/2611.07640","relationship":"Source-stated"}],"sourceMedia":{"status":"not_found","sourceUrl":"https://arxiv.org/abs/2611.07640","checkedAt":"2026-11-09T13:24:07.831Z","items":[],"note":"No suitable media was found by the supported page extraction."},"assumptions":[],"openQuestion":{"attribution":"Open question","text":"How well do these attack patterns and defense results hold beyond the 90 validated cases, three tool-use environments and five LLMs?"},"whatWouldChangeView":{"attribution":"Change condition not recorded","text":""},"editorialComparisons":[],"live":{"title":"arXiv cs.AI: Beyond Instruction Override: Benchmarking Indirect Prompt Injection with Task-Tampering Attacks","summary":"Rongting Zhang, Martin Bertran, Sandeep Avula, Chia-Jung Lee and Vanessa Murdock argue that indirect prompt injection can tamper with a task’s decisions without replacing the task. Their benchmark treats planted content as an attack when its source lacks authority over the decision it tries to influence. For example, dispute evidence might cite a false refund policy to inflate a refund, while the agent still works on the buyer’s dispute.\n\nAcross 90 validated cases in three tool-use environments and five LLMs, the authors report that attacks on decision rules, available actions and state had higher mean success than attacks on the agent’s objective. A detection-and-removal defense reduced objective-targeting attacks to 2.4% success, but observation- and state-targeting attacks succeeded at 9.5% and 12.1%. A tool-policy defense allowed 15.4% attack success, close to 17.0% without a defense; the authors say these attacks generally keep the expected tools and manipulate values gathered during execution.\n\nThe authors argue that evaluations focused on redirecting tasks or targeting objectives can overestimate how much these defenses cover. The benchmark makes the source’s authority over a decision central to defining the attack, and its results suggest that defenses tested against task replacement may miss attacks that leave the task intact.","question":"How well do these attack patterns and defense results hold beyond the 90 validated cases, three tool-use environments and five LLMs?","claims":[{"text":"The authors define an indirect prompt-injection attack by whether planted content tries to influence a decision its source is not authorized to determine, rather than by whether it uses instruction-like wording.","excerpt":"planted content constitutes an attack when it attempts to influence a decision that its source is not authorized to determine","support":"source-stated"},{"text":"The benchmark contains 90 validated cases across three tool-use environments, each targeting a decision required by the benign task rather than replacing the task.","excerpt":"in each of 90 validated cases across three tool-use environments","support":"source-stated"},{"text":"Across five LLMs, attacks targeting decision rules, available actions and state had higher mean success than objective-targeting attacks without a defense.","excerpt":"attacks on three of the five other targets (decision rules, available actions, and state) have higher mean success than objective attacks across five LLMs","support":"source-stated"},{"text":"The detection-and-removal defense reduced objective-targeting attacks to 2.4% success but left observation- and state-targeting attacks at 9.5% and 12.1%.","excerpt":"reduces objective-targeting attacks to 2.4% success but leaves observation- and state-targeting attacks at 9.5% and 12.1%","support":"source-stated"},{"text":"The tool-policy defense allowed 15.4% attack success, compared with 17.0% without a defense; the authors say these attacks generally retain expected tools and manipulate values obtained during execution.","excerpt":"A tool-policy defense still allows 15.4% attack success, close to 17.0% without a defense","support":"source-stated"},{"text":"The authors caution that evaluations focused on task redirection or objective-targeting attacks can overestimate defense coverage.","excerpt":"Evaluations whose attacks redirect the task or target only the agent's objective can therefore overestimate