arXiv cs.AI· Chengquan Guo, Xiaodong Liu, Weiwei Yang, Mingqian Feng, Jialin Song, Qiyao Ma, Carolyn Buractaon, Christopher White, Bo Li, Jianfeng Gao·· 2 小时前AI 评分52
arXiv 论文揭示 LLM 智能体的信任区域效应：注入位置显著影响攻击成功率
Where You Inject Matters: The Trust Region Effect in LLM Agents
AI 导读
arXiv 论文（arXiv:2610.38867）系统性研究了间接提示词注入的位置对 LLM 智能体攻击效果的影响。作者搭建了覆盖工具使用、编码和日常工作的三个智能体测试环境，在固定注入内容时发现智能体对不同位置的易感性不同，称为信任区域效应。
正文 · 原文
Abstract:LLM agents are increasingly adopted in long-horizon tasks and interact with diverse external environments. Despite their growing capabilities, these agents remain vulnerable to real-world attacks such as indirect prompt injections, which manipulate agents through malicious instructions embedded in external environments. While existing risk assessment work has primarily focused on the injection content, the effect of where an injection appears has not been systematically characterized. Studying injection placement requires agents to operate over longer-horizon tasks and interact with diverse environmental surfaces. Thus, we build three agentic testbeds spanning tool use, coding, and daily workflow domains with diverse injection surfaces. Holding the injection content fixed, we find that agent susceptibility varies across injection placements. We refer to this phenomenon as the trust region effect: agents implicitly assign different levels of trust to different regions of their environments. For example, an agent powered by GPT-5.4 follows an unsafe injection instruction placed in a repository documentation file (i.e., a README or TODO file) 2.6 times more often on average than the same instruction placed in a code or data file. Building upon this observation, we develop learning-based attackers that generate injection content and select better injection placements. Our approach demonstrates that both where an injection is placed and what content it contains can affect the strength of indirect prompt injection attacks. To the best of our knowledge, this work provides the first systematic characterization for the effectiveness of different injection placements, spanning both coarse-grained environmental surfaces and fine-grained positions. The uneven trust that agents implicitly place across their environments provides important insights for future attack and defense design.
| Subjects: | Artificial Intelligence (cs.AI); Cryptography and Security (cs.CR); Machine Learning (cs.LG) |
| Cite as: | arXiv:2610.38867 [cs.AI] |
| (or arXiv:2610.38867v1 [cs.AI] for this version) | |
| https://doi.org/10.48550/arXiv.2610.38867 arXiv-issued DOI via DataCite |
Submission history
From: Chengquan Guo [view email]
[v1]
Wed, 28 Oct 2026 20:40:04 UTC (208 KB)
来源：arXiv cs.AI · arxiv.org