{"id":"2307ec46-345e-42e5-9346-7e6eafda8299","arxiv_id":"2606.02240","paper_version":3,"verdict":"REJECT","confidence":"HIGH","novelty_score":6.0,"correctness_risk":"high","formal_verification":"none","parameter_count":5,"one_line_summary":"A new dynamic red-teaming benchmark and a low-cost tool-response classifier reportedly reduce indirect-prompt-injection attack success in LLM agents, though the reduction is measured counterfactually and the scenario set is closed.","lead":"This paper introduces a benchmark and a detection model for indirect prompt injection in LLM agents that read from enterprise SaaS integrations. It reports that a small classifier can reduce attack success from about 70% to 2.4%, but the reduction is estimated from recorded traces and the headline claims outrun the experiments.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Headline 'online ASR reduction' is unsupported: guarded ASR is counterfactual and post-flag agent behavior is unmodeled (Sec. 5.4), so the 67.5pp/75-77pp prevention claim is not demonstrated.","rationale":"The paper's most valuable contribution is the benchmark and the high detection TPR on held-out integrations; those seem internally consistent and are independent of the concern. The problem is the inference from detection to attack prevention. The headline abstract says 'cuts online attack success by 75-77pp' with '0.0% real-benign' FPR, but Section 5.4's methodology is explicitly counterfactual: it reuses recorded no-guard traces, flags any step, and equates a flag with prevention. That equivalence assumes the agent either stops or proceeds exactly as in the no-guard trace after a block, which is not how tool-calling loops behave: the agent receives a signal and may retry, choose another tool, ask the user, or abandon. Each of these changes both ASR and utility. The paper's own limitation statement confirms this gap and defers end-to-end task-completion under inline guarding to follow-up work. Additionally, the abstract's '0.0% real-benign FPR' is a selected subset (2,500 production hard-negatives); overall FPR is 0.37%, and the abstract's '75-77pp' does not match the Table 1 reduction for GPT-5.4-mini (69.8pp). These discrepancies are secondary but reinforce that the abstract is not a faithful summary of the evidence. The reader's weakest assumption identifies the same counterfactual gap, and I agree. A live re-execution with the guard inline is the single check that would settle whether the claimed online reduction is real; until then the defense claim is unsupported, so the reader's REJECT verdict should stand.","tokens_in":20636,"tokens_out":4870,"duration_ms":47593,"concrete_test":"Run the 215-scenario canonical panel end-to-end with AGENTREDGUARD-MiniLM inline at threshold 0.5 for at least the three models named in the abstract (Haiku, GPT-5.4-mini, Gemini-3-flash), allowing the target agent to observe the flag and continue (retry/alternative plan/abandonment). Compute online ASR inclusive of partials, task-completion rate, and over-refusal rate, and compare with the per-trace counterfactual estimate in Table 1 (e.g., 67.5pp overall, 77.2pp Haiku). If the online ASR reduction differs by more than ~5pp from the counterfactual, or if task completion drops materially, the headline 'online' claim fails.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central defense claim—that AGENTREDGUARD 'cuts online attack success' by 75-77pp—rests on a counterfactual computation, not on measured prevention. In Section 5.4 the guarded ASR is obtained by taking each recorded no-guard trace and asking whether the guard would have flagged any tool-response step; every flagged scenario is counted as prevented. The paper explicitly states: 'counterfactual agent behaviour under blocking (retry, alternative plan, abandonment) is not modelled.' A real agent that receives a block signal may ignore it, retry with a different tool/plan, or abandon the task; any of these changes the actual ASR and utility. The same gap applies to the abstract's '0.0% real-benign' FPR: this is the production-hard-negative subset only; the full benign corpus FPR is 0.37% (Table 7), and inline task-completion/over-refusal is deferred to follow-up work (Section 5.5). Thus the abstract promises online validation that the body does not provide. The detection results (99.75% TPR on cross-integration held-out attacks) are internally consistent and support detection; they do not establish attack prevention without modeling post-flag agent behavior.