the coverage of these defenses.","support":"source-stated"}],"limitations":["The supplied evidence is the paper’s abstract; it does not name the five LLMs or provide further detail about the benchmark cases or evaluation procedures."],"mediaId":"97c8d7aa1cb2159503141e04ca3f422a54aefaebb9e9c88786d2e2cff171d5e2","correctionReason":null,"id":"123627dbd658290e63b4583460666027b83cc682542c700825688d785343840a","publicationId":"3005b244-cb90-4134-8fa6-09ca1b0734b4","version":1,"sourceUrl":"https://arxiv.org/abs/2611.07640","sourceTitle":"Beyond Instruction Override: Benchmarking Indirect Prompt Injection with Task-Tampering Attacks","publisher":"arXiv cs.AI","publishedAt":null,"originalPublished":{"value":"2026-11-05","precision":"day","basis":"publisher_citation_date"},"firstObservedAt":"2026-11-06T05:12:39.172Z","createdAt":"2026-11-08T20:20:17.870Z","historical":true,"entityIds":["arxiv"],"topicIds":["intelligence-and-discovery"],"media":[{"id":"97c8d7aa1cb2159503141e04ca3f422a54aefaebb9e9c88786d2e2cff171d5e2","kind":"article","url":"https://arxiv.org/abs/2611.07640","sourceUrl":"https://arxiv.org/abs/2611.07640","label":"Read original","provenance":"source_link","verification":{"status":"verified","checkedAt":"2026-11-08T20:19:10.122Z","method":"acquired_source","contentType":"text/html"},"recommendationReason":"Recommended by Jev for understanding this source; checked by Luna."}],"sourceMedia":{"status":"not_found","sourceUrl":"https://arxiv.org/abs/2611.07640","checkedAt":"2026-11-09T13:24:07.831Z","items":[],"note":"No suitable media was found by the supported page extraction."},"editorialDecision":{"outcome":"accept","reasonCodes":["material_development"],"rubricVersion":"stream-admission-v5","mediaId":"97c8d7aa1cb2159503141e04ca3f422a54aefaebb9e9c88786d2e2cff171d5e2","confidence":0.92,"provider":"typesafe","model":"jev-1.13.0","inputHash":"cfc907711d828bf5dd6e0a5b8684c259ccdff61c4dedc9459f1b5f388fa9dcc5","decidedAt":"2026-11-08T20:19:12.156Z"},"provenance":{"textHash":"749292f1d40fde1b183ae869e17cd81e63ecc072f03196242f62069bde51b324","observationId":"eea00d7603ae76c783f25f89daf6eeb5a61d1b1a6f604392b4614a8cea9c0ed3","retrievedAt":"2026-11-08T20:19:09.778Z","kind":"publisher-page","preparer":{"model":"gpt-6-luna","runId":"5b06ed43-1f92-4838-854b-e8730bc6ae83"},"reviewer":{"model":"gpt-6-luna","runId":"c7a03329-6c02-4a74-8a17-94ac3ef8424f"}},"audit":{"status":"uncertain","reviewedAt":"2026-11-08T20:20:17.870Z","model":"anthropic/claude-opus-5.5"},"sourceAttribution":{"authors":[{"name":"Zhang, Rongting","url":null,"kind":"unknown"},{"name":"Bertran, Martin","url":null,"kind":"unknown"},{"name":"Avula, Sandeep","url":null,"kind":"unknown"},{"name":"Lee, Chia-Jung","url":null,"kind":"unknown"},{"name":"Murdock, Vanessa","url":null,"kind":"unknown"}],"authorRole":"article-author","hosts":[],"status":"stated","authorRoster":{"truncated":false,"omitted":0,"assertionGroupsOmitted":0},"participation":[{"actor":{"name":"Zhang, Rongting","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Zhang, Rongting","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2611.07640","locator":"head/meta[name=author|citation_author]"},"assertionId":"1de69b4cb72096e145458a1934a4be51648e87e9f6f27615aca16143d2bb3ae9:participation:0","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-09T13:24:07.831Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"1de69b4cb72096e145458a1934a4be51648e87e9f6f27615aca16143d2bb3ae9","sourceUrl":"https://arxiv.org/abs/2611.07640","contentSha256":"67b836692c6dc9a9bdd0cf7e8241d8d30634b97aaf08db3bb8ecf44fe6af519f","textHash":"749292f1d40fde1b183ae869e17cd81e63ecc072f03196242f62069bde51b324","observedAt":"2026-11-09T13:24:07.831Z"}},{"actor":{"name":"Bertran, Martin","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Bertran, Martin","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2611.07640","locator":"head/meta[name=author|citation_author]"},"assertionId":"1de69b4cb72096e145458a1934a4be51648e87e9f6f27615aca16143d2bb3ae9:participation:1","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-09T13:24:07.831Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"1de69b4cb72096e145458