Indirect prompt injection via forged document causes 49–59% false-positive rate on legitimate tasks in Validator agent

Auto-published from arXiv:2609.17648 by the mine-arxiv pipeline. Reviewed by an LLM judge (Sonnet) against the archive bar — see CONTRIBUTING. Notes: cleared review (confidence 0.72, flags: [no-prompt-excerpt])

Category

indirect-prompt-injection

Model

gemma4:31b-cloud (Ollama, temperature=0)

Surface

agent harness (LangGraph: Researcher retrieval → Validator judgment)

Setup

The Researcher agent retrieves documents from a compromised source. Each retrieved document contains fabricated approval claims, confidence scores, and provenance statements crafted to manipulate the Validator's judgment. The Validator processes the Researcher's summary without visibility into source compromise. The attack is evaluated on gold-safe tasks that should be approved. No verbatim injection payload is published in the paper.

Reproduction anchor

benchmark: Enron Email Dataset, 36 gold-safe tasks, seeds {1, 7, 42}; FPR measured as proportion of safe tasks incorrectly blocked; model: gemma4:31b-cloud via Ollama; no code repository released

Observed behavior

Agent hijacking (indirect prompt injection) causes a 59.3% false-positive rate in the undefended condition and 49.1% with authorization enabled — meaning roughly half of all legitimate tasks are incorrectly blocked by the Validator due to injected content. The Observer layer reduces this to 7.4% by detecting and removing injections before Validator processing.

Expected behavior

The Validator should approve gold-safe tasks regardless of injected content in retrieved documents; the FPR should be near 0%.

Reproducibility

medium

Threat model

An attacker who controls any document source reachable by a Researcher agent (web pages, databases, email attachments) can inject content that causes the downstream Validator to block legitimate user tasks at scale — a denial-of-service against the pipeline's authorized functionality. This threatens any agentic system that retrieves external content and routes it through an LLM-based approval step.

Novelty

Quantifies indirect prompt injection harm not as unauthorized execution but as availability harm: ~50% of legitimate tasks are incorrectly rejected, a rarely-measured failure mode that standard UAR metrics would miss entirely.

Source

• arXiv: 2609.17648
• PDF: https://arxiv.org/pdf/2609.17648
• Categories: cs.CR, cs.CY
• Authors: Tanzim Hossain Safin, Sharif Noor Zisad, Swakkhar Shatabda, Ragib Hasan

Triage notes (auto)

• paperType: case-study
• estimatedCaseCount: 2
• triage reason: Empirical study of attack propagation in multi-agent LLM pipelines demonstrating memory poisoning and indirect prompt injection with reproducible setup (LangGraph pipeline, 60 labeled tasks). Failures are model/agent-level: compromised agents bypass authorization through forged documents and poisoned memory, with quantified metrics (JBR, Unsafe Action Rate).

─────────────────────────────────────────────────────────────────────