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper introduces AGENTREDBENCH, a dynamic LLM-driven redteaming benchmark for indirect prompt injection in tool-use agents, spanning 215 underspecified-authorization scenarios across 24 enterprise integrations and five attack types. Attack content is generated per-run by a fixed attacker model (Claude Haiku 4.5) conditioned on integration schemas, and eight frontier target models are evaluated for no-guard ASR (32–81%). The paper also introduces AGENTREDGUARD, a 23M-parameter MiniLM classifier trained on adversarial tool-response content from the same pipeline. The authors report 99.75% TPR at 0.37% FPR on cross-integration held-out attacks, and claim that the guard cuts panel ASR from 69.9% to 2.4% (67.5 percentage points), with cross-integration and cross-attack-type generalization. The Limitations section explicitly states that the guarded ASR is computed counterfactually: a scenario is counted as prevented if the guard would have flagged any tool-response step, and that counterfactual agent behavior under blocking is not modeled.","tokens_in":20992,"tokens_out":4803,"duration_ms":49776,"significance":"If substantiated, the benchmark would be a valuable community resource: per-run dynamic attack generation, broad enterprise-integration coverage, and a lightweight inference-time guard that generalizes to unseen integrations would each be significant contributions. The detection evaluation is comparatively rigorous: TPR/FPR are cleanly defined, bootstrap CIs are reported, the guard's cross-integration and cross-attack-type holdouts are sensible, and the reproducibility manifest and low-latency CPU deployment are concrete strengths. However, the central defense claim — that AGENTREDGUARD cuts *online* attack success — is not measured; it is a counterfactual per-trace projection. Because the abstract and conclusion present this as an established prevention result, the paper substantially overclaims. The cross-attacker generalization stated in the abstract is also absent from the experimental body. The benchmark's absolute ASR numbers are explicitly selection-biased by the Haiku pre-filter. These issues are load-bearing for the paper's headline claims.","major_comments":[{"comment":"The headline claim that AGENTREDGUARD 'cuts online attack success by 75–77pp' and 'cuts panel ASR to 2.4%' is not supported by the reported experiments. Section 5.4 computes guarded ASR per trace: a scenario counts as prevented if the guard would have flagged any tool-response step, with the paper's own statement that 'counterfactual agent behaviour under blocking (retry, alternative plan, abandonment) is not modelled.' A flag does not imply prevention: the agent may ignore the flag, retry with a different tool or plan, abandon the task, or be disrupted on benign-but-flagged responses. The 2.4% number is therefore a flag-coverage projection, not an online ASR. The abstract's use of 'online attack success' and the conclusion's 'cuts panel ASR to 2.4%' are not justified by the body.","section":"§5.4, Table 1; Abstract; Conclusion"},{"comment":"The abstract claims '0.0% real-benign false-positive rate' and '0.2% on a synthetic-benign corpus.' The body's Table 7 reports AGENTREDGUARD-MiniLM FPR as 0.37% on the full 4,807-row benign corpus, with 0% only on the 2,500 production-connector hard-negative subset (Table 5). Moreover, Section 5.5 states that end-to-end task-completion under inline guarding is deferred to follow-up work, so the utility side of the security-utility tradeoff is not measured. The abstract's precision and 'real-benign' framing are therefore misleading relative to the actual evaluation.","section":"Abstract vs. §5.4/§5.5, Table 7"},{"comment":"The absolute ASR values are not population estimates. The 215 scenarios were haiku-pre-filtered to retain only scenarios where Claude Haiku 4.5 produced at least one success/partial during authoring, as the Limitations section acknowledges: 'Absolute ASR ... is therefore an upper bound.' This is appropriate for a relative-ordering benchmark, but the 67.5pp reduction and the 2.4% guarded number are computed on this selected set and should not be read as deployment-relevant rates. There is also an internal inconsistency in the denominator: §5.1 says attacker-side pipeline failures are 'counted as fails,' while Appendix C, Table 4 says such failures are 'Excluded from the ASR denominator.' These choices change reported