a1934a4be51648e87e9f6f27615aca16143d2bb3ae9","sourceUrl":"https://arxiv.org/abs/2611.07640","contentSha256":"67b836692c6dc9a9bdd0cf7e8241d8d30634b97aaf08db3bb8ecf44fe6af519f","textHash":"749292f1d40fde1b183ae869e17cd81e63ecc072f03196242f62069bde51b324","observedAt":"2026-11-09T13:24:07.831Z"}},{"actor":{"name":"Avula, Sandeep","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Avula, Sandeep","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2611.07640","locator":"head/meta[name=author|citation_author]"},"assertionId":"1de69b4cb72096e145458a1934a4be51648e87e9f6f27615aca16143d2bb3ae9:participation:2","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-09T13:24:07.831Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"1de69b4cb72096e145458a1934a4be51648e87e9f6f27615aca16143d2bb3ae9","sourceUrl":"https://arxiv.org/abs/2611.07640","contentSha256":"67b836692c6dc9a9bdd0cf7e8241d8d30634b97aaf08db3bb8ecf44fe6af519f","textHash":"749292f1d40fde1b183ae869e17cd81e63ecc072f03196242f62069bde51b324","observedAt":"2026-11-09T13:24:07.831Z"}},{"actor":{"name":"Lee, Chia-Jung","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Lee, Chia-Jung","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2611.07640","locator":"head/meta[name=author|citation_author]"},"assertionId":"1de69b4cb72096e145458a1934a4be51648e87e9f6f27615aca16143d2bb3ae9:participation:3","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-09T13:24:07.831Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"1de69b4cb72096e145458a1934a4be51648e87e9f6f27615aca16143d2bb3ae9","sourceUrl":"https://arxiv.org/abs/2611.07640","contentSha256":"67b836692c6dc9a9bdd0cf7e8241d8d30634b97aaf08db3bb8ecf44fe6af519f","textHash":"749292f1d40fde1b183ae869e17cd81e63ecc072f03196242f62069bde51b324","observedAt":"2026-11-09T13:24:07.831Z"}},{"actor":{"name":"Murdock, Vanessa","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Murdock, Vanessa","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2611.07640","locator":"head/meta[name=author|citation_author]"},"assertionId":"1de69b4cb72096e145458a1934a4be51648e87e9f6f27615aca16143d2bb3ae9:participation:4","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-09T13:24:07.831Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"1de69b4cb72096e145458a1934a4be51648e87e9f6f27615aca16143d2bb3ae9","sourceUrl":"https://arxiv.org/abs/2611.07640","contentSha256":"67b836692c6dc9a9bdd0cf7e8241d8d30634b97aaf08db3bb8ecf44fe6af519f","textHash":"749292f1d40fde1b183ae869e17cd81e63ecc072f03196242f62069bde51b324","observedAt":"2026-11-09T13:24:07.831Z"}}],"participationCoverage":{"total":5,"returned":5,"complete":true,"fullAssertions":"source-metadata-endpoint"},"distribution":null,"publisher":null,"sourceUrl":"https://arxiv.org/abs/2611.07640","snapshotId":"1de69b4cb72096e145458a1934a4be51648e87e9f6f27615aca16143d2bb3ae9","contentSha256":"67b836692c6dc9a9bdd0cf7e8241d8d30634b97aaf08db3bb8ecf44fe6af519f","textHash":"749292f1d40fde1b183ae869e17cd81e63ecc072f03196242f62069bde51b324","observedAt":"2026-11-09T13:24:07.831Z","basis":"publisher-page-metadata","sourceLinks":45,"linksTruncated":false,"metadataUrl":"/api/pipeline/stream/123627dbd658290e63b4583460666027b83cc682542c700825688d785343840a/source"}},"canonicalUrl":"https://escapemeridian.com/readings/arxiv-cs-ai-beyond-instruction-override-benchmarking-indirect-123627db","formats":{"html":"/readings/arxiv-cs-ai-beyond-instruction-override-benchmarking-indirect-123627db","markdown":"/readings/arxiv-cs-ai-beyond-instruction-override-benchmarking-indirect-123627db.md","json":"/readings/arxiv-cs-ai-beyond-instruction-override-benchmarking-indirect-123627db.json"},"attribution":"Headline and summary by Escape Meridian, prepared by Luna from the attributed source. A source check is not independent confirmation of the source’s claims.","maintainedGuideLinks":[],"readerContext":{"version":"reader-context-v1","attribution":"Reference context selected by Escape Meridian; separate from source evidence. Entity mentions do not establish authorship, involvement or endorsement.","terms":[{"id":"term-benchmark","name":"Benchmark","explanation":"A defined set of tests used to compare