{"id":"e72d376e2d63f0dca5bc267cc4a850ef596f8d936ba1129a22037abdedc3be9b","title":"arXiv cs.AI paper: Researchers find injection placement affects LLM agent susceptibility","argument":"In a paper submitted to arXiv, Chengquan Guo and coauthors argue that where an indirect prompt injection appears can change whether an LLM agent follows it. They call this the “trust region effect”: agents implicitly assign different levels of trust to different parts of an environment.\n\nThe authors tested agents in three testbeds covering tool use, coding and daily workflows. Holding the malicious instruction fixed, they found that susceptibility varied with its placement. In one comparison, an agent powered by GPT-5.4 followed an unsafe instruction in repository documentation files, such as README or TODO files, 2.6 times more often on average than the same instruction in a code or data file.\n\nThe authors also developed learning-based attackers that generate injection content and choose placements, reporting that both factors can affect attack strength. Escape Meridian interpretation: the finding suggests that defenses focused only on instruction content may miss differences tied to where instructions appear. The paper describes testbed results; how well these patterns carry over to deployed agents and other environments remains unknown.\n\nHow consistently does the trust region effect hold across deployed agents and environments?","topicIds":["intelligence-and-discovery"],"domain":"science","claimType":"attributed reading","limits":"The supplied evidence is the arXiv abstract; it does not provide details of the testbed methods, sample sizes, or results beyond the stated findings. The abstract reports testbed findings but does not establish how well the placement effect generalizes to deployed agents or other environments.","speaker":{"name":"Guo, Chengquan, Liu, Xiaodong, Yang, Weiwei, Feng, Mingqian, Song, Jialin, Ma, Qiyao, Buractaon, Carolyn, White, Christopher, Li, Bo, Gao, Jianfeng","roleAtSource":"Article author"},"source":{"title":"Where You Inject Matters: The Trust Region Effect in LLM Agents","publisher":"arXiv cs.AI","format":"Article","url":"https://arxiv.org/abs/2610.38867","publishedAt":"2026-10-28","dateBasis":"Date basis not provided."},"evidence":[{"text":"The authors report that LLM agent susceptibility to indirect prompt injection varies according to where the instruction appears, even when its content is held fixed.","excerpt":"Holding the injection content fixed, we find that agent susceptibility varies across injection placements.","url":"https://arxiv.org/abs/2610.38867","relationship":"Source-stated"},{"text":"The paper names this placement-dependent difference in susceptibility the trust region effect.","excerpt":"We refer to this phenomenon as the trust region effect: agents implicitly assign different levels of trust to different regions of their environments.","url":"https://arxiv.org/abs/2610.38867","relationship":"Source-stated"},{"text":"In the authors’ reported comparison, GPT-5.4 followed an unsafe instruction in repository documentation more often than the same instruction in a code or data file.","excerpt":"an agent powered by GPT-5.4 follows an unsafe injection instruction placed in a repository documentation file (i.e., a README or TODO file) 2.6 times more often on average than the same instruction placed in a code or data file.","url":"https://arxiv.org/abs/2610.38867","relationship":"Source-stated"},{"text":"The authors say their learning-based attackers generate injection content and select placements, and that both can affect attack strength.","excerpt":"Our approach demonstrates that both where an injection is placed and what content it contains can affect the strength of indirect prompt injection attacks.","url":"https://arxiv.org/abs/2610.38867","relationship":"Source-stated"},{"text":"The paper’s testbed findings raise the question of whether placement effects also occur in deployed agents and other environments; the supplied evidence does not establish this.","excerpt":"we build three agentic testbeds spanning tool use, coding, and daily workflow domains with diverse injection surfaces.","url":"https://arxiv.org/abs/2610.38867","relationship":"Escape Meridian interpretation"}],"sourceMedia":{"status":"not_found","sourceUrl":"https://arxiv.org/abs/2610.38867","checkedAt":"2026-11-11T05:56:07.948Z","items":[],"note":"No suitable media was found by the supported page extraction."},"assumptions":[],"openQuestion":{"attribution":"Open question","text":"How consistently does the trust region effect hold across deployed agents and environments?"},"whatWouldChangeView":{"attribution":"Change condition not recorded","text":""},"editorialComparisons":[],"live":{"title":"arXiv cs.AI paper: Researchers find injection placement affects LLM agent susceptibility","summary":"In a paper submitted to arXiv, Chengquan Guo and coauthors argue that where an indirect prompt injection appears can change whether an LLM agent follows it. They call this the “trust region effect”: agents implicitly assign different levels of trust to different parts of an environment.\n\nThe authors tested agents in three testbeds covering tool use, coding and daily workflows. Holding the malicious instruction fixed, they found that susceptibility varied with its placement. In one comparison, an agent powered by GPT-5.4 followed an unsafe instruction in repository documentation files, such as README or TODO files, 2.6 times more often on average than the same instruction in a code or data file.