ASR, especially for Sonnet (14 failures), and must be reconciled.","section":"§5.1/§5.3, Appendix C, Limitations"},{"comment":"The abstract claims 'cross-attacker holdouts (two independent attacker families held out from training) confirm the gain transfers.' No such experiment appears in the body. Section 5.6 reports only cross-integration and cross-attack-type holdouts, and §5.1 fixes the attacker as Claude Haiku 4.5 for all runs. Since the guard is trained on attack rows generated by that same attacker, held-out integrations and attack types still come from the same attacker's output distribution. The claimed transfer to 'two independent attacker families' is therefore unsupported, and the circularity concern is material: the guard's generalization is demonstrated only within one attack-generation pipeline. Either a cross-attacker experiment must be added or the abstract claim removed.","section":"Abstract vs. §5.6/§5.1"}],"minor_comments":[{"comment":"The caption notes that the per-attack-type TPR on the 'full 14,846-row attack corpus includes the training subset.' This is easy to miss; please mark in-sample vs. held-out rows explicitly in the table or title, since Table 7 is the actual held-out result.","section":"Table 2 caption"},{"comment":"Several per-connector cells are based on very small scenario counts (e.g., outlookcalendar n=3). Reporting the per-row n or suppressing unstable cells would avoid over-interpreting single-digit differences.","section":"Table 6"},{"comment":"The 'With AGENTREDGUARD: attack blocked' panel is an illustrative trace, not a measured online blocking run. Label the right panel as illustrative/projected to avoid implying a live prevention experiment.","section":"Figure 2"},{"comment":"The abstract reports '0.2% on a synthetic-benign corpus,' but the full benign corpus FPR in Table 7 is 0.37%. The relationship between the 'synthetic-benign corpus' and the full/structural benign corpus is unclear; please define consistently.","section":"Abstract"}],"recommendation":"reject","confidential_remarks":"The benchmark itself and the detection results may be a useful contribution to the agent-security community, and the dynamic-attacker methodology is a worthwhile direction. However, the paper's central prevention claim is counterfactual, the abstract asserts experiments that do not appear in the body (cross-attacker holdouts), and the ASR denominator is internally inconsistent. These are not local presentation issues; they require new experiments or a fundamental reframing of the claims. I cannot recommend acceptance in the current form."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Short version: the benchmark is a real contribution and the detection experiments are cleanly done, but the paper's headline defense claim is not supported by the experiments as run. The abstract says the guard 'cuts online attack success by 75-77pp' at '0.0% real-benign false-positive rate' and confirms 'cross-attacker holdouts.' The body does not support those statements. The ASR reduction is a per-trace counterfactual: they take each recorded trace, ask whether the guard would have flagged any tool-response step, and count flagged scenarios as prevented. They say so plainly in Section 5.4: 'counterfactual agent behaviour under blocking (retry, alternative plan, abandonment) is not modelled.' A real agent that retries, switches tools, or abandons after a block could have materially different ASR. The 0.0% FPR is only on the production hard-negative subset; the full benign corpus FPR is 0.37% (Table 7). I also don't see a cross-attacker holdout anywhere in the body — the holdouts are cross-integration and cross-attack-type. The Haiku pre-filtering is acknowledged, and absolute ASR is an upper bound; that's fine as long as the claims stay relative.\n\nCredit where it's due: the benchmark itself is useful. 215 scenarios, 24 integrations, a dynamic attacker with retry, a five-type underspecified-authorization taxonomy, 49 chained scenarios. The guard is a modest 23M classifier on tool-response content, and the detection evaluation is done well: bootstrap CIs, held-out integrations, held-out attack types. The 99.75% TPR at 0.37% FPR on the cross-integration split is internally consistent and convincing as detection. Training on tool-response rather than chat data is the right move, and the comparison against Llama Guard, PromptGuard 2, and ProtectAI makes the distribution-shift point effectively.