{"schemaVersion":"nuwa-current-record-1","version":"2026-10-29.1","publication":"published","work":{"id":"injecagent","title":"InjecAgent: Benchmarking Indirect Prompt Injections in Tool-Integrated Large Language Model Agents","aliases":["InjecAgent"],"authors":["Qiusi Zhan","Zhixiang Liang","Zifan Ying","Daniel Kang"],"primaryFunction":"evaluation","secondaryFunctions":[],"kind":"benchmark","sourceId":"injecagent-publication","attributionSourceId":"injecagent-publication-author-source","originalUrl":"https://arxiv.org/abs/2403.02691","publicationDate":"2024-03-05","updatedOn":"2026-10-25","areas":["cybersecurity"],"scopeNote":{"en":"The main dimension follows the task outcome in the original protocol. Topic relevance is documented in the parent research record; no unreviewed question-level links are inferred.","zh":"主维度依据原协议的任务结果确定。主题关联见研究档案，不推断尚未审阅的问题级关联。"},"protocolIds":["injecagent"],"contributions":[{"organizationId":"uiuc","role":"research","sourceId":"injecagent-publication-author-source","locator":"Author affiliations on the original paper title page"}],"summary":{"en":"Benchmarks indirect prompt injection against tool-integrated agents processing untrusted external content.","zh":"评测工具型智能体处理不可信外部内容时遭受间接提示注入的情况。"},"note":{"question":null,"method":null,"finding":null,"supports":null,"limits":null,"connections":null},"resources":[],"noteStatus":{"question":"limited","method":"limited","finding":"limited","supports":"limited","limits":"limited","connections":"limited"},"noteAvailability":{"en":"A substantive NUWA research note is not yet available. The repeated draft sections were removed pending review of the original methods, findings and limitations; use the original publication for the research account.","zh":"实质性的 NUWA 研究笔记尚未完成。重复草稿章节已移除，待核查原始方法、发现与限制；研究内容请以原始出版物为准。"},"noteSourceLocator":"No complete section-level method/results/limitations review completed for this note; cached original page and any chart audit retained as discovery evidence.","tags":[]},"reading":{"id":"injecagent","title":"InjecAgent: Benchmarking Indirect Prompt Injections in Tool-Integrated Large Language Model Agents","en":{"question":"How vulnerable are tool-integrated agents to attacker instructions in external content?","design":"1,054 simulated cases span seventeen user tools and 62 attacker tools; thirty agents are evaluated, with valid-output rates reported separately.","findings":["ReAct GPT-4 was vulnerable in 24% of evaluated cases, with a near doubling in the enhanced condition.","Unparseable and otherwise invalid outputs are excluded from robustness assessment (§3.1)."],"interpretation":"NUWA interpretation: success rates require the valid-output denominator and simulation assumptions.","limits":"The enhanced setting uses one fixed reinforcement prompt; single-turn simulation does not capture all adaptive multi-step behavior.","decisionRelevance":"Model recommendation: retain validity rates and distinguish baseline from enhanced attacks.","takeaway":"NUWA interpretation: success rates require the valid-output denominator and simulation assumptions.","connections":[],"scoring":"Attack success among valid assessed outputs; valid-output rate is separate.","conditions":"1,054 simulated cases; baseline versus one fixed enhanced-prompt condition.","statistics":"ReAct GPT-4 was vulnerable in 24% of evaluated cases, with a near doubling in the enhanced condition. Unparseable and otherwise invalid outputs are excluded from robustness assessment (§3.1).","usage":"Model recommendation: retain validity rates and distinguish baseline from enhanced attacks."