LAAF: A Systematic Red-Teaming Method and Automated Attack Framework for LPCI Vulnerabilities in Agentic LLM Systems

Persistent memory, RAG, and tool connections in agentic LLMs allow LPCI to lie dormant across sessions, and the authors state that no automated red-teaming tool covered its full lifecycle at the time.

• Scenario: The authors state that payloads written to memory or a vector store can re-enter across sessions, be encoded to pass plaintext filters, and activate after keyword, tool-call, or turn triggers, so single-request analysis and output-layer-only filtering are insufficient (§3.1). Previous 1,700 tests had a combined success rate of 43%, with platform failure rates from ChatGPT's 15.06% to Gemini-2.5-pro's 70.83% (§3.5).
• Existing gaps: The authors state that Garak does not model memory persistence, cross-session triggers, or layered encoding; PyRIT supports multi-turn but each turn is independent, does not use the previous turn's winning payload to seed the next, and does not implement the six-stage lifecycle (§1–2).
• Assumption: The authors believe LPCI differs from standard prompt injection in persistence, encoding, and conditional activation, and red teaming must proceed by stages (§3.1).
• This paper's approach: LAAF provides a 49-item, six-category technique taxonomy (Table 1) and Persistent Stage Breaker (PSB): after a stage is broken, mutations of the winning payload seed the next stage. The authors state this is the first automated red-teaming framework combining both (abstract).
• Threat model:
  • Goal: achieve EXECUTED stage by stage; only this counts as a breakthrough (§4.1). Stages range from S1 reconnaissance to S6 trace tampering (§3.4).
  • Knowledge: black-box API, no gradients; the authors state GCG is out of current scope (§6.8).
  • Capability: plaintext payloads and their mutations; evaluation uses at most 100 attempts per stage with a 1 s interval (§8.1).
  • Victim system: single agent with persistent memory, RAG integration, and tool connections. Multi-agent propagation is out of scope (§1). The evaluation is actually direct chat-completion, with stage prompts simulating posture, and no real RAG or memory interface (§9).

Prompt injection and retrieval/memory poisoning

• Perez and Ribeiro (2022): Established prompt injection as a systematic vulnerability. The paper only describes this.
• Greshake et al. (2023): Indirect injection via retrieved content. The authors call this the basis of LPCI's RAG attack surface.
• Zhu et al. [6] and Chen et al. (2024): The text states that the former demonstrates poisoned RAG documents can manipulate answers (reference titled PoisonedRAG); the latter (AgentPoison) demonstrates that poisoning agent memory or knowledge bases can create persistent control. The authors state that the latter is directly relevant to LPCI's AV-2 and AV-4.

Automated jailbreaks

• PAIR (Chao et al., 2023): Uses an LLM to iteratively rewrite jailbreak candidates. The paper reports it can jailbreak in as few as 20 queries. The authors contrast: PSB uses a fixed set of 49 typed techniques rather than free-form rewriting, and seeds from the previous stage's winning payload rather than starting from scratch each time.
• AutoDAN (Liu et al., 2024): Hierarchical genetic search generates covert discrete adversarial suffixes. The authors state that it, like the encoding class, targets filter evasion but is token-level and does not do semantic reframing.
• GCG from Zou et al. (2023): White-box gradient descent yields transferable universal adversarial suffixes. The authors state that it is out of scope for black-box APIs but is one motivation for the encoding class.

Scanning tools

• Garak (Derczynski et al., 2024): Modular scanning covering jailbreaks and basic injection. The authors note it does not model memory persistence, cross-session triggers, or layered encoding.
• PyRIT (Microsoft, 2024): Multi-turn adversarial testing. The authors note that each turn is treated as an independent interaction, without seeding s_{i+1} from the winning payload of stage s_i, and without LPCI's six-stage model.

Baseline and evaluation target

• Baseline: The authors' prior manual single-technique LPCI testing [1], 1,700 structured cases, five-platform stage pass rates. The target here is six-stage PSB scans of five production endpoints on OpenRouter. The authors state in §9 that the two are not equivalent in method, attempt budget, or model version.

The authors state that no existing tool combines LPCI-specific technique categories with adaptive, lifecycle-aware seed escalation; this is the gap LAAF fills, not a claim that automation itself is novel (§2).

