Pith. sign in

REVIEW 4 major objections 6 minor 36 references

PlanFlip shows that a single planning-phase injection can corrupt every downstream sub-task of a multi-agent LLM system at once, and that when the planner and critic share the same backbone, the critic is biased into approving the corrupted

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · deepseek-v4-flash

2026-08-02 15:10 UTC pith:TZO2F7BP

load-bearing objection Real planning-phase taxonomy and a genuine blind-spot observation, but the headline claim rests on an inverted metric and the defense evaluation contradicts itself. the 4 major comments →

arxiv 2607.16199 v1 pith:TZO2F7BP submitted 2026-04-30 cs.AI

PlanFlip: Attacking Multi-Agent LLM Systems via Planning-Phase Prompt Injection

Yuhang Wang This is my paper
classification cs.AI
keywords prompt injectionmulti-agent LLM systemsplanning phasecascade amplificationcorrelated-agent blind spotmodel diversityplan verificationLLM security
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

Multi-agent LLM systems entrust a Planner with turning a goal into a sequence of sub-tasks. This paper argues that a single context entry—disguised as a tool output or retrieved document—can redirect that entire sequence before execution, corrupting every downstream step at once. Across nine frontier models and roughly 3,500 episodes, the authors find three vulnerability profiles: stronger instruction-following models are more easily hijacked (the strongest model tested had the highest attack success rate); homogeneous pipelines, where the same model both plans and critiques, exhibit a correlated-agent blind spot in which the critic approves plans that independent judges find significantly off-goal; and reasoning-augmented models neutralize all four attack types. The paper concludes that heterogeneous model diversity is a security prerequisite, and proposes two defenses that reach detection rates up to 1.00.

Core claim

The paper's central claim is that the planning phase is a single point of failure with cascade amplification: a single injection into the planner's context, before any tool call, can change all n sub-tasks at once, where a step-level injection reaches at most 1/n of the plan. It defines four template attacks—goal substitution, priority inversion, context pollution, and role confusion—that contain no keyword triggers and so pass surface filters. Its second claim is the correlated-agent blind spot: when the critic shares the same backbone model as the planner, the injection biases both simultaneously, so the critic reports 'aligned' on plans that are structurally and semantically altered. The

What carries the argument

The machinery that carries the argument is the decomposition of plan generation into π = P(g, x): a goal and context produce the plan, so an adversary who cannot change g can still corrupt π by injecting into x. The correlated-agent blind spot is formalized by asserting that a shared parameter vector θ shifts the conditional distributions of planner and critic together, so the same-backbone critic cannot detect deviations a different-backbone critic would flag. The cascade amplification factor κ measures the fraction of sub-tasks changed, giving planning-phase attacks κ = 1 versus κ ≤ 1/n for tool-call injections. The metrics ASR, Stealth, and StepShift then partition models into overt, blin

Load-bearing premise

The load-bearing premise is that sharing a backbone model forces the critic to share the planner's injection-induced bias, making the blind spot a structural property of identical parameters; the paper asserts this without proof, and its own results on the strongest model are a counter-example in which the same-backbone critic detects most attacks.

What would settle it

Run the four PlanFlip injections on a homogeneous pipeline while varying only the critic's verification prompt (for example, asking it to check each sub-task against the original goal), with a genuinely independent judge from a different model family scoring the same episodes. If the same-backbone critic then flags the deviations, or if the independent judge's scores change materially when the 'independent' judge is swapped for a same-family model, the blind spot is prompt- or judge-dependent rather than a structural property of shared parameters.

Watch this falsifier — get emailed when new claim-graph text bears on it.

