推理窗口：LLM智能体何时决定遵循提示注入

AI 摘要

该论文研究LLM智能体在阅读提示注入后何时决定是否遵循注入。通过分支重采样方法，作者发现开启思考模式后，决策从阅读时转移到推理过程中（Qwen3-8B的阅读时固定方差份额从0.91降至0.62），且思考对不同模型攻击成功率影响方向不一。研究还表明单次运行标签对思考型智能体噪声大，基准测试需每任务多次运行。

正文节选

The Window Is in the Reasoning: When LLM Agents Decide to Follow Prompt Injections Abstract. LLM agents that read untrusted content can be hijacked by prompt injections. Runtime monitors that try to catch a hijack before the agent acts, and benchmarks that score each task with a single run, share an assumption: whether an agent follows an injection is settled when the injection is read. We test this assumption with branching rollouts that replay an episode exactly up to the step at which the age

发布时间：2026-10-21 12:00

抓取时间：2026-10-20 12:17

来源机构：arXiv