ASPIRE: Agentic Safety & Prompt Injection Red-teaming Engine
cs.CR
Submitted: 2026-10-06
Updated: 2026-10-06
Code: https://github.com/a2aproject/A2A
License: http://creativecommons.org/licenses/by/4.0/
The gist: LLM agents retrieve untrusted content and act through tools, creating indirect prompt-injection risks that can cause unauthorized actions or persistent state changes.
Terminology
Abstract
LLM agents retrieve untrusted content and act through tools, creating indirect prompt-injection risks that can cause unauthorized actions or persistent state changes. Existing automated red-teaming largely optimizes payloads for pre-specified scenarios, leaving latent vulnerabilities across the agent's behavior space unexplored. We present ASPIRE, an Agentic Safety & Prompt Injection Red-teaming Engine for open-ended, behavior-level vulnerability discovery. ASPIRE maintains an evolving Agent Security Behavior Graph and uses complementary Explore and Exploit experts to discover, verify, and generalize consequence-centric tests. Trajectory evidence updates the graph and diagnoses partial or failed attempts, while cross-run memory transfers useful red-team strategies. Experiments on various benchmarks show that ASPIRE substantially expands coverage across consequences, injection methods, environments, and behavior paths while maintaining strong attack success.
Sources
- LLMail-Inject: A Dataset from a Realistic Adaptive Prompt Injection Challenge
- Learning to Inject: Automated Prompt Injection via Reinforcement Learning
- Know Your Agent: Reconnaissance-Driven Pentesting of AI Agents
- PI-Hunter: Automated Red-Teaming for Exposing and Localizing Prompt Injections
- Defending Against Indirect Prompt Injection Attacks With Spotlighting
- AgentDyn: Are Your Agent Security Defenses Deployable in Real-World Dynamic Environments?
- MUZZLE: Adaptive Agentic Red-Teaming of Web Agents Against Indirect Prompt Injection Attacks
- AgentVigil: Generic Black-Box Red-teaming for Indirect Prompt Injection against LLM Agents
- ChainFuzzer: Greybox Fuzzing for Workflow-Level Multi-Tool Vulnerabilities in LLM Agents
- PISmith: Reinforcement Learning-based Red Teaming for Prompt Injection Defenses
- VeriGrey: Greybox Agent Validation
Related papers
- SoK: AI-Augmented Binary Reversing
- Relaxed Sender Anonymity for CBDC Interbank Settlement: A Zero-Knowledge Approach on Permissioned EVM
- Calibration-Family Overfit: Why Trusted Sabotage Monitors Don't Transfer Across Lineages
- Estimating the Social Cost of Corporate Data Breaches
- Efficient Fuzzy PSI under One-Sided Assumptions
- Sealing the Audit-Runtime Gap for LLM Skills