\n\nThe authors also developed learning-based attackers that generate injection content and choose placements, reporting that both factors can affect attack strength. Escape Meridian interpretation: the finding suggests that defenses focused only on instruction content may miss differences tied to where instructions appear. The paper describes testbed results; how well these patterns carry over to deployed agents and other environments remains unknown.\n\nHow consistently does the trust region effect hold across deployed agents and environments?","question":"How consistently does the trust region effect hold across deployed agents and environments?","claims":[{"text":"The authors report that LLM agent susceptibility to indirect prompt injection varies according to where the instruction appears, even when its content is held fixed.","excerpt":"Holding the injection content fixed, we find that agent susceptibility varies across injection placements.","support":"source-stated"},{"text":"The paper names this placement-dependent difference in susceptibility the trust region effect.","excerpt":"We refer to this phenomenon as the trust region effect: agents implicitly assign different levels of trust to different regions of their environments.","support":"source-stated"},{"text":"In the authors’ reported comparison, GPT-5.4 followed an unsafe instruction in repository documentation more often than the same instruction in a code or data file.","excerpt":"an agent powered by GPT-5.4 follows an unsafe injection instruction placed in a repository documentation file (i.e., a README or TODO file) 2.6 times more often on average than the same instruction placed in a code or data file.","support":"source-stated"},{"text":"The authors say their learning-based attackers generate injection content and select placements, and that both can affect attack strength.","excerpt":"Our approach demonstrates that both where an injection is placed and what content it contains can affect the strength of indirect prompt injection attacks.","support":"source-stated"},{"text":"The paper’s testbed findings raise the question of whether placement effects also occur in deployed agents and other environments; the supplied evidence does not establish this.","excerpt":"we build three agentic testbeds spanning tool use, coding, and daily workflow domains with diverse injection surfaces.","support":"interpretation"}],"limitations":["The supplied evidence is the arXiv abstract; it does not provide details of the testbed methods, sample sizes, or results beyond the stated findings.","The abstract reports testbed findings but does not establish how well the placement effect generalizes to deployed agents or other environments."],"mediaId":"059d8b4a673cd59f11a408a33cbd92889ee697225bdce77397011c6d397b011d","correctionReason":null,"id":"e72d376e2d63f0dca5bc267cc4a850ef596f8d936ba1129a22037abdedc3be9b","publicationId":"bd58ba5f-82e8-40ac-8296-e46cb8927038","version":1,"sourceUrl":"https://arxiv.org/abs/2610.38867","sourceTitle":"Where You Inject Matters: The Trust Region Effect in LLM Agents","publisher":"arXiv cs.AI","publishedAt":null,"originalPublished":{"value":"2026-10-28","precision":"day","basis":"publisher_citation_date"},"firstObservedAt":"2026-10-30T06:43:00.514Z","createdAt":"2026-11-11T04:53:04.711Z","historical":true,"entityIds":["arxiv"],"topicIds":["intelligence-and-discovery"],"media":[{"id":"059d8b4a673cd59f11a408a33cbd92889ee697225bdce77397011c6d397b011d","kind":"article","url":"https://arxiv.org/abs/2610.38867","sourceUrl":"https://arxiv.org/abs/2610.38867","label":"Read original","provenance":"source_link","verification":{"status":"verified","checkedAt":"2026-10-31T11:49:31.235Z","method":"acquired_source","contentType":"text/html"},"recommendationReason":"Recommended by Jev for understanding this source; checked by Luna."}],"sourceMedia":{"status":"not_found","sourceUrl":"https://arxiv.org/abs/2610.38867","checkedAt":"2026-11-11T05:56:07.948Z","items":[],"note":"No suitable media was found by the supported page extraction."},"editorialDecision":{"outcome":"accept","reasonCodes":["material_development"],"rubricVersion":"stream-admission-v5","mediaId":"059d8b4a673cd59f11a408a33cbd92889ee697225bdce77397011c6d397b011d","confidence":0.8500000000000001,"provider":"typesafe","model":"jev-1.13.0","inputHash":"354f981a6c1477d1fdd5a3ea90180916297bc06c09d9a5fa301e3e4d1485bc87","decidedAt":"2026-10-31T11:49:32.985Z"},"provenance":{"textHash":"455a0d4bb4b4ac262a3644a44d213568ea62541cb3c563807c735bad826aa6d6","observationId":"70fb0535c932fd5d637859eb87db84d0500f4b681e09e90d4616931925a38039","retrievedAt":"2026-10-31T11:49:30.991Z","kind":"publisher-page","preparer":{"model":"gpt-6-luna","runId":"9641515d-ec52-49ab-83f7-4aef7398e7e4"},"reviewer":{"model":"gpt-6-luna","runId":"9c2887df-11eb-4a42-8668-d40ab725d84d"}},"audit":{"status":"passed","reviewedAt":"2026-11-11T04:53:04.711Z","model":"anthropic/claude-opus-5.5"},"sourceAttribution":{"authors":[{"name":"Guo, Chengquan","url":null,"kind":"unknown"},{"name":"Liu, Xiaodong","url":null,"kind":"unknown"},{"name":"Yang, Weiwei","url":null,"kind":"unknown"},{"name":"Feng, Mingqian","url":null,"kind":"unknown"},{"name":"Song, Jialin","url":null,"kind":"unknown"},{"name":"Ma, Qiyao","url":null,"kind":"unknown"},{"name":"Buractaon, Carolyn","url":null,"kind":"unknown"},{"name":"White, Christopher","url":null,"kind":"unknown"},{"name":"Li, Bo","url