Reproduce “Security Assessment of DeepSeek Harness with A.I.G: Evaluating Resistance to Indirect Prompt Injection” on OpenResearch

About this paper

Zonghao Ying, Xiangfan Wu, Huiyu Wu, Xing Zheng, Huangsheng Cheng, Xiaorong Shi, Jing Guo

A security assessment by Tencent Zhuque Lab of the DeepSeek Harness (DSH) agent framework, using a controlled test matrix and runtime-level evaluation, quantified its resistance to indirect prompt injection attacks. The study revealed overall full attack success rates of 5.6% (J_R) and 5.3% (J_L), noting that attacks via "hidden Unicode" in file mode achieved 25.5% J_R full success, with "skills" channels demonstrating heightened susceptibility.

Key insights

• The specific carrier representation (e.g., file mode vs. text mode) significantly influences attack success, demonstrating that text-only evaluations can miss critical vulnerabilities arising from file-level parsing and metadata.
• There is a crucial difference between influencing a model's textual output (output compliance) and compelling it to execute sensitive tool actions (action success), with the latter being substantially more challenging to achieve.
• Reusable agent assets such as 'skills' are particularly vulnerable vectors for indirect prompt injection, exhibiting higher susceptibility compared to other content types like web retrieval or document reading.
• The disagreement between rule-based and semantic evaluators (J_R and J_L) provides informative insights, highlighting that mechanical attack signals do not always equate to semantically complete attack objectives.

Summary by alphaXiv.