systems. Results depend on the tasks and measures selected.","referenceUrl":"https://arxiv.org/abs/2211.09110"},{"id":"term-prompt-injection","name":"Prompt injection","explanation":"Hidden instructions placed in a document, email or web page that try to take control of an AI system reading it.","referenceUrl":"https://en.wikipedia.org/wiki/Prompt_injection"},{"id":"term-tool-use","name":"Tool use","explanation":"A model's ability to operate other software, such as a search engine, a calculator or a code runner, while it works.","referenceUrl":"https://docs.anthropic.com/en/docs/build-with-claude/tool-use/overview"},{"id":"term-llm","name":"Large language model","explanation":"A language model with many learned numerical settings, used to process and generate language.","referenceUrl":"https://developers.google.com/machine-learning/glossary#large-language-model"}],"entities":[{"id":"arxiv","name":"arXiv","kind":"organization","context":"arXiv is a research manuscript repository where authors share papers that may not yet have been peer reviewed.","referenceUrls":["https://arxiv.org/","https://info.arxiv.org/help/api/index.html"],"path":"/entities/arxiv","json":"/entities/arxiv.json","markdown":"/entities/arxiv.md"}]},"researchQuestions":[],"withdrawn":false,"references":{"schemaVersion":1,"target":{"type":"reading","id":"123627dbd658290e63b4583460666027b83cc682542c700825688d785343840a","revision":"3005b244-cb90-4134-8fa6-09ca1b0734b4","revisionKind":"publication-id","title":"arXiv cs.AI: Beyond Instruction Override: Benchmarking Indirect Prompt Injection with Task-Tampering Attacks","url":"https://escapemeridian.com/readings/arxiv-cs-ai-beyond-instruction-override-benchmarking-indirect-123627db"},"source":{"type":"source","id":"https://arxiv.org/abs/2611.07640","revision":"749292f1d40fde1b183ae869e17cd81e63ecc072f03196242f62069bde51b324","revisionKind":"sha256-source-text","title":"Beyond Instruction Override: Benchmarking Indirect Prompt Injection with Task-Tampering Attacks","url":"https://arxiv.org/abs/2611.07640"},"status":"available","items":[],"next":null,"scope":"Explicit citations in public readings and public file attachments to this reading. Shared topics are not citations. Other artifact types need an explicit reference adapter."},"revisions":[{"id":"123627dbd658290e63b4583460666027b83cc682542c700825688d785343840a","title":"arXiv cs.AI: Beyond Instruction Override: Benchmarking Indirect Prompt Injection with Task-Tampering Attacks","argument":"Rongting Zhang, Martin Bertran, Sandeep Avula, Chia-Jung Lee and Vanessa Murdock argue that indirect prompt injection can tamper with a task’s decisions without replacing the task. Their benchmark treats planted content as an attack when its source lacks authority over the decision it tries to influence. For example, dispute evidence might cite a false refund policy to inflate a refund, while the agent still works on the buyer’s dispute.\n\nAcross 90 validated cases in three tool-use environments and five LLMs, the authors report that attacks on decision rules, available actions and state had higher mean success than attacks on the agent’s objective. A detection-and-removal defense reduced objective-targeting attacks to 2.4% success, but observation- and state-targeting attacks succeeded at 9.5% and 12.1%. A tool-policy defense allowed 15.4% attack success, close to 17.0% without a defense; the authors say these attacks generally keep the expected tools and manipulate values gathered during execution.\n\nThe authors argue that evaluations focused on redirecting tasks or targeting objectives can overestimate how much these defenses cover. The benchmark makes the source’s authority over a decision central to defining the attack, and its results suggest that defenses tested against task replacement may miss attacks that leave the task intact.","topicIds":["intelligence-and-discovery"],"domain":"science","claimType":"attributed reading","limits":"The supplied evidence is the paper’s abstract; it does not name the five LLMs or provide further detail about the benchmark cases or evaluation procedures.","speaker":{"name":"Zhang, Rongting, Bertran, Martin, Avula, Sandeep, Lee, Chia-Jung, Murdock, Vanessa","roleAtSource":"Article author"},"source":{"title":"Beyond Instruction Override: Benchmarking Indirect Prompt Injection with Task-Tampering Attacks","publisher":"arXiv cs.AI","format":"Article","url":"https://arxiv.org/abs/2611.07640","publishedAt":"2026-11-05","dateBasis":"Date basis not provided."