},"zh":{"question":"工具智能体对外部内容中的恶意指令有多脆弱？","design":"1,054个模拟案例覆盖17种用户工具、62种攻击工具，评价30种智能体，并另报有效输出率。","findings":["ReAct GPT-4在受评案例24%中受影响，增强条件近乎翻倍。","不可解析等无效输出不进入稳健性评价（§3.1）。"],"interpretation":"NUWA 解读：成功率须连同有效输出分母及模拟假设阅读。","limits":"增强设置只用一个固定提示，单轮模拟不能覆盖自适应多步行为。","decisionRelevance":"模型建议：保留有效率，并区分基础与增强攻击。","takeaway":"NUWA 解读：成功率须连同有效输出分母及模拟假设阅读。","connections":[],"scoring":"在有效受评输出中计攻击成功，有效率另报。","conditions":"1,054模拟例，基础及一个固定增强提示。","statistics":"ReAct GPT-4在受评案例24%中受影响，增强条件近乎翻倍。 不可解析等无效输出不进入稳健性评价（§3.1）。","usage":"模型建议：保留有效率，并区分基础与增强攻击。"},"assertionPolicy":{"question":"source-research-question","design":"source-finding","findings":"source-finding","interpretation":"nuwa-interpretation","limits":"source-limit-or-explicit-editorial-scope-limit","connections":"source-supported-relationship-only","decisionRelevance":"model-recommendation-not-source-conclusion"},"sourceRefs":[{"sourceId":"injecagent-publication-author-source","url":"https://arxiv.org/html/2403.02691","locator":"Abstract","version":"Selected original resource https://arxiv.org/html/2403.02691; sha256:0c09657b3b3f5886ee984f733cec481166307362cdde82378536fc24b254db78; archived source capture; exact capture time not independently established","artifactSha256":"0c09657b3b3f5886ee984f733cec481166307362cdde82378536fc24b254db78"},{"sourceId":"injecagent-publication-author-source","url":"https://arxiv.org/html/2403.02691","locator":"§2 Benchmark Construction","version":"Selected original resource https://arxiv.org/html/2403.02691; sha256:0c09657b3b3f5886ee984f733cec481166307362cdde82378536fc24b254db78; archived source capture; exact capture time not independently established","artifactSha256":"0c09657b3b3f5886ee984f733cec481166307362cdde82378536fc24b254db78"},{"sourceId":"injecagent-publication-author-source","url":"https://arxiv.org/html/2403.02691","locator":"§3.1 Experiment Settings: Output Parsing","version":"Selected original resource https://arxiv.org/html/2403.02691; sha256:0c09657b3b3f5886ee984f733cec481166307362cdde82378536fc24b254db78; archived source capture; exact capture time not independently established","artifactSha256":"0c09657b3b3f5886ee984f733cec481166307362cdde82378536fc24b254db78"},{"sourceId":"injecagent-publication-author-source","url":"https://arxiv.org/html/2403.02691","locator":"§8 Limitations","version":"Selected original resource https://arxiv.org/html/2403.02691; sha256:0c09657b3b3f5886ee984f733cec481166307362cdde82378536fc24b254db78; archived source capture; exact capture time not independently established","artifactSha256":"0c09657b3b3f5886ee984f733cec481166307362cdde82378536fc24b254db78"}],"publication":{"state":"published","publishedOn":"2026-10-29","authorizationReference":"user-authorized-global-index-publication-2026-10-29","reviewedCandidateId":"local-6efe31bc4a0c0f37"},"review":{"state":"published-note","sourceScope":"full-text","availableScope":null,"readingCoverage":"selected-source-sections; not a complete section-by-section paper audit","completePaperAudit":false,"independentEvidenceReview":"pending-human-review","bilingualEditorialReview":"pending-human-review","authorship":"model-assisted-research-note","preparedFingerprint":"d6daeb43035cd4eb7177d7f053c0f812cd06729dd567316bd003b37876977059"}},"sources":[{"id":"injecagent-publication","title":"InjecAgent: Benchmarking Indirect Prompt Injections in Tool-Integrated Large Language Model Agents","url":"https://arxiv.org/abs/2403.02691","version":"arXiv:2403.02691v3","publicationDate":"2024-03-05","datePrecision":"day","type":"paper","verifiedOn":"2026-10-25","documentId":"arxiv:2403.02691","authors":["Qiusi Zhan","Zhixiang Liang","Zifan Ying","Daniel Kang"],"aliases":["https://doi.org/10.48550/arXiv.2403.02691","https://arxiv.org/abs/2403.02691","https://arxiv.org/pdf/2403.02691"]}]}