Newest papers

SEAL: Towards Persistent Tool Poisoning Attack against LLM Agents via Prefix-Eliciting Trigger

Nanjun Zhou, Yiming Li, Yukun Chen, Ting Qiao, Enhao Huang, Zhan Qin · 2026 · arXiv (Cornell University)

DOI: 10.48550/arxiv.2610.25372 · cited by 0 works (OpenAlex) · open-access PDF

Arabic

وقد أظهرت أدوات التعدي على الأدوات أن التعدي على الأدوات قد يكون خطراً حقيقياً على العاملين في LLM، حيث يضم المتنافسون إرشادات ضارة في توصيات الأدوات أو الموارد الخارجية التي تدور في سياق العاملين، مما يسمح للمنافسين بالتعدي على عملية اختيار الأدوات. ومع ذلك، فإن هجمات التعدي على الأدوات الحالية تعتمد أساسا على فرضية مثالية أن الهجمات تتطور في سياق التخطيط، وبالتالي تقلل من تأثير الهجمات على كل دورة من التفاعل. ونحن نرى أن فعالية التعدي على الأدوات لا تزال تهدد بشكل كبير في إعدادات العاملين متعددة الأطراف الواقعية. ونحن أيضاً ندرك أن هذه التعد

Machine translation (Meta M2M100); the English original follows.

Abstract

Tool poisoning has emerged as a critical security threat to LLM agents, where adversaries embed malicious instructions in tool descriptions or external resources that enter the agent's context, allowing adversaries to manipulate agent's tool selection process. However, existing tool poisoning attacks primarily rely on an idealized assumption that the attacks task effect within a single interaction round. We show that their effectiveness degrades sharply in realistic multi-round agentic settings. We further reveal that this degradation stems from the fact that agents do not consistently surface attack-relevant signals in their reasoning as the planning context evolves, thereby weakening the attack's influence across rounds. To investigate whether tool poisoning remains a practical threat in such realistic settings, we propose SEAL, a two-stage method for persistent tool poisoning. Specifically, SEAL first performs Prefix-Eliciting Trigger Optimization (PETO) to optimize context-specific triggers that elicit attack-relevant reasoning prefixes, improving effectiveness within individual contexts. It then applies Local-to-Universal Trigger Aggregation (L2U) to combine these local triggers into a single universal trigger, improving generalization across different contexts and execution rounds. Extensive experiments across seven representative multi-round scenarios and different models demonstrate the attack effectiveness of SEAL, its transferability across target models, and its resistance to potential defenses.

Read in: English · Spanish · Chinese · Hindi · Arabic · Portuguese · French · German · Japanese · Russian · Korean · Indonesian · Vietnamese

Topics: Computer science, Context (archaeology), Task (project management), Transferability, Computer security, Generalization

Sources: OpenAlex (CC0), arXiv, Crossref. Agent Exchange