If this is right

  • A one-line injection can corrupt the entire sub-task plan, so defenses must check the plan itself before execution rather than filtering tool calls or outputs.
  • Homogeneous self-audit provides no security: in two models the same-backbone critic approved every attacked plan while independent judges measured a real 0.20–0.32 drop in goal alignment.
  • Capability amplifies vulnerability: the strongest model tested had the highest attack success rate (0.68), so model upgrades alone do not narrow the attack surface.
  • Goal-anchored sub-task checks plus a cross-family reference planner detected attacks up to rate 1.00, outperforming same-backbone baselines in 15 of 16 comparison cells.
  • Reasoning-augmented planning (explicit justification before output) eliminated all four injections in the tested setup, pointing to a built-in resistance mechanism.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • The paper treats the blind spot as structural, but its own results on the strongest model show the same-backbone critic detecting most attacks; a direct test varying only the critic's prompt would show whether the blind spot is inherent to shared parameters or partly prompt-dependent.
  • The cascade mechanism should transfer beyond the four scenarios tested: any decomposed pipeline—code generation, API orchestration, multi-step research—is a candidate target for similar planning-phase injections.
  • A cheap mitigation follows from the paper's scenario analysis: abstract goals were the most vulnerable, so decomposing goals into concrete sub-goal specifications before planning should shrink the attack surface.
  • Benchmarks for agent security should report verification by at least one cross-family judge, since same-backbone self-scores can be systematically inflated in homogeneous deployments.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

4 major / 6 minor

Summary. The paper introduces PlanFlip, a family of four planning-phase prompt-injection attacks (GoalSubstitution, PriorityInversion, ContextPollution, RoleConfusion) against multi-agent LLM pipelines, and evaluates them on nine frontier LLMs over 3,479 episodes. It claims three main findings: (1) 'capability amplifies vulnerability,' with GPT-5 showing the highest ASR; (2) homogeneous pipelines exhibit a 'correlated-agent blind spot' in which the same-backbone Critic approves structurally corrupted plans; and (3) reasoning-augmented DeepSeek-R1 fully resists the attacks. It also proposes two defenses, GoalAnchorCheck (D1) and CrossAgentConsensus (D2), reporting high detection rates and arguing that heterogeneous backbone diversity is a security prerequisite.

Significance. If the findings were valid, the paper would make an important contribution to the security of LLM-based multi-agent systems, and the attack taxonomy, prompt templates, and comparatively large-scale evaluation (with Wilson and bootstrap CIs) would be valuable resources for the community. The paper's strengths include a clearly specified threat model, concrete injection templates in Appendix F, and a defense evaluation with baselines. However, the central claims as written rest on an inverted metric, an unproven structural assertion, and a compromised independence check; these are not local issues but affect the paper's main conclusions.

