Reproduce “LoopTrap: Termination Poisoning Attacks on LLM Agents” on OpenResearch

About this paper

Huiyu Xu, Zhibo Wang, Wenhui Zhang, Ziqi Zhu, Yaopeng Wang, Kui Ren, Chun Chen

Researchers defined and demonstrated "Termination Poisoning," a novel attack where malicious prompts manipulate an LLM agent's internal termination logic, leading to unbounded computation loops and resource exhaustion. An automated red-teaming framework, LoopTrap, was developed which achieved an 86.3% Attack Success Rate and an average Step Amplification Factor of 3.57x across 8 mainstream LLM agents, outperforming non-adaptive baselines by a notable margin.

Key insights

• Termination poisoning is a broadly viable threat, with all 8 evaluated LLM agents exhibiting susceptibility, averaging a 2.33x Step Amplification Factor, and its effectiveness is sensitive to task characteristics (e.g., open-ended tasks are more vulnerable).
• Different LLM agents exhibit distinct and interpretable vulnerability patterns across attack strategies, characterized by dimensions like Phase Compliance, Authority Compliance, Recursive Susceptibility, and Verification Tendency.
• LoopTrap's profile-guided strategy selection and reflective learning components are crucial for its effectiveness, with behavioral fingerprinting alone contributing 4.6 percentage points to Attack Success Rate and the skill library providing cumulative gains.

Summary by alphaXiv.