Ignored, Not Refused: What Low Prompt-Injection Success Rates Hide in Small Tool-Using Agents

Farhan Zarif; Kazi Shahid Ahmed Galib; Synthia Akter Promi; Shabnam Sharmin Tarin; Ariyan Hossain; Sadif Ahmed; Farig Yousuf Sadeque

arXiv · 2610.23254

Ignored, Not Refused: What Low Prompt-Injection Success Rates Hide in Small Tool-Using Agents

Farhan Zarif·Kazi Shahid Ahmed Galib·Synthia Akter Promi·Shabnam Sharmin Tarin·Ariyan Hossain·Sadif Ahmed·Farig Yousuf Sadeque

View original source ↗Read source document ↗Export metadata ↓

Abstract

Tool-using agents read untrusted external content, which exposes them to indirect prompt injection (IPI), where hidden instructions hijack the agent's tool calls. Benchmarks measure IPI security by the attack success rate (ASR), which treats every failed attack as a successful defense. To test this assumption, we audit 33,000 trajectories from eleven open-weight agents (2-14B parameters) on InjecAgent and AgentDojo. A label-blind LLM judge shows that most failed attacks are ignored (76-80%) rather than refused (17-18%). With identical model weights, changing only the system prompt shifts InjecAgent ASR from 0.2% to 43%. Our Attack-Task Outcome Matrix (ATOM) further shows that in 21.7% of AgentDojo episodes, the agent stayed safe but did not complete the user's task. A low ASR therefore mostly reflects agents silently ignoring injections, not refusing them. Evaluations should report how attacks fail and whether the user's task is completed, alongside ASR. We release the labeled corpus, judge prompt, and analysis code.

Explore related subjects

cs.CL cs.CR

Keep this discovery

Explore connections, maps & timelines

BibTeX RIS

Farhan Zarif, Kazi Shahid Ahmed Galib, Synthia Akter Promi, Shabnam Sharmin Tarin, Ariyan Hossain, Sadif Ahmed, Farig Yousuf Sadeque. 2026-10-16. Ignored, Not Refused: What Low Prompt-Injection Success Rates Hide in Small Tool-Using Agents. https://arxiv.org/abs/2610.23254

Cite the original work for its findings. Save a collection to share your selection of sources.

KEEP EXPLORING

Related papers

arXiv2026

Enriching Patent Claim Generation with European Patent Dataset

Drafting patent claims is time-intensive, costly, and requires professional skill. Therefore, researchers have investigated large language models (LLMs) to assist inventors in writing claims. However, existing work has largely relied on datasets from the United States Patent and Trademark Office (USPTO). To enlarge research scope regarding various jurisdictions, drafting conventions, and legal standards, we introduce EPD, a European patent dataset. EPD presents rich textual data and structured metadata to support multiple patent-related tasks, including claim generation. This dataset enriches the field in three critical aspects: (1) Jurisdictional diversity: Patents from different offices vary in legal and drafting conventions. EPD fills a critical gap by providing a benchmark of European patents to enable more comprehensive evaluation. (2) Quality improvement: EPD offers high-quality granted patents with finalized and legally approved texts, whereas others consist of patent applications that are unexamined or provisional. Experiments show that LLMs fine-tuned on EPD significantly outperform those trained on previous datasets and even GPT-4o in claim quality and cross-domain generalization. (3) Real-world simulation: We propose a difficult subset of EPD to better reflect real-world challenges. Results reveal that all tested LLMs perform substantially worse on challenging samples, which highlights the need for future research.

cs.CL↗

arXiv2026

POSID: Target-Task-Unsupervised Person-Attribute Extraction from Heterogeneous Public-Safety Text

Person descriptions in public-safety text can be compact and regular, or distributed across heterogeneous narratives in which evidence boundaries and person ownership are ambiguous. We present POSID, a target-task-unsupervised framework that decomposes person-attribute extraction into candidate localization, provenance-controlled extraction scope, structured recovery and traversal, and person association, without supervised training or fine-tuning on the target task. We evaluate six localization configurations under two traversal policies across three real-use cohorts and two controlled synthetic diagnostics. On structurally regular descriptions, the strongest configurations reach 1.000/.972 Attr-Only (AO)/Attr-Value (AV) F1 on Compact500. Across the real-use cohorts, every RE-containing configuration benefits from conservative early stopping, while semantic-only retrieval can benefit from continued traversal when localization is less constrained. On the heterogeneous multi-person Challenge14 cohort, the best automatic AO and AV results are .500 and .382; replacing automatic candidates with verified evidence raises the frozen extractor to .522/.410 under early stopping, showing that localization is one of the material bottlenecks. We further introduce provenance-aware scoring for collective and underspecified evidence and a separate person-aware diagnostic for ownership and fragmentation. Together, the results establish a measurable operating regime for inspectable person-attribute extraction and distinguish errors due to localization, traversal, structured recovery, and attribution. Code: https://github.com/ksolaiman/hart-posid.

cs.CL↗

arXiv2026

Reasoning for Hierarchical Text Classification: The Case of Patents

Hierarchical text classification (HTC) assigns documents to multiple levels of a pre-defined taxonomy. Automated patent subject classification represents one of the hardest HTC scenarios because of professional difficulties and extensive labels. Prior approaches only output a flat label set, which offers little insight into the reason behind predictions. Therefore, we propose Reasoning for Hierarchical Classification (RHC), a novel framework that reformulates HTC as a step-by-step reasoning task to sequentially deduce hierarchical labels. RHC trains large language models (LLMs) in two stages: a cold-start stage that aligns outputs with chain-of-thought (CoT) reasoning format and a reinforcement learning (RL) stage to enhance multi-step reasoning ability. RHC demonstrates four advantages in our experiments. (1) Effectiveness: RHC surpasses previous baselines and outperforms the supervised fine-tuning counterparts by approximately 3% in accuracy and macro F1. (2) Explainability: RHC produces natural-language justifications before prediction to facilitate human inspection. (3) Scalability: RHC scales favorably with model size with larger gains compared to standard fine-tuning. (4) Applicability: Beyond patents, we further demonstrate that RHC achieves state-of-the-art performance on other widely used HTC benchmarks, which highlights its broad applicability.

cs.CL↗