major comments (4)
  1. [§3.3, Eq. (3); Abstract; §4.2 Finding 1] ASR is defined as ASR = P[v∈{drifted,unsafe}], i.e., the probability that the same-backbone Critic flags the attacked plan. This is a detection rate, not an attack success rate. The paper then uses GPT-5's high ASR (0.68) to claim 'capability amplifies vulnerability.' The data show the opposite: GPT-5's Critic detects most attacks (Stealth 0.10–0.60 in Table 1). A correct reading of the metrics is that GPT-5's Critic is comparatively effective, not that GPT-5 is especially vulnerable. Since Eq. (7) and the vulnerability profiles also key off this ASR, Finding 1 and the profile labels ('overt', 'blind-spot') are not supported as stated.
  2. [§3.1, Definition 2 and Eq. (2)] The 'correlated-agent blind spot' is presented as a structural consequence of shared backbone θ. But Eq. (2) merely asserts that for an injection that already induces a blind spot, the expected verdicts of θ and θ′ differ; it does not prove that sharing θ causes the blind spot. The paper's own GPT-5 results contradict the necessity claim: GPT-5 is a homogeneous pipeline, yet its same-backbone Critic detects a majority of attacks. The observed GPT-4o and Llama-3.3-70B behavior could instead reflect Critic prompt design (e.g., not comparing against the original goal) or model-specific instruction-following. Moreover, the NeurIPS-style checklist in the appendix states the paper 'does not contain formal theorems or proofs,' which conflicts with the 'formal characterisation' claimed in Section 3.1. This is load-bearing because the paper's key insight — that homogeneous pipelines are structura
  3. [§4.2.2, Independent Semantic Validation; Table 3] The validation of the blind spot uses J2 = Llama-3.3-70B as an 'independent' judge for Llama-3.3-70B episodes. This judge shares the backbone of the attacked pipeline, so it is not independent for those episodes. The inter-judge agreement r=0.943 may partly reflect the same model evaluating itself consistently, rather than a robust cross-model signal. The paper should use judges from model families disjoint from every attacked pipeline (e.g., DeepSeek-V3.1 and Qwen-Plus for both blind-spot models), report per-model agreement, and justify that the two judges are heterogeneous with respect to each attacked backbone.
  4. [Appendix H, Tables 6–14; Eq. (6)] The benign rows in the per-scenario tables report StepShift values well above 0: e.g., o1 finance_report benign StepShift = 0.54, GPT-5 travel_plan benign StepShift = 0.41, Grok-3 code_assist benign StepShift = 0.27. Under the definition in Eq. (6), StepShift compares the benign plan π* to the attacked plan π̂; in the benign condition π̂ = π*, so the edit-distance measure must be exactly 0. The non-zero benign StepShift indicates that the metric is not computed as defined, or that the 'benign' condition differs from the definition. This undermines the use of StepShift > 0 to establish that blind-spot attacks genuinely restructure plans, which is central to distinguishing the blind-spot profile from genuine resistance.
minor comments (6)
  1. [§3.3, Eq. (7)] The thresholds τ_a = τ_s = 0.5 are presented without sensitivity analysis. Given the ASR definition issue, the vulnerability-profile assignments would change materially under a corrected metric; a robustness check over thresholds would be helpful.
  2. [§4.2.3 vs. Appendix G, D1] Section 4.2.3 describes D1 as 'keyword anchoring,' but Appendix G says D1 computes semantic similarity using an LLM call. Please unify the description and specify whether the threshold τ1=0.4 applies to similarity or to a keyword match.
  3. [Appendix G, D2] The reference planner for D2 is described only as 'e.g., Qwen-Plus as verifier for GPT-4o pipelines and vice versa.' The exact reference model used for each attacked pipeline is not specified, which is necessary for reproducibility of the reported D2 detection rates.
  4. [§4.2.2] The paper reports 'all 200 blind-spot episodes' scored by two judges, but does not give the per-model breakdown (e.g., 100 GPT-4o + 100 Llama-3.3-70B, or another split). Please report n per model and per condition.
  5. [Table 1 and Figure 2] The arrow notation 'ASR↑' is ambiguous once ASR is recognized as a detection rate. Consider renaming the metric (e.g., 'Critic Detection Rate') or redefining it as the actual attack success probability, and adjusting all figures and text accordingly.
  6. [Checklist, item 3] The checklist states 'This paper is empirical; it does not contain formal theorems or proofs,' yet Section 3.1 labels Eq. (2) as a 'formal characterisation.' This inconsistency should be resolved — either provide a proof or weaken the claim.

Circularity Check

4 steps flagged

ASR is defined by the same-backbone Critic's verdict, so 'capability amplifies vulnerability' and the A1/A3 ablation 'confirming' the blind spot are partly tautological; moreover, J2 is the same backbone as the Llama-3.3-70B pipeline it is used to validate.

specific steps
  1. self definitional [Section 4.3, Ablation Study (A1 vs A3)]
    "The correlated blind spot is robust to defense configuration. GPT-4o yields ASR = 0.04, Stealth = 0.96 under both A1 and A3, confirming the blind spot is a structural property of backbone θ, not a defense gap."