\n\nThe soft spots are concentrated in the leap from detection to prevention. The authors are honest in the limitations section, which I appreciate, but the abstract overstates. The circularity concern — the guard is trained on the same pipeline's attack rows — is mitigated by the held-out axes, but the attacker is always Claude Haiku 4.5, so cross-attacker generalization is untested despite the abstract's claim.\n\nWho should read it: anyone working on agent security or tool-response guards. It's a good benchmark paper in disguise, and the detection results deserve a serious referee. My recommendation: send it to peer review, but insist the authors fix the abstract/body gap and either run a true online evaluation or stop calling the counterfactual numbers 'online.'","headline":"The benchmark and detection numbers are worth your time; the headline ASR-reduction claim is counterfactual and the abstract overpromises.","tokens_in":21456,"tokens_out":2744,"would_cite":true,"duration_ms":27940,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"The paper argues that indirect prompt injection in tool-use agents is severe and under-measured, and that a small integration-aware classifier can cut attack success from roughly 70% to 2% at near-zero false positives.","keywords":["indirect prompt injection","LLM agents","tool-use agents","red teaming benchmark","SaaS integrations","safety classifier","attack success rate","defense evaluation"],"falsifier":"Run the guard inline in a live tool-use agent over the same 215 scenarios (or a random sample from the 1,731-scenario pool) and measure actual end-to-end attack success and task completion under blocking. If the realized ASR reduction is materially below 67.5 points — because blocked agents retry with alternative tools, or because flagged-but-benign responses cause failures — the counterfactual headline fails. A cheaper check: re-run the guard against an attacker given black-box access to the guard and the explicit goal of evading it, and observe whether TPR at 0.37% FPR holds.","tokens_in":20538,"feed_emoji":"🛡️","tokens_out":4524,"duration_ms":42892,"temperature":0.7,"pith_summary":"This paper tries to establish that LLM agents which read from third-party integrations — email, calendars, CRMs, wikis — are routinely exploitable through indirect prompt injection, where an attacker writes content into an integration the agent later reads, and that existing benchmarks badly underestimate the problem. To show this, it introduces AGENTREDBENCH, a dynamic red-teaming benchmark of 215 subtle 'underspecified authorization' attacks across 24 enterprise integrations, with attack payloads freshly generated per run rather than replayed from templates. On eight frontier models, unguarded attack success ranges from 32% to 81%. The paper also presents AGENTREDGUARD, a 23M-parameter classifier that inspects tool-response content before the agent does; it reports cutting panel attack success from 69.9% to 2.4% at 0.37% false positives and 9.5 ms median CPU latency, with transfer to integrations and attack types held out from training. If correct, a cheap inference-time guard sitting in the tool-response layer can defuse most of the read–write gap that makes agents dangerous.","feed_headline":"Small CPU guard cuts agent attack success from 70% to 2.4%","feed_subtitle":"A 23M-parameter classifier that reads tool responses blocks most indirect prompt injections across 24 SaaS integrations.","key_machinery":"The load-bearing object is AGENTREDGUARD-MiniLM, a 23M-parameter finetuned text classifier that intercepts each tool-call response before the agent reads it, scores it for attack content, and blocks it above a calibrated threshold. Its training corpus pairs 14,846 attack-containing tool-response rows from benchmark traces with a 4,807-row production-shape benign corpus, with four integrations and three attack types held out for generalization tests. The defense is evaluated through the benchmark's four-component pipeline — a dynamic attacker agent, an orchestrator that stages payloads into mock integration state, a target agent running its tool-calling loop, and an LLM judge — which gives ev","core_discovery":"The central claim is that the tool-response layer of the agent loop is both the attack surface and the best place to defend it. The authors show that subtle attacks at the boundary of what a user's request authorizes — embedding attacker URLs in replies, substituting the destination of a write, or substituting the