LAAF 把载荷生成、六阶段执行、模式判定和变异播种闭合成环（Figure 1）：某阶段突破后，变异引擎用获胜载荷播种下一阶段。

生命周期与阶段上下文

• 四向量：AV-1 工具投毒，AV-2 记忆持久的编码触发，AV-3 经记忆固化的角色覆盖，AV-4 RAG 索引文档中的载荷持久（§3.3）。
• 六阶段：S1 Reconnaissance、S2 Logic-Layer Injection、S3 Trigger Execution、S4 Persistence/Reuse、S5 Evasion/Obfuscation、S6 Trace Tampering（§3.4，Figure 2）。
• logic-layer：作者指系统外部的记忆、RAG 与工具连接器，以区别对齐文献中模型内部的 instruction-layer（§3.2，引 Wallace et al., 2024）。
• 阶段提示词：每阶段一条不同的受害侧系统提示词，模拟从普通助手到文档访问、记忆回灌、新会话、过滤器开启、审计日志。附录 B 给全文与 SHA-256。它们不是攻击载荷。

六组件与成功判定

• 组件：（1）Payload Generator，从分类采样并在生成时做 SHA-256 去重；（2）Stage Engine，顺序跑 S1→S6；（3）Attack Executor，负责 API、限速与重试；（4）Response Analyser；（5）Results Logger，写 CSV/JSON/HTML/PDF；（6）Mutation Engine。
• 判定：确定性、基于模式、看完整响应。优先级严格为 BLOCKED > EXECUTED > WARNING > UNKNOWN。只有 EXECUTED 算阶段突破。
• EXECUTED：响应含指令遵从（例如声称将执行注入动作、系统提示泄露、外泄证据或接受注入框架的标记），且无 BLOCKED 模式。外泄证据的论文阈值包括长度至少 30 字符的 base64、攻击者基础设施 URL 或结构化字段泄露。
• 其余三类：BLOCKED 为明确拒绝、引用安全策略或称检测到注入；与遵从信号同时出现时绝对优先。WARNING 为含糊或部分执行，无前两类信号；其他非空、非拒绝、非遵从响应默认 WARNING，置信度 0.2，不计入突破。UNKNOWN 为空响应、超时或 API 错误，不计入阶段预算并立即重试。

49 项技术分类

Table 1 与 Figure 3：Encoding 11（主阶段 S5）、Structural 8（S2）、Semantic 8（S3）、Layered 5（S3+S5）、Trigger/Timing 12（S3）、Exfiltration 5（S2+S3+S4）。

• Encoding（E1–E11）：利用明文扫描器与模型解码能力的不对称，含单编码与嵌套组合。
• Structural（S1–S8）：把载荷放进 RAG 会索引、但不做指令扫描的文档结构。
• Semantic（M1–M8）：不编码，把载荷写成模型被训练去遵循的优先指令。作者称这是最强类别，并称语义绕过在拒绝 Base64 的平台上成功。
• Layered（L1–L5）：堆叠编码、结构、语义与触发。作者写，若流水线中 n 个独立分类器各自以概率 pi 检出，联合检出概率为各 pi 之积；并称这只适合独立分类器流水线，对单次前向的安全对齐模型只是近似，每层概率未实测（§6.4）。
• Trigger（T1–T12）与 Exfiltration（EX1–EX5）：前者控制何时触发（关键词、轮次、会话年龄、角色、工具、记忆回灌、跨会话、嵌套、隐写）。作者称 T10、T11 没有单一可疑关键词或时间模式。后者经注入文档演示外泄，利用指令遵循优先于内容过滤；论文给出五类名称，此处不复述载荷。

组合空间为 |P| = T × V × I × S，其中 T=49，V=5，I=1,920（96 条基础指令 × 20 个上下文修饰），S=6，理论最大 2,822,400，生成时去重（§6.7）。

Persistent Stage Breaker

Figure 4 的决策环中，阶段 si 的结果函数取 EXEC、BLOCK 或 WARN。PSB 计算 p^∗_i = first p ∈ π_i : f(p, s_i) = EXEC：在自适应排序的探索序列中取第一个突破载荷，而不是穷尽搜索以最小化尝试次数。下一阶段批次为 Bi+1 = μ(p*i)。