":null,"kind":"unknown"},{"name":"Gao, Jianfeng","url":null,"kind":"unknown"}],"authorRole":"article-author","hosts":[],"status":"stated","authorRoster":{"truncated":false,"omitted":0,"assertionGroupsOmitted":0},"participation":[{"actor":{"name":"Guo, Chengquan","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Guo, Chengquan","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2610.38867","locator":"head/meta[name=author|citation_author]"},"assertionId":"887c4ee50f9a2f38f8df688e56286bbf84d1688a849ef132bc7b8c2966a93cc7:participation:0","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-11T05:56:07.948Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"887c4ee50f9a2f38f8df688e56286bbf84d1688a849ef132bc7b8c2966a93cc7","sourceUrl":"https://arxiv.org/abs/2610.38867","contentSha256":"9a621cec0253678f5fd2b150c737d6cebadd95db0e7e569b1c9e3f34b1f5d040","textHash":"455a0d4bb4b4ac262a3644a44d213568ea62541cb3c563807c735bad826aa6d6","observedAt":"2026-11-11T05:56:07.948Z"}},{"actor":{"name":"Liu, Xiaodong","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Liu, Xiaodong","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2610.38867","locator":"head/meta[name=author|citation_author]"},"assertionId":"887c4ee50f9a2f38f8df688e56286bbf84d1688a849ef132bc7b8c2966a93cc7:participation:1","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-11T05:56:07.948Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"887c4ee50f9a2f38f8df688e56286bbf84d1688a849ef132bc7b8c2966a93cc7","sourceUrl":"https://arxiv.org/abs/2610.38867","contentSha256":"9a621cec0253678f5fd2b150c737d6cebadd95db0e7e569b1c9e3f34b1f5d040","textHash":"455a0d4bb4b4ac262a3644a44d213568ea62541cb3c563807c735bad826aa6d6","observedAt":"2026-11-11T05:56:07.948Z"}},{"actor":{"name":"Yang, Weiwei","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Yang, Weiwei","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2610.38867","locator":"head/meta[name=author|citation_author]"},"assertionId":"887c4ee50f9a2f38f8df688e56286bbf84d1688a849ef132bc7b8c2966a93cc7:participation:2","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-11T05:56:07.948Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"887c4ee50f9a2f38f8df688e56286bbf84d1688a849ef132bc7b8c2966a93cc7","sourceUrl":"https://arxiv.org/abs/2610.38867","contentSha256":"9a621cec0253678f5fd2b150c737d6cebadd95db0e7e569b1c9e3f34b1f5d040","textHash":"455a0d4bb4b4ac262a3644a44d213568ea62541cb3c563807c735bad826aa6d6","observedAt":"2026-11-11T05:56:07.948Z"}},{"actor":{"name":"Feng, Mingqian","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Feng, Mingqian","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2610.38867","locator":"head/meta[name=author|citation_author]"},"assertionId":"887c4ee50f9a2f38f8df688e56286bbf84d1688a849ef132bc7b8c2966a93cc7:participation:3","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-11T05:56:07.948Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"887c4ee50f9a2f38f8df688e56286bbf84d1688a849ef132bc7b8c2966a93cc7","sourceUrl":"https://arxiv.org/abs/2610.38867","contentSha256":"9a621cec0253678f5fd2b150c737d6cebadd95db0e7e569b1c9e3f34b1f5d040","textHash":"455a0d4bb4b4ac262a3644a44d213568ea62541cb3c563807c735bad826aa6d6","observedAt":"2026-11-11T05:56:07.948Z"}},{"actor":{"name":"Song, Jialin","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Song, Jialin","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2610.38867","locator":"head/meta[name=author|citation_author]"},"assertionId":"887c4ee50f9a2f38f8df688e56286bbf84d1688a849ef132bc7b8c2966a93cc7:participation:4","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-11T05:56:07.948Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"887c4ee50f9a2f38f8df688e56286bbf84d1688a849ef132bc7b8c2966a93cc7","sourceUrl":"https://arxiv.org/abs/2610.38867","contentSha256":"9a621cec0253678f5fd2b150c737d6cebadd95db0e7e569b1c9e3f34b1f5d040","textHash":"455a0d4bb4b4ac262a3644a44d213568ea62541cb3c563807c735bad826aa6d6","observedAt":"2026-11-11T05:56:07.948Z"}},{"actor":{"name":"Ma, Qiyao","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Ma, Qiyao","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2610.38867","locator":"head/meta[name=author|citation_author]"},"assertionId":"887c4ee50f9a2f38f8df688e56286bbf84d1688a849ef132bc7b8c2966a93cc7:participation:5","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-11T05:56:07.948Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"887c4ee50f9a2f38f8df688e56286bbf84d1688a849ef132bc7b8c2966a93cc7","sourceUrl":"https://arxiv.org/abs/2610.38867","contentSha256":"9a621cec0253678f5fd2b150c737d6cebadd95db0e7e569b1c9e3f34b1f5d040","textHash":"455a0d4bb4b4ac262a3644a44d213568ea62541cb3c563807c735bad826aa6d6","observedAt":"2026-11-11T05:56:07.948Z"}},{"actor":{"name":"Buractaon, Carolyn","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Buractaon, Carolyn","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2610.38867","locator":"head/meta[name=author|citation_author]"},"assertionId":"887c4ee50f9a2f38f8df688e56286bbf84d1688a849ef132bc7b8c2966a93cc7:participation:6","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-11T05:56:07.948Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"887c4ee50f9a2f38f8df688e56286bbf84d1688a849ef132bc7b8c2966a93cc7","sourceUrl":"https://arxiv.org/abs/2610.38867","contentSha256":"9a621cec0253678f5fd2b150c737d6cebadd95db0e7e569b1c9e3f34b1f5d040","textHash":"455a0d4bb4b4ac262a3644a44d213568ea62541cb3c563807c735bad826aa6d6","observedAt":"2026-11-11T05:56:07.948Z"}},{"actor":{"name":"White, Christopher","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"White, Christopher","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2610.38867","locator":"head/meta[name=author|citation_author]"},"assertionId":"887c4ee50f9a2f38f8df688e56286bbf84d1688a849ef132bc7b8c2966a93cc7:participation:7","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-11T05:56:07.948Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"887c4ee50f9a2f38f8df688e56286bbf84d1688a849ef132bc7b8c2966a93cc7","sourceUrl":"https://arxiv.org/abs/2610.38867","contentSha256":"9a621cec0253678f5fd2b150c737d6cebadd95db0e7e569b1c9e3f34b1f5d040","textHash":"455a0d4bb4b4ac262a3644a44d213568ea62541cb3c563807c735bad826aa6d6","observedAt":"2026-11-11T05:56:07.948Z"}},{"actor":{"name":"Li, Bo","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Li, Bo","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2610.38867","locator":"head/meta[name=author|citation_author]"},"assertionId":"887c4ee50f9a2f38f8df688e56286bbf84d1688a849ef132bc7b8c2966a93cc7:participation:8","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-11T05:56:07.948Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"887c4ee50f9a2f38f8df688e56286bbf84d1688a849ef132bc7b8c2966a93cc7","sourceUrl":"https://arxiv.org/abs/2610.38867","contentSha256":"9a621cec0253678f5fd2b150c737d6cebadd95db0e7e569b1c9e3f34b1f5d040","textHash":"455a0d4bb4b4ac262a3644a44d213568ea62541cb3c563807c735bad826aa6d6","observedAt":"2026-11-11T05:56:07.948Z"}},{"actor":{"name":"Gao, Jianfeng","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Gao, Jianfeng","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2610.38867","locator":"head/meta[name=author|citation_author]"},"assertionId":"887c4ee50f9a2f38f8df688e56286bbf84d1688a849ef132bc7b8c2966a93cc7:participation:9","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-11T05:56:07.948Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"887c4ee50f9a2f38f8df688e56286bbf84d1688a849ef132bc7b8c2966a93cc7","sourceUrl":"https://arxiv.org/abs/2610.38867","contentSha256":"9a621cec0253678f5fd2b150c737d6cebadd95db0e7e569b1c9e3f34b1f5d040","textHash":"455a0d4bb4b4ac262a3644a44d213568ea62541cb3c563807c735bad826aa6d6","observedAt":"2026-11-11T05:56:07.948Z"}}],"participationCoverage":{"total":10,"returned":10,"complete":true,"fullAssertions":"source-metadata-endpoint"},"distribution":null,"publisher":null,"sourceUrl":"https://arxiv.org/abs/2610.38867","snapshotId":"887c4ee50f9a2f38f8df688e56286bbf84d1688a849ef132bc7b8c2966a93cc7","contentSha256":"9a621cec0253678f5fd2b150c737d6cebadd95db0e7e569b1c9e3f34b1f5d040","textHash":"455a0d4bb4b4ac262a3644a44d213568ea62541cb3c563807c735bad826aa6d6","observedAt":"2026-11-11T05:56:07.948Z","basis":"publisher-page-metadata","sourceLinks":50,"linksTruncated":false,"metadataUrl":"/api/pipeline/stream/e72d376e2d63f0dca5bc267cc4a850ef596f8d936ba1129a22037abdedc3be9b/source"}},"canonicalUrl":"https://escapemeridian.com/readings/arxiv-cs-ai-paper-researchers-find-injection-placement-affects-e72d376e","formats":{"html":"/readings/arxiv-cs-ai-paper-researchers-find-injection-placement-affects-e72d376e","markdown":"/readings/arxiv-cs-ai-paper-researchers-find-injection-placement-affects-e72d376e.md","json":"/readings/arxiv-cs-ai-paper-researchers-find-injection-placement-affects-e72d376e.json"},"attribution":"Headline and summary by Escape Meridian, prepared by Luna from the attributed source. A source check is not independent confirmation of the source’s claims.","maintainedGuideLinks":[],"readerContext":{"version":"reader-context-v1","attribution":"Reference context selected by Escape Meridian; separate from source evidence. Entity mentions do not establish authorship, involvement or endorsement.","terms":[{"id":"term-llm","name":"Large language model","explanation":"A language model with many learned numerical settings, used to process and generate language.","referenceUrl":"https://developers.google.com/machine-learning/glossary#large-language-model"},{"id":"term-prompt-injection","name":"Prompt injection","explanation":"Hidden instructions placed in a document, email or web page that try to take control of an AI system reading it.","referenceUrl":"https://en.wikipedia.org/wiki/Prompt_injection"},{"id":"term-tool-use","name":"Tool use","explanation":"A model's ability to operate other software, such as a search engine, a calculator or a code runner, while it works.","referenceUrl":"https://docs.anthropic.com/en/docs/build-with-claude/tool-use/overview"}],"entities":[{"id":"arxiv","name":"arXiv","kind":"organization","context":"arXiv is a research manuscript repository where authors share papers that may not yet have been peer reviewed.","referenceUrls":["https://arxiv.org/","https://info.arxiv.org/help/api/index.html"],"path":"/entities/arxiv","json":"/entities/arxiv.json","markdown":"/entities/arxiv.md"}]},"researchQuestions":[],"withdrawn":false,"references":{"schemaVersion":1,"target":{"type":"reading","id":"e72d376e2d63f0dca5bc267cc4a850ef596f8d936ba1129a22037abdedc3be9b","revision":"bd58ba5f-82e8-40ac-8296-e46cb8927038","revisionKind":"publication-id","title":"arXiv cs.AI paper: Researchers find injection placement affects LLM agent susceptibility","url":"https://escapemeridian.com/readings/arxiv-cs-ai-paper-researchers-find-injection-placement-affects-e72d376e"},"source":{"type":"source","id":"https://arxiv.org/abs/2610.38867","revision":"455a0d4bb4b4ac262a3644a44d213568ea62541cb3c563807c735bad826aa6d6","revisionKind":"sha256-source-text","title":"Where You Inject Matters: The Trust Region Effect in LLM Agents","url":"https://arxiv.org/abs/2610.38867"},"status":"available","items":[],"next":null,"scope":"Explicit citations in public readings and public file attachments to this reading. Shared topics are not citations. Other artifact types need an explicit reference adapter."