    ASR (Eq. 3) and Stealth (Eq. 5) are defined exclusively from the same-backbone Critic verdict v = Cθ(g, π̂, Eθ(π̂)). The defenses D1/D2 added in A1 vs A3 are separate post-hoc detectors that do not enter v. Therefore ASR and Stealth are definitionally invariant across A1 and A3 regardless of whether the blind spot is structural. The passage presents this invariance as empirical confirmation of a structural property of θ, but the comparison cannot test that property; it only reflects that the metric was defined on the unchanged Critic component.

  2. self definitional [Section 4.2 Finding 2; Section 3.3 Eqs. (3),(5)]
    "GPT-4o and Llama-3.3-70B show ASR≈0 yet Stealth=1.00: attacks silently restructure plans while the same-backbone Critic reports alignment."

    With verdict space {aligned, drifted, unsafe}, Stealth = P[v=aligned|A] = 1 - P[v∈{drifted,unsafe}|A] = 1 - ASR on attacked episodes. So 'ASR≈0 yet Stealth=1.00' is not an independent empirical conjunction; it is a definitional complement of the same Critic verdict. The blind-spot profile in Eq. 7 therefore inherits this tautology. The non-circular evidence for plan corruption is StepShift and the external judges; the 'yet' framing overstates what the two metrics jointly establish.

  3. other [Section 4.2.2 Independent Semantic Validation]
    "we score all 200 GPT-4o and Llama-3.3-70B blind-spot episodes with two independent heterogeneous judges (J1: DeepSeek-V3.1, J2: Llama-3.3-70B), neither sharing a backbone with the attacked pipelines."

    For Llama-3.3-70B episodes, J2 is the same model as the attacked pipeline's backbone, so it is not a heterogeneous judge and the sentence 'neither sharing a backbone with the attacked pipelines' is false. The claimed independent validation for the Llama-3.3-70B blind spot therefore partly reduces to same-backbone self-evaluation; the reported inter-judge r=0.943 for those episodes may reflect the same model's self-consistency rather than an independent signal. J1 remains a genuine hetero judge, so this is partial, not total, circularity.

  4. self definitional [Section 4.2 Finding 1; Section 3.3 Eq. (3)]
    "GPT-5 achieves the highest attack success rate (ASR = 0.68): stronger instruction-following makes a model more susceptible to well-crafted injections, not less."

    ASR is defined as P[v∈{drifted,unsafe}] with v produced by the same-backbone Critic (Eq. 3). Under the paper's own adversary model (Eq. 1), a Critic flag means the attack fails; high ASR therefore measures Critic strictness as much as Planner susceptibility. Ranking GPT-5 as 'most vulnerable' from ASR is thus partly an artifact of metric definition: a stricter Critic inflates ASR regardless of Planner compliance, and the A2 ablation (no Critic) produces ASR=1.00 for every model, showing the metric is dominated by Critic presence. StepShift provides some independent evidence of plan deviation, but the stated causal claim about instruction-following is not isolated by the experiments.

full rationale

The paper is not wholly circular. Cascade amplification (Definition 1) is a direct consequence of planning-phase injection, and StepShift is a Critic-independent measure of structural plan change; DeepSeek-R1's StepShift=0.00 is an external, non-tautological observation. The defense results (D1/D2) are also empirical and not derived from the paper's own assumptions. However, several load-bearing steps do reduce to definitions or violated independence assumptions. First, the A1/A3 ablation 'confirming' that the blind spot is structural is tautological because ASR and Stealth are defined solely by the same-backbone Critic, which is unchanged by D1/D2. Second, the 'ASR≈0 yet Stealth=1.00' framing is a definitional complement, not an independent discovery. Third, the 'independent heterogeneous' validation for Llama-3.3-70B uses Llama-3.3-70B itself as one judge, so the claimed independence is false for those episodes. Fourth, the 'capability amplifies vulnerability' finding interprets a Critic-detection rate as Planner susceptibility, which conflates attacker success with defender detection. These issues do not erase the StepShift-based evidence of plan corruption or the genuinely heterogeneous J1 judge, but they make the headline claims substantially less independent than presented. No self-citation chain or imported uniqueness theorem is load-bearing here.