body of a write — succeed on 32–81% of frontier models with no guard, while bound-delegation patterns that violate explicit user instructions are already held in check by alignment. They then train a small text classifier on adversarial tool-response content and report that it flags 99.75% of held-out attacks at 0.37% false-positive rate, reducing overall panel attack success rate","pith_inferences":["The counterfactual ASR reduction is an upper bound: a real agent whose tool call is blocked may retry with a different tool, replan, or abandon the task, and the paper does not model those trajectories; online task-completion measurement is deferred to follow-up work.","Because the guard is described as learning repeated surface markers (audit-log phrasing, vendor-of-record domains, URL wrappers), an adaptive attacker that strips or varies those signatures could plausibly erode its 99.75% TPR; the paper does not test against an attacker that optimizes against the guard.","The sharp contrast between high no-guard ASR on active attack types and 0–2% on bound-delegation types suggests a cleaner policy split: enforce explicit user bounds through instruction hierarchy or rules, and spend classifier budget on underspecified-authorization attacks.","The haiku-pre-filtered scenario selection means absolute ASR is an upper bound; the load-bearing claim is relative ordering across models, and that ordering would likely survive a random scenario sample, although such a sample is not reported."],"forward_implications":["If the results hold, production agents can be defended at inference time with a CPU-friendly classifier rather than large LLM guards or enumerated rule engines.","The benchmark's dynamic attacker — fresh payloads per run generated against integration schemas — prevents template replay and keeps attack-success numbers from becoming memorization scores.","The 32–81% unguarded range and the large within-provider spread imply alignment training, not model scale, is the main driver of resistance to subtle injection, making alignment a complement to, not a substitute for, inference-time defense.","Transfer to held-out integrations and held-out attack types implies a guard trained on one set of SaaS surfaces may deploy to new ones without retraining on them."],"fun_headline_variants":["23M-param guard cuts agent attacks to 2.4%","Tool-response reader blocks 99.75% of injections","Small model defends SaaS agents from prompt injection","Dynamic redteaming: 215 scenarios, 23M-param defense","AgentRedGuard: 0% benign FPR, 99% attack detection"],"cache_read_input_tokens":2304,"weakest_assumption_plain":"The headline 67.5-point ASR reduction is computed counterfactually from recorded traces — a scenario counts as prevented if the guard would have flagged any tool-response step — and the paper does not model how a real agent would behave after a block; if blocked agents retry or replan, or if the guard blocks benign responses, the true online reduction could differ materially.","fun_headline_variants_meta":{"raw":{"variants":["23M-param guard cuts agent attacks to 2.4%","Tool-response reader blocks 99.75% of injections","Small model defends SaaS agents from prompt injection","Dynamic redteaming: 215 scenarios, 23M-param defense","AgentRedGuard: 0% benign FPR, 99% attack detection"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000453,"raw_usage":{"total_tokens":2164,"prompt_tokens":838,"completion_tokens":1326,"prompt_tokens_details":{"cached_tokens":256},"prompt_cache_hit_tokens":256,"prompt_cache_miss_tokens":582,"completion_tokens_details":{"reasoning_tokens":1236}},"tokens_in":582,"tokens_out":1326,"duration_ms":11816,"temperature":1.0,"reasoning_tokens":1236,"cache_read_input_tokens":256,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-02T12:32:21.970458+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run the guard inline in a live tool-use agent over the same 215 scenarios (or a random sample from the 1,731-scenario pool) and measure actual end-to-end attack success and task completion under blocking. If the realized ASR reduction is materially below 67.5 points — because blocked agents retry with alternative tools, or because flagged-but-benign responses cause failures — the counterfactual headline fails. A cheaper check: re-run the guard against an attacker given black-box access to the guard and the explicit goal of evading it, and observe whether TPR at 0.37% FPR holds.","supporting_citations":[],"review_version":2}