},"revisions":[{"id":"e72d376e2d63f0dca5bc267cc4a850ef596f8d936ba1129a22037abdedc3be9b","title":"arXiv cs.AI paper: Researchers find injection placement affects LLM agent susceptibility","argument":"In a paper submitted to arXiv, Chengquan Guo and coauthors argue that where an indirect prompt injection appears can change whether an LLM agent follows it. They call this the “trust region effect”: agents implicitly assign different levels of trust to different parts of an environment.\n\nThe authors tested agents in three testbeds covering tool use, coding and daily workflows. Holding the malicious instruction fixed, they found that susceptibility varied with its placement. In one comparison, an agent powered by GPT-5.4 followed an unsafe instruction in repository documentation files, such as README or TODO files, 2.6 times more often on average than the same instruction in a code or data file.\n\nThe authors also developed learning-based attackers that generate injection content and choose placements, reporting that both factors can affect attack strength. Escape Meridian interpretation: the finding suggests that defenses focused only on instruction content may miss differences tied to where instructions appear. The paper describes testbed results; how well these patterns carry over to deployed agents and other environments remains unknown.\n\nHow consistently does the trust region effect hold across deployed agents and environments?","topicIds":["intelligence-and-discovery"],"domain":"science","claimType":"attributed reading","limits":"The supplied evidence is the arXiv abstract; it does not provide details of the testbed methods, sample sizes, or results beyond the stated findings. The abstract reports testbed findings but does not establish how well the placement effect generalizes to deployed agents or other environments.","speaker":{"name":"Guo, Chengquan, Liu, Xiaodong, Yang, Weiwei, Feng, Mingqian, Song, Jialin, Ma, Qiyao, Buractaon, Carolyn, White, Christopher, Li, Bo, Gao, Jianfeng","roleAtSource":"Article author"},"source":{"title":"Where You Inject Matters: The Trust Region Effect in LLM Agents","publisher":"arXiv cs.AI","format":"Article","url":"https://arxiv.org/abs/2610.38867","publishedAt":"2026-10-28","dateBasis":"Date basis not provided."},"evidence":[{"text":"The authors report that LLM agent susceptibility to indirect prompt injection varies according to where the instruction appears, even when its content is held fixed.","excerpt":"Holding the injection content fixed, we find that agent susceptibility varies across injection placements.","url":"https://arxiv.org/abs/2610.38867","relationship":"Source-stated"},{"text":"The paper names this placement-dependent difference in susceptibility the trust region effect.","excerpt":"We refer to this phenomenon as the trust region effect: agents implicitly assign different levels of trust to different regions of their environments.","url":"https://arxiv.org/abs/2610.38867","relationship":"Source-stated"},{"text":"In the authors’ reported comparison, GPT-5.4 followed an unsafe instruction in repository documentation more often than the same instruction in a code or data file.","excerpt":"an agent powered by GPT-5.4 follows an unsafe injection instruction placed in a repository documentation file (i.e., a README or TODO file) 2.6 times more often on average than the same instruction placed in a code or data file.","url":"https://arxiv.org/abs/2610.38867","relationship":"Source-stated"},{"text":"The authors say their learning-based attackers generate injection content and select placements, and that both can affect attack strength.","excerpt":"Our approach demonstrates that both where an injection is placed and what content it contains can affect the strength of indirect prompt injection attacks.","url":"https://arxiv.org/abs/2610.38867","relationship":"Source-stated"},{"text":"The paper’s testbed findings raise the question of whether placement effects also occur in deployed agents and other environments; the supplied evidence does not establish this.","excerpt":"we build three agentic testbeds spanning tool use, coding, and daily workflow domains with diverse injection surfaces.","url":"https://arxiv.org/abs/2610.38867","relationship":"Escape Meridian interpretation"}],"sourceMedia":{"status":"not_found","sourceUrl":"https://arxiv.org/abs/2610.38867","checkedAt":"2026-11-11T05:56:07.948Z","items":[],"note":"No suitable media was found by the supported page extraction."},"assumptions":[],"openQuestion":{"attribution":"Open question","text":"How consistently does the trust region effect hold across deployed agents and environments?"},"whatWouldChangeView":{"attribution":"Change condition not recorded","text":""},"editorialComparisons":[],"live":{"title":"arXiv cs.AI paper: Researchers find injection placement affects LLM agent susceptibility","summary":"In a paper submitted to arXiv, Chengquan Guo and coauthors argue that where an indirect prompt injection appears can change whether an LLM agent follows it. They call this the “trust region effect”: agents implicitly assign different levels of trust to different parts of an environment.