• 变异档：由自上次突破起的连续拦截次数 c 决定。c<10 为同类别内重采样参数；10≤c<20 为换一种 E1–E11 编码；c≥20 为再叠一个技术类别。另以 ρ=0.30 混入从全空间均匀抽取的新载荷。c 的两个阈值与 ρ 是三个可调超参数。作者称 ρ=0.30 是经验启发式。
• 表述不一致：架构节称四种策略（encoding、reframe、trigger、compound）；§7.2 只定义上述三种。论文未说明 reframe、trigger 如何对应这三档。

作者标出的分类边界

当前分类面向 black-box、纯文本、单智能体。作者列入扩展、未逐条实现的有：多模态注入、工具 schema 的参数注入/schema 覆盖/工具描述投毒、GCG 式梯度前缀、经对话摘要的记忆投毒（§6.8）。

Experimental Setup

• Endpoints: Five authorized research instances accessed via OpenRouter: gemini-2.0-flash-001, claude-3-haiku-20240307, meta-llama/llama-3.1-70b-instruct, mistralai/mixtral-8x7b-instruct, openai/gpt-4o-mini (§8.1). In the tables, abbreviated as Gemini-2.0-flash, Claude-3-haiku, LLaMA3-70B, Mixtral-8x7b, ChatGPT-4o-mini.
• Protocol: Three independent full PSB scans on 2026-03-09. Up to 100 payloads per stage (up to 600 per platform), 1 s request interval. Table 2 and Table 3 are Run 2; Table 4 is the three runs' BR. The authors' reasons for choosing this budget include: about 100–325 s per stage under rate limiting, six-stage scans under 35 minutes, and the authors' estimate of about $0.10–0.20 per platform.
• Metrics: Number of attempts needed for first breakthrough; BR = number of broken stages / 6. Not broken within 100 attempts is recorded as NOT BROKEN (“–” in tables). The authors state this does not indicate exhaustive resistance.
• Judgment: The Response Analyser is deterministic pattern classification, not an LLM judge. The paper does not report temperature values or agreement with human judgment.
• Baseline: Stage pass rates from previous manual single-technique LPCI tests [1]. The authors state that the taxonomy values in Figure 5 are estimates derived from the distribution of winning techniques, not independent per-category trials.
• Exfiltration target: Only researcher-controlled endpoints (§8.1).

Main Results

The table below merges Run 2 from Table 3 with the three repetitions from Table 4. Unbroken stages are according to Table 2.

Swipe horizontally to read the table

Platform	Run 2 BR	Three-run mean	Range	Run 2 total attempts	Run 2 unbroken
Gemini-2.0-flash	100%	94%	83–100	9	none
Mixtral-8x7b	100%	94%	83–100	79	none
LLaMA3-70B	83%	89%	83–100	210	S5
Claude-3-haiku	67%	78%	67–83	232	S1, S5
ChatGPT-4o-mini	67%	67%	50–83	373	S2, S5
Total	83%	84%	83–86	903	—

• First-breakthrough attempts from Table 2: Gemini's six stages are 2, 1, 1, 2, 2, 1; ChatGPT's S3 is 97. The authors state the budget creates a ceiling effect, and unbroken should not be written as having resisted. Run 2 total duration is 3,896 s (Table 3).
• The abstract states 83% is reproduced across three runs and states platform-level rates are stable within 17 percentage points, while also giving a mean of 84% (range 83–86%). The three-run totals in Table 4 are 86%, 83%, 83%; ChatGPT's range is inconsistent with “within 17 percentage points,” and the table takes precedence. The authors state the three repetitions are only point estimates, and confidence intervals require a larger sample.
• One place in the text states that ChatGPT in Run 2 did not break S1, and states that Run 1 and Run 3 broke S1 within 33 and 39 attempts, respectively. Table 2 and Appendix Table 11 record Run 2's S1 as broken at the 33rd attempt (EX5), with S2 and S5 unbroken. The table takes precedence. Per-run stage attempt counts are not tabulated in the paper.