Axiom & Free-Parameter Ledger

3 free parameters · 4 axioms · 1 invented entities

The central claims rest on: hand-chosen thresholds for defenses and profile classification; the unproven assertion that shared backbone necessarily implies shared bias; the reliability of LLM-as-judge for validation; and the representativeness of four synthetic scenarios. The most fragile is the Eq. (2) assertion, which is contradicted by the paper's own GPT-5 data and is the foundation for the 'correlated-agent blind spot' and for D2's design.

free parameters (3)
  • τ1 (GoalAnchorCheck similarity threshold) = 0.4
    Hand-chosen threshold for D1; no sensitivity analysis provided.
  • τ2 (CrossAgentConsensus edit-distance threshold) = 0.4
    Hand-chosen threshold for D2; no sensitivity analysis or benign false-positive baseline.
  • τ_a, τ_s (vulnerability-profile thresholds for ASR and Stealth) = 0.5, 0.5
    Used to classify models into overt/blind-spot/resistant profiles; chosen by hand.
axioms (4)
  • ad hoc to paper Same-backbone Critic shares the Planner's distributional bias (Eq. 2)
    The paper asserts Eθ[Cθ|π̂] ≠ Eθ′[Cθ′|π̂] for θ′ ≠ θ without rigorous proof; this is the basis for the correlated-agent blind spot. It is contradicted by the paper's own GPT-5 results, where the same-backbone Critic detects most attacks.
  • domain assumption LLM-as-judge provides reliable alignment scores in benign settings
    Used to compute GDS and to validate blind-spot deviations via judges; prior work (Zheng et al. 2023) is cited, but Stureborg et al. 2024 (also cited) shows same-backbone judges are unreliable even without adversarial pressure.
  • domain assumption Heterogeneous reference planner produces comparable plans for the same goal (D2)
    D2's detection relies on edit distance between reference and attacked plans; if different models naturally produce different valid plans, the threshold will flag benign plans as attacked. No benign-plan baseline is reported.
  • domain assumption The four scenarios (finance_report, medical_info, code_assist, travel_plan) are representative of real agent tasks
    The generalization of vulnerability profiles to production multi-agent pipelines depends on this representativeness; the paper itself notes task concreteness affects ASR, but only four synthetic scenarios are used.
invented entities (1)
  • Correlated-agent blind spot independent evidence
    purpose: Explains why homogeneous pipelines fail to detect planning-phase injections: the Critic shares the Planner's backbone and is simultaneously biased by the same injection.
    The paper attempts empirical validation via StepShift and independent judges, though the J2 same-backbone issue weakens the evidence for Llama-3.3-70B. It makes a falsifiable prediction (heterogeneous critics should detect deviations) and is therefore not a purely ad hoc construct.

pith-pipeline@v1.3.0-alltime-deepseek · 27372 in / 18210 out tokens · 163525 ms · 2026-08-02T15:10:32.917636+00:00 · methodology

0 comments
read the original abstract

Multi-agent LLM systems increasingly rely on a Planner to decompose goals into sub-task sequences that downstream Executor and Critic agents execute and audit. We identify the planning phase as a critical attack surface: a single injection into the Planner's context achieves cascade amplification, corrupting all downstream sub-tasks simultaneously. We introduce PlanFlip, a framework comprising four planning-phase prompt injection attacks -- GoalSubstitution (PF-1), PriorityInversion (PF-2), ContextPollution (PF-3), and RoleConfusion (PF-4) -- each disguised as plausible tool outputs to evade keyword filters. Evaluating nine frontier LLMs across 3,479 episodes, we uncover three findings: (1) capability amplifies vulnerability -- GPT-5 achieves the highest attack success rate (ASR = 0.68), contradicting the assumption that stronger models are inherently more secure; (2) homogeneous pipelines exhibit a correlated-agent blind spot -- GPT-4o and Llama-3.3-70B show ASR near 0 yet Stealth = 1.00 and StepShift > 0, with attacks restructuring plans while the same-backbone Critic reports alignment (two independent judges confirm -0.20 to -0.32 semantic deviation, r = 0.943); (3) reasoning-augmented models resist injections -- DeepSeek-R1 achieves StepShift = 0.00 across all attacks. We propose GoalAnchorCheck (D1) and CrossAgentConsensus (D2), achieving detection rates up to 1.00 and outperforming same-backbone baselines in 15 of 16 cells. Our key insight: heterogeneous model diversity is a security prerequisite for multi-agent systems; redundancy within a homogeneous backbone provides no protection against planning-phase attacks.

