Adaptive Multi-Turn Prompt Injection Against LLM Agent Defenders (Research Benchmark)

Technical Analysis

The benchmark pits an autonomous 'attacker' LLM against a 'memoryless' defender LLM across up to 15 rounds, where the attacker observes each defender response and adapts its injection strategy across turns, while the defender treats each turn as an independent, non-remembered interaction. Restricting evaluation to a single turn yields near-zero attack success (0-1%), while allowing adaptive multi-turn escalation raises success to 5.4-14.0% across frontier models (Claude Opus, GPT-5.4, Gemini), with large scenario-specific variance (e.g., one scenario reaching 60% ASR against Opus). The entry point is the standard conversational/agentic input channel; the 'gain' for an attacker in this framing is inducing a policy-violating or unsafe response from the defender LLM after iterative probing. The work highlights that pooling multiple attacker models finds more unique successful jailbreaks than any single attacker, and that generated attacks are novel relative to existing benchmark corpora (low cosine similarity), suggesting current static red-teaming corpora under-represent adaptive multi-turn risk. No specific agent framework, tool layer, or inter-agent protocol vulnerability is described; the work is model-input-level red-teaming, not a supply-chain, tool-poisoning, or protocol exploit.

Detection Signatures

• N/A - this is a research benchmark, not an active campaign; defenders should watch for: repeated conversational probing that incrementally shifts context/framing across many turns, sudden topic pivots following a refusal, escalating persuasion/role-play framing across turns, and multi-turn sessions with high semantic drift from the initial stated task

Remediation Steps

1. 1

   Adopt multi-turn safety evaluation

   Incorporate adaptive, multi-round red-teaming (such as this benchmark) into model/agent evaluation pipelines rather than relying solely on single-turn or static attack pool benchmarks.

2. 2

   Add cross-turn memory/context monitoring

   Deploy session-level anomaly detection that tracks cumulative context drift and adversarial pivoting across turns, since per-turn-only evaluation misses adaptive escalation.

3. 3

   Ensemble red-team testing

   Test defenses against multiple frontier attacker models (not just one), since the paper shows pooling attackers uncovers 1.4-2.2x more unique successful attacks than any single attacker.

4. 4

   Scenario-specific hardening

   Investigate and patch high-variance failure scenarios individually, since aggregate ASR masks scenario-specific weaknesses (e.g., 60% ASR on one scenario for a model otherwise performing well).