Instruction Self-Arbitration Is Not a Trust Boundary: Configuration-Dependent Tool Calls and External Enforcement in LLM Agents
cs.CR
Submitted: 2026-08-28
Updated: 2026-10-17
Sources
- StruQ: Defending Against Prompt Injection with Structured Queries
- AgentPoison: Red-teaming LLM Agents via Poisoning Memory or Knowledge Bases
- Defeating Prompt Injections by Design
- Control Illusion: The Failure of Instruction Hierarchies in Large Language Models
- Defending Against Indirect Prompt Injection Attacks With Spotlighting
- Online Shift Detection and Conformal Adaptation for Deployed Safety Classifiers
- Injection-Execution Dissociation: A Mechanistic Evaluation of Persistent Memory Attacks and Defenses in Stateful LLM Agents
- Retrieval Observability Bounds on Provenance Detection for Agent Memory Poisoning: Measured Coverage and a Falsified Standalone Detector
- Defenses Against Prompt Attacks Learn Surface Heuristics
- Identifying the Risks of LM Agents with an LM-Emulated Sandbox
- The Instruction Hierarchy: Training LLMs to Prioritize Privileged Instructions
- Knowledge Conflicts for LLMs: A Survey
- Benchmarking and Defending Against Indirect Prompt Injection Attacks on Large Language Models
- InjecAgent: Benchmarking Indirect Prompt Injections in Tool-Integrated Large Language Model Agents
Related papers
- SoK: AI-Augmented Binary Reversing
- Relaxed Sender Anonymity for CBDC Interbank Settlement: A Zero-Knowledge Approach on Permissioned EVM
- Calibration-Family Overfit: Why Trusted Sabotage Monitors Don't Transfer Across Lineages
- Estimating the Social Cost of Corporate Data Breaches
- Efficient Fuzzy PSI under One-Sided Assumptions
- Sealing the Audit-Runtime Gap for LLM Skills