Figures

Figures reproduced from arXiv: 2607.16199 by Yuhang Wang.

Figure 1
Figure 1. Figure 1: The PlanFlip threat model and defenses. A Planner–Executor–Critic pipeline shares a single backbone θ (blue band). An adversary appends injection ϵ to the Planner’s context (red dashed arrow), disguised as a plausible tool output or retrieved document. The corrupted plan π propagates to all downstream sub-tasks (cascade amplification, orange). Because Pθ and Cθ share θ, ϵ simultaneously biases both—the cor… view at source ↗
Figure 2
Figure 2. Figure 2: ASR vs. Stealth per model for each attack type. Each point is one model; colour and [PITH_FULL_IMAGE:figures/full_fig_p007_2.png] view at source ↗
Figure 3
Figure 3. Figure 3: Semantic alignment scores (0=off-goal, 1=aligned) for benign and attacked+Critic=aligned [PITH_FULL_IMAGE:figures/full_fig_p008_3.png] view at source ↗
Figure 4
Figure 4. Figure 4: Detection rates (DR) of D1, D2, and Either (D1 [PITH_FULL_IMAGE:figures/full_fig_p008_4.png] view at source ↗
Figure 5
Figure 5. Figure 5: Ablation: ASR and Stealth across three system configurations. A2 (no Critic) yields [PITH_FULL_IMAGE:figures/full_fig_p014_5.png] view at source ↗
Figure 6
Figure 6. Figure 6: ASR (large number) and StepShift (small grey, “ss=”) per model and attack type. Cell colour [PITH_FULL_IMAGE:figures/full_fig_p014_6.png] view at source ↗
Figure 7
Figure 7. Figure 7: Detection rates of baselines (B1–B3) vs. D1+D2 across four vulnerability profiles. B1 fails [PITH_FULL_IMAGE:figures/full_fig_p017_7.png] view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

36 extracted references · 6 linked inside Pith

  1. [1]

    Journal of the American Statistical Association , volume =

    Probable Inference, the Law of Succession, and Statistical Inference , author =. Journal of the American Statistical Association , volume =. 1927 , doi =

    1927

  2. [2]

    2023 , url =

    Yao, Shunyu and Zhao, Jeffrey and Yu, Dian and Du, Nan and Shafran, Izhak and Narasimhan, Karthik and Cao, Yuan , booktitle =. 2023 , url =

    2023

  3. [3]

    2023 , url =

    Wu, Qingyun and Bansal, Gagan and Zhang, Jieyu and Wu, Yiran and Zhang, Shaokun and Zhu, Erkang and Li, Beibin and Jiang, Li and Zhang, Xiaoyun and Wang, Chi , booktitle =. 2023 , url =

    2023

  4. [4]

    NeurIPS 2022 Workshop on Machine Learning Safety , year =

    Perez, Fabi. NeurIPS 2022 Workshop on Machine Learning Safety , year =

    2022

  5. [5]

    2024 , url =

    Zhan, Qiusi and Liang, Zhixiang and Ying, Zifan and Kang, Daniel , booktitle =. 2024 , url =

    2024

  6. [6]

