Reproduce “AgentDrift: A Step-Labeled Benchmark of Injection-Hijacked LLM Agent Trajectories” on OpenResearch
Turn your favorite coding agents into research agents that review literature, develop hypotheses, and run experiments.
Universal app for Apple silicon and Intel. Requires macOS 11 or later.
About this paper
Asif Pinjari, Mithun Paul Saint-Germain
AgentDrift introduces a step-labeled benchmark for detecting and localizing indirect prompt-injection compromises in LLM-agent tool trajectories. Its 12,536 synthetic trajectories distinguish successful, partial, delayed, and failed attacks from benign and hard-negative behavior, while baseline results show that surface features detect full hijacks relatively well but struggle with subtle behavioral drift and cannot reliably separate attempted from successful attacks.
Key insights
- Successful compromise is best understood as an ordered behavioral transition: a poisoned observation is followed by actions that serve the attacker rather than the user.
- A non-sequential logistic-regression baseline reached 0.647 F1 overall, detecting 88.0% of full hijacks but only 8.2% of partial and 23.1% of delayed attacks, underscoring the need for sequence-aware monitoring.
- Lexical and identity shortcuts are substantial: an LLM screening pass mislabeled nearly all hard negatives, while a world-identity lookup achieved 86.1% accuracy on the default split without using trajectory behavior.
Summary by alphaXiv.
Tip: change arxiv.org to autoarxiv.org in any arXiv abstract link to open the paper here.