Study finds most LLM agent decisions on prompt injections are set at read time
Researchers examined how LLM agents handle prompt injections by replaying episodes up to the moment an injection is read and then resampling the remainder many times. Across four AgentDojo suites they measured that a Qwen3 agent without chain‑of‑thought reasoning has 0.91 of the outcome variance fixed at read time. Adding reasoning lowers this share to 0.62 (95 % CI [-0.38, -0.22]) and reduces…
Key points
- 0.91 of outcome variance for Qwen3 without reasoning is decided when the injection is read
- Chain‑of‑thought reasoning drops the fixed share to 0.62 (95 % CI [-0.38, -0.22]) and lowers attack success for Qwen3
- Single‑run labels for thinking agents diverge from reruns up to 35 %, urging repeated benchmark runs
The study also shows that zero‑shot chain‑of‑thought monitors built on cheaper models miss much of the already‑decided behavior, whereas stronger or look‑ahead monitors approximate the decision formed in the reasoning prefix. Single‑run labels for thinking agents disagree with reruns up to 35 % of the time, suggesting that benchmarks should use repeated runs per task to capture true performance.
The story so far
2 episodes →- Study finds most LLM agent decisions on prompt injections are set at read timethis story
The headline, key points and digest above were generated by Digest AI's editorial model from the linked sources. Automated summaries can contain errors: the sources are the record. Spotted a mistake? Tell us. Published by Martin K., who runs Digest AI and handles corrections.
More in Research
All →- CoDA enables rapid codebook development for domain-specific text annotation · 1 src
- Researchers prove Prefix-Tuning can exactly steer pretrained transformers · 1 src
- Study probes if LMs understand variable roles via SAEs · 1 src
- OR-License benchmark tests LLM agents on real operations research tasks · 1 src
- Researchers test open-weight Hunyuan-MT-7B for stylistic translation · 1 src
Comments
via GitHub Discussions