    2024 , url =

    Debenedetti, Edoardo and Zhang, Jie and Balunovic, Mislav and Beurer-Kellner, Luca and Fischer, Marc and Vechev, Martin , booktitle =. 2024 , url =

    2024

  7. [7]

    Prompt Injection Attacks and Defenses in

    Liu, Yupei and Jia, Yuqi and Geng, Runpeng and Jia, Jinyuan and Gong, Neil Zhenqiang , booktitle =. Prompt Injection Attacks and Defenses in. 2023 , url =

    2023

  8. [8]

    2024 , url =

    Chen, Zhaorun and Guo, Zhen and Xiao, Chaowei and Li, Bo and Zhao, Ruoxi , booktitle =. 2024 , url =

    2024

  9. [9]

    2024 , url =

    Wang, Yifei and Xue, Dizhan and Zhang, Shengjie and Qing, Shengsheng , booktitle =. 2024 , url =

    2024

  10. [10]

    Attacking

    Greshake, Kai and Abdelnabi, Sahar and Mishra, Shailesh and Endres, Christoph and Holz, Thorsten and Fritz, Mario , booktitle =. Attacking. 2023 , url =

    2023

  11. [11]

    2024 , url =

    Zeng, Mintong and Jia, Jinyuan and Liu, Yupei and Chen, Yuanshun and Gong, Neil Zhenqiang and Li, Bo , booktitle =. 2024 , url =

    2024

  12. [12]

    2024 , url =

    Andriushchenko, Maksym and Souly, Alexandra and Bhatt, Mrinank and Sherburn, Max and Winsor, Eric and Bhargava, Yarin and Gal, Yarin and Kolter, Zico and Bhatt, Mantas and Casper, Stephen and others , booktitle =. 2024 , url =

    2024

  13. [13]

    Chen, Weize and Su, Yusheng and Zuo, Jingwei and Yang, Cheng and Yuan, Chenfei and Qian, Chen and Chan, Chi-Min and Qin, Yujia and Lu, Yaxi and Xie, Ruobing and others , booktitle =. Scaling. 2024 , url =

    2024

  14. [14]

    2024 , url =

    Hua, Wenyue and Yang, Xianjun and Jin, Mingyu and Li, Zelong and Cheng, Wei and Tang, Ruixiang and Zhang, Yongfeng , booktitle =. 2024 , url =

    2024

  15. [15]

    2024 , url =

    Zeng, Mintong and Zhang, Ding and Guo, Weijie and Jia, Jinyuan and Li, Bo , booktitle =. 2024 , url =

    2024

  16. [16]

    arXiv preprint arXiv:2310.08419 , year =

    Jailbreaking Black Box Large Language Models in Twenty Queries , author =. arXiv preprint arXiv:2310.08419 , year =

    Pith/arXiv arXiv

  17. [17]

    arXiv preprint arXiv:2307.15043 , year =

    Universal and Transferable Adversarial Attacks on Aligned Language Models , author =. arXiv preprint arXiv:2307.15043 , year =

    Pith/arXiv arXiv

  18. [18]

    2024 , url =

    Mazeika, Mantas and Phan, Long and Yin, Xuwang and Zou, Andy and Wang, Zifan and Mu, Norman and Sakhaee, Elham and Li, Nathaniel and Basart, Steven and Li, Bo and others , booktitle =. 2024 , url =

    2024

  19. [19]

    Constitutional

    Bai, Yuntao and Jones, Andy and Ndousse, Kamal and Askell, Amanda and Chen, Anna and DasSarma, Nova and Drain, Dawn and Fort, Stanislav and Ganguli, Deep and Henighan, Tom and others , booktitle =. Constitutional. 2022 , url =

    2022

  20. [20]

    Advances in Neural Information Processing Systems , volume =

    Training Language Models to Follow Instructions with Human Feedback , author =. Advances in Neural Information Processing Systems , volume =. 2022 , url =

    2022

  21. [21]