},"evidence":[{"text":"The authors define an indirect prompt-injection attack by whether planted content tries to influence a decision its source is not authorized to determine, rather than by whether it uses instruction-like wording.","excerpt":"planted content constitutes an attack when it attempts to influence a decision that its source is not authorized to determine","url":"https://arxiv.org/abs/2611.07640","relationship":"Source-stated"},{"text":"The benchmark contains 90 validated cases across three tool-use environments, each targeting a decision required by the benign task rather than replacing the task.","excerpt":"in each of 90 validated cases across three tool-use environments","url":"https://arxiv.org/abs/2611.07640","relationship":"Source-stated"},{"text":"Across five LLMs, attacks targeting decision rules, available actions and state had higher mean success than objective-targeting attacks without a defense.","excerpt":"attacks on three of the five other targets (decision rules, available actions, and state) have higher mean success than objective attacks across five LLMs","url":"https://arxiv.org/abs/2611.07640","relationship":"Source-stated"},{"text":"The detection-and-removal defense reduced objective-targeting attacks to 2.4% success but left observation- and state-targeting attacks at 9.5% and 12.1%.","excerpt":"reduces objective-targeting attacks to 2.4% success but leaves observation- and state-targeting attacks at 9.5% and 12.1%","url":"https://arxiv.org/abs/2611.07640","relationship":"Source-stated"},{"text":"The tool-policy defense allowed 15.4% attack success, compared with 17.0% without a defense; the authors say these attacks generally retain expected tools and manipulate values obtained during execution.","excerpt":"A tool-policy defense still allows 15.4% attack success, close to 17.0% without a defense","url":"https://arxiv.org/abs/2611.07640","relationship":"Source-stated"},{"text":"The authors caution that evaluations focused on task redirection or objective-targeting attacks can overestimate defense coverage.","excerpt":"Evaluations whose attacks redirect the task or target only the agent's objective can therefore overestimate the coverage of these defenses.","url":"https://arxiv.org/abs/2611.07640","relationship":"Source-stated"}],"sourceMedia":{"status":"not_found","sourceUrl":"https://arxiv.org/abs/2611.07640","checkedAt":"2026-11-09T13:24:07.831Z","items":[],"note":"No suitable media was found by the supported page extraction."},"assumptions":[],"openQuestion":{"attribution":"Open question","text":"How well do these attack patterns and defense results hold beyond the 90 validated cases, three tool-use environments and five LLMs?"},"whatWouldChangeView":{"attribution":"Change condition not recorded","text":""},"editorialComparisons":[],"live":{"title":"arXiv cs.AI: Beyond Instruction Override: Benchmarking Indirect Prompt Injection with Task-Tampering Attacks","summary":"Rongting Zhang, Martin Bertran, Sandeep Avula, Chia-Jung Lee and Vanessa Murdock argue that indirect prompt injection can tamper with a task’s decisions without replacing the task. Their benchmark treats planted content as an attack when its source lacks authority over the decision it tries to influence. For example, dispute evidence might cite a false refund policy to inflate a refund, while the agent still works on the buyer’s dispute.\n\nAcross 90 validated cases in three tool-use environments and five LLMs, the authors report that attacks on decision rules, available actions and state had higher mean success than attacks on the agent’s objective. A detection-and-removal defense reduced objective-targeting attacks to 2.4% success, but observation- and state-targeting attacks succeeded at 9.5% and 12.1%. A tool-policy defense allowed 15.4% attack success, close to 17.0% without a defense; the authors say these attacks generally keep the expected tools and manipulate values gathered during execution.