Reproduce “Manipulating LLM Web Agents with Indirect Prompt Injection Attack via HTML Accessibility Tree” on OpenResearch
Turn your favorite coding agents into research agents that review literature, develop hypotheses, and run experiments.
Universal app for Apple silicon and Intel. Requires macOS 11 or later.
About this paper
Sam Johnson, Viet Pham, Thai Le
This research empirically demonstrates indirect prompt injection attacks on Large Language Model-based web navigation agents by embedding adversarial triggers in webpage HTML's accessibility tree. The study shows these triggers can hijack agent behavior, leading to actions like data exfiltration or forced clicks, and quantifies high attack success rates across various realistic scenarios.
Key insights
- Indirect Prompt Injection (IPI) via the HTML accessibility tree poses a practical and serious threat to LLM-based web navigation agents.
- Universal adversarial triggers can be effectively optimized to hijack agent behavior across multiple user instructions on a single website, and even for specific malicious actions across different websites.
- The attack method is robust, allowing successful execution of targeted actions even when the LLM's output includes minor syntactic variations.
Summary by alphaXiv.
Tip: change arxiv.org to autoarxiv.org in any arXiv abstract link to open the paper here.