\n\nThe authors tested agents in three testbeds covering tool use, coding and daily workflows. Holding the malicious instruction fixed, they found that susceptibility varied with its placement. In one comparison, an agent powered by GPT-5.4 followed an unsafe instruction in repository documentation files, such as README or TODO files, 2.6 times more often on average than the same instruction in a code or data file.\n\nThe authors also developed learning-based attackers that generate injection content and choose placements, reporting that both factors can affect attack strength. Escape Meridian interpretation: the finding suggests that defenses focused only on instruction content may miss differences tied to where instructions appear. The paper describes testbed results; how well these patterns carry over to deployed agents and other environments remains unknown.\n\nHow consistently does the trust region effect hold across deployed agents and environments?","question":"How consistently does the trust region effect hold across deployed agents and environments?","claims":[{"text":"The authors report that LLM agent susceptibility to indirect prompt injection varies according to where the instruction appears, even when its content is held fixed.","excerpt":"Holding the injection content fixed, we find that agent susceptibility varies across injection placements.","support":"source-stated"},{"text":"The paper names this placement-dependent difference in susceptibility the trust region effect.","excerpt":"We refer to this phenomenon as the trust region effect: agents implicitly assign different levels of trust to different regions of their environments.","support":"source-stated"},{"text":"In the authors’ reported comparison, GPT-5.4 followed an unsafe instruction in repository documentation more often than the same instruction in a code or data file.","excerpt":"an agent powered by GPT-5.4 follows an unsafe injection instruction placed in a repository documentation file (i.e., a README or TODO file) 2.6 times more often on average than the same instruction placed in a code or data file.","support":"source-stated"},{"text":"The authors say their learning-based attackers generate injection content and select placements, and that both can affect attack strength.","excerpt":"Our approach demonstrates that both where an injection is placed and what content it contains can affect the strength of indirect prompt injection attacks.","support":"source-stated"},{"text":"The paper’s testbed findings raise the question of whether placement effects also occur in deployed agents and other environments; the supplied evidence does not establish this.","excerpt":"we build three agentic testbeds spanning tool use, coding, and daily workflow domains with diverse injection surfaces.","support":"interpretation"}],"limitations":["The supplied evidence is the arXiv abstract; it does not provide details of the testbed methods, sample sizes, or results beyond the stated findings.","The abstract reports testbed findings but does not establish how well the placement effect generalizes to deployed agents or other environments."],"mediaId":"059d8b4a673cd59f11a408a33cbd92889ee697225bdce77397011c6d397b011d","correctionReason":null,"id":"e72d376e2d63f0dca5bc267cc4a850ef596f8d936ba1129a22037abdedc3be9b","publicationId":"bd58ba5f-82e8-40ac-8296-e46cb8927038","version":1,"sourceUrl":"https://arxiv.org/abs/2610.38867","sourceTitle":"Where You Inject Matters: The Trust Region Effect in LLM Agents","publisher":"arXiv cs.AI","publishedAt":null,"originalPublished":{"value":"2026-10-28","precision":"day","basis":"publisher_citation_date"},"firstObservedAt":"2026-10-30T06:43:00.514Z","createdAt":"2026-11-11T04:53:04.711Z","historical":true,"entityIds":["arxiv"],"topicIds":["intelligence-and-discovery"],"media":[{"id":"059d8b4a673cd59f11a408a33cbd92889ee697225bdce77397011c6d397b011d","kind":"article","url":"https://arxiv.org/abs/2610.38867","sourceUrl":"https://arxiv.org/abs/2610.38867","label":"Read original","provenance":"source_link","verification":{"status":"verified","checkedAt":"2026-10-31T11:49:31.235Z","method":"acquired_source","contentType":"text/html"},"recommendationReason":"Recommended by Jev for understanding this source; checked by Luna."}],"sourceMedia":{"status":"not_found","sourceUrl":"https://arxiv.org/abs/2610.38867","checkedAt":"2026-11-11T05:56:07.948Z","items":[],"note":"No suitable media was found by the supported page extraction."},"editorialDecision":{"outcome":"accept","reasonCodes":["material_development"],"rubricVersion":"stream-admission-v5","mediaId":"059d8b4a673cd59f11a408a33cbd92889ee697225bdce77397011c6d397b011d","confidence":0.8500000000000001,"provider":"typesafe","model":"jev-1.13.0","inputHash":"354f981a6c1477d1fdd5a3ea90180916297bc06c09d9a5fa301e3e4d1485bc87","decidedAt":"2026-10-31T11:49:32.985Z"},"provenance":{"textHash":"455a0d4bb4b4ac262a3644a44d213568ea62541cb3c563807c735bad826aa6d6","observationId":"70fb0535c932fd5d637859eb87db84d0500f4b681e09e90d4616931925a38039","retrievedAt":"2026-10-31T11:49:30.991Z","kind":"publisher-page","preparer":{"model":"gpt-6-luna","runId":"9641515d-ec52-49ab-83f7-4aef7398e7e4"},"reviewer":{"model":"gpt-6-luna","runId":"9c2887df-11eb-4a42-8668-d40ab725d84d"}},"audit":{"status":"passed","reviewedAt":"2026-11-11T04:53:04.711Z","model":"anthropic/claude-opus-5.5"},"sourceAttribution":{"authors":[{"name":"Guo, Chengquan","url":null,"kind":"unknown"