    Advances in Neural Information Processing Systems , volume =

    Self-Refine: Iterative Refinement with Self-Feedback , author =. Advances in Neural Information Processing Systems , volume =. 2023 , url =

    2023

  22. [22]

    and others , booktitle =

    Zheng, Lianmin and Chiang, Wei-Lin and Sheng, Ying and Zhuang, Siyuan and Wu, Zhanghao and Zhuang, Yonghao and Lin, Zi and Li, Zhuohan and Li, Dacheng and Xing, Eric P. and others , booktitle =. Judging. 2023 , url =

    2023

  23. [23]

    Advances in Neural Information Processing Systems , volume =

    Tree of Thoughts: Deliberate Problem Solving with Large Language Models , author =. Advances in Neural Information Processing Systems , volume =. 2023 , url =

    2023

  24. [24]

    Proceedings of the Annual Meeting of the Association for Computational Linguistics , year =

    Plan-and-Solve Prompting: Improving Zero-Shot Chain-of-Thought Reasoning by Large Language Models , author =. Proceedings of the Annual Meeting of the Association for Computational Linguistics , year =

  25. [25]

    Advances in Neural Information Processing Systems , volume =

    Reflexion: Language Agents with Verbal Reinforcement Learning , author =. Advances in Neural Information Processing Systems , volume =. 2023 , url =

    2023

  26. [26]

    Compromising

    Tan, Tong and Zhao, Zichuan and Jiang, Minlie , booktitle =. Compromising. 2024 , url =

    2024

  27. [27]

    2024 , url =

    Hong, Sirui and Zhuge, Mingchen and Chen, Jonathan and Zheng, Xiawu and Cheng, Yuheng and Zhang, Ceyao and Wang, Jinlin and Wang, Zili and Yau, Steven Ka Shing and Lin, Zijuan and others , booktitle =. 2024 , url =

    2024

  28. [28]

    Frontiers of Computer Science , year =

    A Survey on Large Language Model based Autonomous Agents , author =. Frontiers of Computer Science , year =

  29. [29]

    arXiv preprint arXiv:2309.07864 , year =

    The Rise and Potential of Large Language Model Based Agents: A Survey , author =. arXiv preprint arXiv:2309.07864 , year =

    Pith/arXiv arXiv

  30. [30]

    Prompt Infection:

    Lee, Donghyun and Oh, Mo Tae Kim , booktitle =. Prompt Infection:. 2024 , url =

    2024

  31. [31]

    Red-Teaming

    Tian, Pengfei and Cheng, Shuai and Zhao, Zhirui and Luo, Xiaolong and Shi, Jianye and Wen, Junfeng and others , booktitle =. Red-Teaming. 2025 , url =

    2025

  32. [32]

    Adaptive Attacks Break Defenses Against Indirect Prompt Injection Attacks on

    Pasquini, Dario and Struppek, Lukas and Hintersdorf, Dominik and Kersting, Kristian , booktitle =. Adaptive Attacks Break Defenses Against Indirect Prompt Injection Attacks on. 2025 , url =

    2025

  33. [33]

    arXiv preprint arXiv:2506.23844 , year =

    A Survey on Autonomy-Induced Security Risks in Large Model-Based Agents , author =. arXiv preprint arXiv:2506.23844 , year =

    Pith/arXiv arXiv

  34. [34]

    arXiv preprint arXiv:2506.07962 , year =

    Correlated Errors in Large Language Models , author =. arXiv preprint arXiv:2506.07962 , year =

    Pith/arXiv arXiv

  35. [35]

    Self-Inconsistency in

    Stureborg, Rickard and Alikaniotis, Dimitris and Suhara, Yoshihiko , booktitle =. Self-Inconsistency in. 2024 , url =

    2024

  36. [36]

    arXiv preprint arXiv:2601.10758 , year =

    User-Mediated Attacks on Planning and Web-Use Agents , author =. arXiv preprint arXiv:2601.10758 , year =

    Pith/arXiv arXiv