\n\nThe authors argue that evaluations focused on redirecting tasks or targeting objectives can overestimate how much these defenses cover. The benchmark makes the source’s authority over a decision central to defining the attack, and its results suggest that defenses tested against task replacement may miss attacks that leave the task intact.","question":"How well do these attack patterns and defense results hold beyond the 90 validated cases, three tool-use environments and five LLMs?","claims":[{"text":"The authors define an indirect prompt-injection attack by whether planted content tries to influence a decision its source is not authorized to determine, rather than by whether it uses instruction-like wording.","excerpt":"planted content constitutes an attack when it attempts to influence a decision that its source is not authorized to determine","support":"source-stated"},{"text":"The benchmark contains 90 validated cases across three tool-use environments, each targeting a decision required by the benign task rather than replacing the task.","excerpt":"in each of 90 validated cases across three tool-use environments","support":"source-stated"},{"text":"Across five LLMs, attacks targeting decision rules, available actions and state had higher mean success than objective-targeting attacks without a defense.","excerpt":"attacks on three of the five other targets (decision rules, available actions, and state) have higher mean success than objective attacks across five LLMs","support":"source-stated"},{"text":"The detection-and-removal defense reduced objective-targeting attacks to 2.4% success but left observation- and state-targeting attacks at 9.5% and 12.1%.","excerpt":"reduces objective-targeting attacks to 2.4% success but leaves observation- and state-targeting attacks at 9.5% and 12.1%","support":"source-stated"},{"text":"The tool-policy defense allowed 15.4% attack success, compared with 17.0% without a defense; the authors say these attacks generally retain expected tools and manipulate values obtained during execution.","excerpt":"A tool-policy defense still allows 15.4% attack success, close to 17.0% without a defense","support":"source-stated"},{"text":"The authors caution that evaluations focused on task redirection or objective-targeting attacks can overestimate defense coverage.","excerpt":"Evaluations whose attacks redirect the task or target only the agent's objective can therefore overestimate the coverage of these defenses.","support":"source-stated"}],"limitations":["The supplied evidence is the paper’s abstract; it does not name the five LLMs or provide further detail about the benchmark cases or evaluation procedures."],"mediaId":"97c8d7aa1cb2159503141e04ca3f422a54aefaebb9e9c88786d2e2cff171d5e2","correctionReason":null,"id":"123627dbd658290e63b4583460666027b83cc682542c700825688d785343840a","publicationId":"3005b244-cb90-4134-8fa6-09ca1b0734b4","version":1,"sourceUrl":"https://arxiv.org/abs/2611.07640","sourceTitle":"Beyond Instruction Override: Benchmarking Indirect Prompt Injection with Task-Tampering Attacks","publisher":"arXiv cs.AI","publishedAt":null,"originalPublished":{"value":"2026-11-05","precision":"day","basis":"publisher_citation_date"},"firstObservedAt":"2026-11-06T05:12:39.172Z","createdAt":"2026-11-08T20:20:17.870Z","historical":true,"entityIds":["arxiv"],"topicIds":["intelligence-and-discovery"],"media":[{"id":"97c8d7aa1cb2159503141e04ca3f422a54aefaebb9e9c88786d2e2cff171d5e2","kind":"article","url":"https://arxiv.org/abs/2611.07640","sourceUrl":"https://arxiv.org/abs/2611.07640","label":"Read original","provenance":"source_link","verification":{"status":"verified","checkedAt":"2026-11-08T20:19:10.122Z","method":"acquired_source","contentType":"text/html"},"recommendationReason":"Recommended by Jev for understanding this source; checked by Luna."}],"sourceMedia":{"status":"not_found","sourceUrl":"https://arxiv.org/abs/2611.07640","checkedAt":"2026-11-09T13:24:07.831Z","items":[],"note":"No suitable media was found by the supported page extraction."