},{"name":"Liu, Xiaodong","url":null,"kind":"unknown"},{"name":"Yang, Weiwei","url":null,"kind":"unknown"},{"name":"Feng, Mingqian","url":null,"kind":"unknown"},{"name":"Song, Jialin","url":null,"kind":"unknown"},{"name":"Ma, Qiyao","url":null,"kind":"unknown"},{"name":"Buractaon, Carolyn","url":null,"kind":"unknown"},{"name":"White, Christopher","url":null,"kind":"unknown"},{"name":"Li, Bo","url":null,"kind":"unknown"},{"name":"Gao, Jianfeng","url":null,"kind":"unknown"}],"authorRole":"article-author","hosts":[],"status":"stated","authorRoster":{"truncated":false,"omitted":0,"assertionGroupsOmitted":0},"participation":[{"actor":{"name":"Guo, Chengquan","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Guo, Chengquan","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2610.38867","locator":"head/meta[name=author|citation_author]"},"assertionId":"887c4ee50f9a2f38f8df688e56286bbf84d1688a849ef132bc7b8c2966a93cc7:participation:0","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-11T05:56:07.948Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"887c4ee50f9a2f38f8df688e56286bbf84d1688a849ef132bc7b8c2966a93cc7","sourceUrl":"https://arxiv.org/abs/2610.38867","contentSha256":"9a621cec0253678f5fd2b150c737d6cebadd95db0e7e569b1c9e3f34b1f5d040","textHash":"455a0d4bb4b4ac262a3644a44d213568ea62541cb3c563807c735bad826aa6d6","observedAt":"2026-11-11T05:56:07.948Z"}},{"actor":{"name":"Liu, Xiaodong","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Liu, Xiaodong","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2610.38867","locator":"head/meta[name=author|citation_author]"},"assertionId":"887c4ee50f9a2f38f8df688e56286bbf84d1688a849ef132bc7b8c2966a93cc7:participation:1","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-11T05:56:07.948Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"887c4ee50f9a2f38f8df688e56286bbf84d1688a849ef132bc7b8c2966a93cc7","sourceUrl":"https://arxiv.org/abs/2610.38867","contentSha256":"9a621cec0253678f5fd2b150c737d6cebadd95db0e7e569b1c9e3f34b1f5d040","textHash":"455a0d4bb4b4ac262a3644a44d213568ea62541cb3c563807c735bad826aa6d6","observedAt":"2026-11-11T05:56:07.948Z"}},{"actor":{"name":"Yang, Weiwei","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Yang, Weiwei","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2610.38867","locator":"head/meta[name=author|citation_author]"},"assertionId":"887c4ee50f9a2f38f8df688e56286bbf84d1688a849ef132bc7b8c2966a93cc7:participation:2","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-11T05:56:07.948Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"887c4ee50f9a2f38f8df688e56286bbf84d1688a849ef132bc7b8c2966a93cc7","sourceUrl":"https://arxiv.org/abs/2610.38867","contentSha256":"9a621cec0253678f5fd2b150c737d6cebadd95db0e7e569b1c9e3f34b1f5d040","textHash":"455a0d4bb4b4ac262a3644a44d213568ea62541cb3c563807c735bad826aa6d6","observedAt":"2026-11-11T05:56:07.948Z"}},{"actor":{"name":"Feng, Mingqian","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Feng, Mingqian","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2610.38867","locator":"head/meta[name=author|citation_author]"},"assertionId":"887c4ee50f9a2f38f8df688e56286bbf84d1688a849ef132bc7b8c2966a93cc7:participation:3","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-11T05:56:07.948Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"887c4ee50f9a2f38f8df688e56286bbf84d1688a849ef132bc7b8c2966a93cc7","sourceUrl":"https://arxiv.org/abs/2610.38867","contentSha256":"9a621cec0253678f5fd2b150c737d6cebadd95db0e7e569b1c9e3f34b1f5d040","textHash":"455a0d4bb4b4ac262a3644a44d213568ea62541cb3c563807c735bad826aa6d6","observedAt":"2026-11-11T05:56:07.948Z"}},{"actor":{"name":"Song, Jialin","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Song, Jialin","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2610.38867","locator":"head/meta[name=author|citation_author]"},"assertionId":"887c4ee50f9a2f38f8df688e56286bbf84d1688a849ef132bc7b8c2966a93cc7:participation:4","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-11T05:56:07.948Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"887c4ee50f9a2f38f8df688e56286bbf84d1688a849ef132bc7b8c2966a93cc7","sourceUrl":"https://arxiv.org/abs/2610.38867","contentSha256":"9a621cec0253678f5fd2b150c737d6cebadd95db0e7e569b1c9e3f34b1f5d040","textHash":"455a0d4bb4b4ac262a3644a44d213568ea62541cb3c563807c735bad826aa6d6","observedAt":"2026-11-11T05:56:07.948Z"}},{"actor":{"name":"Ma, Qiyao","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Ma, Qiyao","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2610.38867","locator":"head/meta[name=author|citation_author]"},"assertionId":"887c4ee50f9a2f38f8df688e56286bbf84d1688a849ef132bc7b8c2966a93cc7:participation:5","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-11T05:56:07.948Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"887c4ee50f9a2f38f8df688e56286bbf84d1688a849ef132bc7b8c2966a93cc7","sourceUrl":"https://arxiv.org/abs/2610.38867","contentSha256":"9a621cec0253678f5fd2b150c737d6cebadd95db0e7e569b1c9e3f34b1f5d040","textHash":"455a0d4bb4b4ac262a3644a44d213568ea62541cb3c563807c735bad826aa6d6","observedAt":"2026-11-11T05:56:07.948Z"}},{"actor":{"name":"Buractaon, Carolyn","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Buractaon, Carolyn","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2610.38867","locator":"head/meta[name=author|citation_author]"},"assertionId":"887c4ee50f9a2f38f8df688e56286bbf84d1688a849ef132bc7b8c2966a93cc7:participation:6","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