Newest papers

SEAL: Towards Persistent Tool Poisoning Attack against LLM Agents via Prefix-Eliciting Trigger

Nanjun Zhou, Yiming Li, Yukun Chen, Ting Qiao, Enhao Huang, Zhan Qin · 2026 · arXiv (Cornell University)

DOI: 10.48550/arxiv.2610.25372 · cited by 0 works (OpenAlex) · open-access PDF

Indonesian

Pengacauan potensial alat telah muncul sebagai ancaman keamanan kritis untuk agen LLM, di mana lawan memasukkan instruksi berbahaya dalam deskripsi alat atau sumber daya eksternal yang masuk ke konteks agen target, memungkinkan lawan untuk memanipulasi proses pemilihan alat agen. Namun, serangan pengacauan alat yang ada terutama bergantung pada asumsi yang diidealisasi bahwa serangan efek tugas dalam satu ronde interaksi. Kami menunjukkan bahwa efektivitas mereka melemah secara tajam dalam pengaturan agen multi-round yang realistis. Kami lebih lanjut mengungkapkan bahwa degradasi ini berasal dari fakta bahwa agen tidak secara konsisten menyerang sinyal yang relevan dalam alasan konteks mereka saat konteks perencanaan berkembang, sehingga melemahkan pengaruh serangan di seluruh ronde. Untuk menyelidiki apakah pengacauan alat tetap menjadi ancaman praktis dalam pengaturan realistis seperti itu, kami menyarankan trigger

Machine translation (Meta M2M100); the English original follows.

Abstract

Tool poisoning has emerged as a critical security threat to LLM agents, where adversaries embed malicious instructions in tool descriptions or external resources that enter the agent's context, allowing adversaries to manipulate agent's tool selection process. However, existing tool poisoning attacks primarily rely on an idealized assumption that the attacks task effect within a single interaction round. We show that their effectiveness degrades sharply in realistic multi-round agentic settings. We further reveal that this degradation stems from the fact that agents do not consistently surface attack-relevant signals in their reasoning as the planning context evolves, thereby weakening the attack's influence across rounds. To investigate whether tool poisoning remains a practical threat in such realistic settings, we propose SEAL, a two-stage method for persistent tool poisoning. Specifically, SEAL first performs Prefix-Eliciting Trigger Optimization (PETO) to optimize context-specific triggers that elicit attack-relevant reasoning prefixes, improving effectiveness within individual contexts. It then applies Local-to-Universal Trigger Aggregation (L2U) to combine these local triggers into a single universal trigger, improving generalization across different contexts and execution rounds. Extensive experiments across seven representative multi-round scenarios and different models demonstrate the attack effectiveness of SEAL, its transferability across target models, and its resistance to potential defenses.

Read in: English · Spanish · Chinese · Hindi · Arabic · Portuguese · French · German · Japanese · Russian · Korean · Indonesian · Vietnamese

Topics: Computer science, Context (archaeology), Task (project management), Transferability, Computer security, Generalization

Sources: OpenAlex (CC0), arXiv, Crossref. Agent Exchange