},"editorialDecision":{"outcome":"accept","reasonCodes":["material_development"],"rubricVersion":"stream-admission-v5","mediaId":"97c8d7aa1cb2159503141e04ca3f422a54aefaebb9e9c88786d2e2cff171d5e2","confidence":0.92,"provider":"typesafe","model":"jev-1.13.0","inputHash":"cfc907711d828bf5dd6e0a5b8684c259ccdff61c4dedc9459f1b5f388fa9dcc5","decidedAt":"2026-11-08T20:19:12.156Z"},"provenance":{"textHash":"749292f1d40fde1b183ae869e17cd81e63ecc072f03196242f62069bde51b324","observationId":"eea00d7603ae76c783f25f89daf6eeb5a61d1b1a6f604392b4614a8cea9c0ed3","retrievedAt":"2026-11-08T20:19:09.778Z","kind":"publisher-page","preparer":{"model":"gpt-6-luna","runId":"5b06ed43-1f92-4838-854b-e8730bc6ae83"},"reviewer":{"model":"gpt-6-luna","runId":"c7a03329-6c02-4a74-8a17-94ac3ef8424f"}},"audit":{"status":"uncertain","reviewedAt":"2026-11-08T20:20:17.870Z","model":"anthropic/claude-opus-5.5"},"sourceAttribution":{"authors":[{"name":"Zhang, Rongting","url":null,"kind":"unknown"},{"name":"Bertran, Martin","url":null,"kind":"unknown"},{"name":"Avula, Sandeep","url":null,"kind":"unknown"},{"name":"Lee, Chia-Jung","url":null,"kind":"unknown"},{"name":"Murdock, Vanessa","url":null,"kind":"unknown"}],"authorRole":"article-author","hosts":[],"status":"stated","authorRoster":{"truncated":false,"omitted":0,"assertionGroupsOmitted":0},"participation":[{"actor":{"name":"Zhang, Rongting","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Zhang, Rongting","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2611.07640","locator":"head/meta[name=author|citation_author]"},"assertionId":"1de69b4cb72096e145458a1934a4be51648e87e9f6f27615aca16143d2bb3ae9:participation:0","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-09T13:24:07.831Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"1de69b4cb72096e145458a1934a4be51648e87e9f6f27615aca16143d2bb3ae9","sourceUrl":"https://arxiv.org/abs/2611.07640","contentSha256":"67b836692c6dc9a9bdd0cf7e8241d8d30634b97aaf08db3bb8ecf44fe6af519f","textHash":"749292f1d40fde1b183ae869e17cd81e63ecc072f03196242f62069bde51b324","observedAt":"2026-11-09T13:24:07.831Z"}},{"actor":{"name":"Bertran, Martin","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Bertran, Martin","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2611.07640","locator":"head/meta[name=author|citation_author]"},"assertionId":"1de69b4cb72096e145458a1934a4be51648e87e9f6f27615aca16143d2bb3ae9:participation:1","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-09T13:24:07.831Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"1de69b4cb72096e145458a1934a4be51648e87e9f6f27615aca16143d2bb3ae9","sourceUrl":"https://arxiv.org/abs/2611.07640","contentSha256":"67b836692c6dc9a9bdd0cf7e8241d8d30634b97aaf08db3bb8ecf44fe6af519f","textHash":"749292f1d40fde1b183ae869e17cd81e63ecc072f03196242f62069bde51b324","observedAt":"2026-11-09T13:24:07.831Z"}},{"actor":{"name":"Avula, Sandeep","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Avula, Sandeep","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2611.07640","locator":"head/meta[name=author|citation_author]"},"assertionId":"1de69b4cb72096e145458a1934a4be51648e87e9f6f27615aca16143d2bb3ae9:participation:2","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-09T13:24:07.831Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"1de69b4cb72096e145458a1934a4be51648e87e9f6f27615aca16143d2bb3ae9","sourceUrl":"https://arxiv.org/abs/2611.07640","contentSha256":"67b836692c6dc9a9bdd0cf7e8241d8d30634b97aaf08db3bb8ecf44fe6af519f","textHash":"749292f1d40fde1b183ae869e17cd81e63ecc072f03196242f62069bde51b324","observedAt":"2026-11-09T13:24:07.831Z"}},{"actor":{"name":"Lee, Chia-Jung","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Lee, Chia-Jung","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2611.07640","locator":"head/meta[name=author|citation_author]"},"assertionId":"1de69b4cb72096e145458a1934a4be51648e87e9f6f27615aca16143d2bb3ae9:participation:3","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-09T13:24:07.831Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"1de69b4cb72096e145458a1934a4be51648e87e9f6f27615aca16143d2bb3ae