-11T05:56:07.948Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"887c4ee50f9a2f38f8df688e56286bbf84d1688a849ef132bc7b8c2966a93cc7","sourceUrl":"https://arxiv.org/abs/2610.38867","contentSha256":"9a621cec0253678f5fd2b150c737d6cebadd95db0e7e569b1c9e3f34b1f5d040","textHash":"455a0d4bb4b4ac262a3644a44d213568ea62541cb3c563807c735bad826aa6d6","observedAt":"2026-11-11T05:56:07.948Z"}},{"actor":{"name":"White, Christopher","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"White, Christopher","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2610.38867","locator":"head/meta[name=author|citation_author]"},"assertionId":"887c4ee50f9a2f38f8df688e56286bbf84d1688a849ef132bc7b8c2966a93cc7:participation:7","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-11T05:56:07.948Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"887c4ee50f9a2f38f8df688e56286bbf84d1688a849ef132bc7b8c2966a93cc7","sourceUrl":"https://arxiv.org/abs/2610.38867","contentSha256":"9a621cec0253678f5fd2b150c737d6cebadd95db0e7e569b1c9e3f34b1f5d040","textHash":"455a0d4bb4b4ac262a3644a44d213568ea62541cb3c563807c735bad826aa6d6","observedAt":"2026-11-11T05:56:07.948Z"}},{"actor":{"name":"Li, Bo","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Li, Bo","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2610.38867","locator":"head/meta[name=author|citation_author]"},"assertionId":"887c4ee50f9a2f38f8df688e56286bbf84d1688a849ef132bc7b8c2966a93cc7:participation:8","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-11T05:56:07.948Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"887c4ee50f9a2f38f8df688e56286bbf84d1688a849ef132bc7b8c2966a93cc7","sourceUrl":"https://arxiv.org/abs/2610.38867","contentSha256":"9a621cec0253678f5fd2b150c737d6cebadd95db0e7e569b1c9e3f34b1f5d040","textHash":"455a0d4bb4b4ac262a3644a44d213568ea62541cb3c563807c735bad826aa6d6","observedAt":"2026-11-11T05:56:07.948Z"}},{"actor":{"name":"Gao, Jianfeng","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Gao, Jianfeng","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2610.38867","locator":"head/meta[name=author|citation_author]"},"assertionId":"887c4ee50f9a2f38f8df688e56286bbf84d1688a849ef132bc7b8c2966a93cc7:participation:9","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-11T05:56:07.948Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"887c4ee50f9a2f38f8df688e56286bbf84d1688a849ef132bc7b8c2966a93cc7","sourceUrl":"https://arxiv.org/abs/2610.38867","contentSha256":"9a621cec0253678f5fd2b150c737d6cebadd95db0e7e569b1c9e3f34b1f5d040","textHash":"455a0d4bb4b4ac262a3644a44d213568ea62541cb3c563807c735bad826aa6d6","observedAt":"2026-11-11T05:56:07.948Z"}}],"participationCoverage":{"total":10,"returned":10,"complete":true,"fullAssertions":"source-metadata-endpoint"},"distribution":null,"publisher":null,"sourceUrl":"https://arxiv.org/abs/2610.38867","snapshotId":"887c4ee50f9a2f38f8df688e56286bbf84d1688a849ef132bc7b8c2966a93cc7","contentSha256":"9a621cec0253678f5fd2b150c737d6cebadd95db0e7e569b1c9e3f34b1f5d040","textHash":"455a0d4bb4b4ac262a3644a44d213568ea62541cb3c563807c735bad826aa6d6","observedAt":"2026-11-11T05:56:07.948Z","basis":"publisher-page-metadata","sourceLinks":50,"linksTruncated":false,"metadataUrl":"/api/pipeline/stream/e72d376e2d63f0dca5bc267cc4a850ef596f8d936ba1129a22037abdedc3be9b/source"}}}],"audits":[{"publicationId":"bd58ba5f-82e8-40ac-8296-e46cb8927038","verdict":"passed","findings":[{"dimension":"attribution","status":"pass","explanation":"The reading attributes the work to Chengquan Guo and coauthors in an arXiv paper, matching the listed authors. Findings remain framed as the authors' claims, and the EM inference is explicitly labeled.","excerpt":"Authors:Chengquan Guo, Xiaodong Liu, Weiwei Yang, Mingqian Feng"},{"dimension":"summary","status":"pass","explanation":"The reading leads with the authors' thesis, defines the trust region effect in the source's terms, and gives the testbeds, the GPT-5.4 example and the learning-based attackers. A general reader can infer that an indirect prompt injection is a planted malicious instruction. Term-library tooltips should cover indirect prompt injection and LLM agent. The question follows from the stated testbed limitation and is not leading.","excerpt":"indirect prompt injections, which manipulate agents through malicious instructions embedded in external environments"},{"dimension":"date","status":"pass","explanation":"The originalPublished date, 2026-10-28, matches the v1 arXiv submission date. It does not use the later feed date of Oct 31.","excerpt":"[Submitted on 28 Oct 2026]"},{"dimension":"support","status":"pass","explanation":"Each factual claim matches the abstract, including the 2.6 times average comparison and the README or TODO example. The EM interpretation about content-only defenses is labeled, conditional ('suggests', 'may') and grounded in the abstract's contrast with prior content-focused work. The generalization gap is stated rather than assumed.","excerpt":"While existing risk assessment work has primarily focused on the injection content, the effect of where an injection appears has not been systematically characterized."},{"dimension":"media","status":"pass","explanation":"The selected media is the verified direct arXiv abstract page for this paper. It is the most direct way for readers to access the source.","excerpt":null}],"createdAt":"2026-11-11T04:53:04.711Z","model":"anthropic/claude-opus-5.5"}],"correctionUrl":"https://escapemeridian.com/corrections/"}