9","sourceUrl":"https://arxiv.org/abs/2611.07640","contentSha256":"67b836692c6dc9a9bdd0cf7e8241d8d30634b97aaf08db3bb8ecf44fe6af519f","textHash":"749292f1d40fde1b183ae869e17cd81e63ecc072f03196242f62069bde51b324","observedAt":"2026-11-09T13:24:07.831Z"}},{"actor":{"name":"Murdock, Vanessa","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Murdock, Vanessa","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2611.07640","locator":"head/meta[name=author|citation_author]"},"assertionId":"1de69b4cb72096e145458a1934a4be51648e87e9f6f27615aca16143d2bb3ae9:participation:4","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-09T13:24:07.831Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"1de69b4cb72096e145458a1934a4be51648e87e9f6f27615aca16143d2bb3ae9","sourceUrl":"https://arxiv.org/abs/2611.07640","contentSha256":"67b836692c6dc9a9bdd0cf7e8241d8d30634b97aaf08db3bb8ecf44fe6af519f","textHash":"749292f1d40fde1b183ae869e17cd81e63ecc072f03196242f62069bde51b324","observedAt":"2026-11-09T13:24:07.831Z"}}],"participationCoverage":{"total":5,"returned":5,"complete":true,"fullAssertions":"source-metadata-endpoint"},"distribution":null,"publisher":null,"sourceUrl":"https://arxiv.org/abs/2611.07640","snapshotId":"1de69b4cb72096e145458a1934a4be51648e87e9f6f27615aca16143d2bb3ae9","contentSha256":"67b836692c6dc9a9bdd0cf7e8241d8d30634b97aaf08db3bb8ecf44fe6af519f","textHash":"749292f1d40fde1b183ae869e17cd81e63ecc072f03196242f62069bde51b324","observedAt":"2026-11-09T13:24:07.831Z","basis":"publisher-page-metadata","sourceLinks":45,"linksTruncated":false,"metadataUrl":"/api/pipeline/stream/123627dbd658290e63b4583460666027b83cc682542c700825688d785343840a/source"}}}],"audits":[{"publicationId":"3005b244-cb90-4134-8fa6-09ca1b0734b4","verdict":"uncertain","findings":[{"dimension":"attribution","status":"pass","explanation":"The draft correctly names the five arXiv authors and attributes the definition, benchmark results and coverage caution to them. The 'arXiv cs.AI' label matches the feed publisher; the paper is primary cs.CR and cross-listed in cs.AI.","excerpt":"Authors:Rongting Zhang, Martin Bertran, Sandeep Avula, Chia-Jung Lee, Vanessa Murdock"},{"dimension":"summary","status":"uncertain","explanation":"The draft is faithful and keeps the authors' central argument. However, the opening sentence uses the central term 'indirect prompt injection' without a plain-language explanation. It also refers to 'the agent' without saying this means an AI system that uses tools and reads outside content. The refund example helps, but a non-specialist may still miss the basic idea. Smallest repair: add a short gloss or tooltip, such as: content an AI agent reads while doing a task (for example, a buyer's dispute evidence) that tries to steer its decisions. The question is grounded in the evidence.","excerpt":"Indirect prompt-injection (IPI) benchmarks predominantly test planted instructions that redirect a tool-using agent toward an attacker-chosen task."},{"dimension":"date","status":"pass","explanation":"The originalPublished date of 2026-11-05 matches the v1 submission date. The feed date of Nov 6 is later and is correctly not used.","excerpt":"[Submitted on 5 Nov 2026]"},{"dimension":"support","status":"pass","explanation":"All the figures (90 cases, three environments, five LLMs, 2.4%, 9.5%, 12.1%, 15.4%, 17.0%) and the comparison between attack targets match the abstract. The closing inference that defenses tested against task replacement may miss tampering attacks restates the authors' own conclusion and is not overstated. The draft omits that the gap persists under detection-optimized rewrites, but this omission does not distort the meaning.","excerpt":"Evaluations whose attacks redirect the task or target only the agent's objective can therefore overestimate the coverage of these defenses."},{"dimension":"media","status":"pass","explanation":"The selected media is the verified, direct arXiv abstract page for this paper. It is the best available link to the source.","excerpt":null}],"createdAt":"2026-11-08T20:20:17.870Z","model":"anthropic/claude-opus-5.5"}],"correctionUrl":"https://escapemeridian.com/corrections/"}