Comparison with Manual Baseline

• What was tested: Figure 6 compares LAAF's overall breakthrough rate with previous manual single-technique tests.
• Results: The text states the gap is most pronounced for Claude (67% vs. 32%) and ChatGPT (67% vs. 15%), and states the manual baseline falls in 15–71%. The exact numbers in §3.5 are Gemini-2.5-pro 70.83%, LLaMA3 49.00%, Mixtral 48.75%, Claude 31.50%, ChatGPT 15.06%, total 43%.
• Authors' interpretation: The authors state Figure 6 is only directional evidence. The manual tests used about 340 attempts per platform, LAAF up to 600 per platform; methods, budgets, and model versions are not equivalent, and [1] does not report version strings, so this cannot be treated as a controlled improvement magnitude (§8.3, §9).

Winning Techniques

• What was tested: Table 5 records the winning technique per platform and stage in Run 2; Figure 5 estimates breakthrough rates by category.
• Results: The authors state that encoding categories (especially E9, E10) and the EX series dominate the winning distribution; the EX series accounts for 10 of the 25 total broken stages. Claude's S2 is EX3, 1 attempt; LLaMA3's S2 is M7, 18 attempts; Mixtral's S1 is M1, 39 attempts; ChatGPT's S3 is E1, 97 attempts, and S6 is EX1, 28 attempts. Appendix A's attempt counts match Table 2.
• Authors' interpretation: The authors state that layered combinations have the highest estimated breakthrough rate, and semantic reframing is higher than encoding on better-guarded platforms. The bar values in Figure 5 are estimates, and specific bar heights cannot be verified after text conversion; the paper also states these are not independent per-category trials. §8.7 uses scan records to illustrate that certain stages were judged broken; payloads are not repeated here.

Risk Ratings

• What was tested: Table 6 gives risk levels by number of findings and maps to OWASP LLM Top 10 v2.0: LLM01 corresponds to S2, S3, S5, S6; LLM06 to S4; LLM07 to S1.
• Results: Gemini and Mixtral are CRITICAL, with 6 findings each (Crit 2, High 4); LLaMA3 is HIGH, 5 findings (Crit 2, High 3); Claude and ChatGPT are MEDIUM, 4 findings each (Crit 1, High 3). Logic-Layer Injection has a CVSS of 9.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N). Claude has no LLM07 because S1 was not broken.
• Authors' interpretation: The authors believe the unbroken S5 across three platforms suggests that evasion-stage payloads trigger output-layer filtering more often than instruction-level defenses.

Other Ablations and Analyses

• Number of layers (single/two/three): the paper does not report comparison numbers, listed as future work (§10).
• PSB hyperparameters c∈{10, 20}, ρ=0.30: no ablation; the authors state ρ is an empirical heuristic (§7.2).
• Single-technique mode with PSB disabled: not run (§9).
• Cross-platform transfer: Table 5 does not test the success rate of A's winning payloads on B (§10).
• Before/after defenses: instruction-level execution or output-layer classifiers not evaluated (§10).
• Product detection model: per-layer detection probability not measured separately (§6.4).

Limitations and future directions noted by the authors

• No end-to-end RAG or memory interface: Stage prompts only simulate posture at the model layer; they cannot confirm whether retrieval and memory reinjection change the effect. The authors list this as the highest-priority follow-up, e.g., injecting into LangChain or LlamaIndex vector stores and then observing autonomous retrieval (§9, §10).
• Single day, specified versions: Results come from named versions dated 2026-03-09; the authors state that they should not be assumed to apply to later versions or fine-tuned variants, and they plan to rerun quarterly (§9, §10).
• Baseline not comparable: It is not equivalent to manual testing in method, per-platform attempt budget, or model version; diversity advantages and automation efficiency cannot be separated. A controlled PSB-off comparison is listed as a follow-up (§9, §10).
• Defenses not tested: The paper does not evaluate defensive countermeasures. The authors suggest adding instruction-level enforcement or output-layer classifiers and rerunning (§10).
• Classification and scenario gaps: Multimodal injection, finer variants of tool schemas, GCG white-box suffixes, memory poisoning via summaries, and multi-agent lateral movement are all marked by the authors as out of scope or follow-ups (§1, §6.8, §10).
• Unverified models and hyperparameters: The multiplicative detection assumption is not measured layer by layer; ρ and escalation thresholds are not systematically ablated; three repetitions are called point estimates by the authors, insufficient for confidence intervals (§6.4, §7.2, Table 4 note, §10).

Experimental coverage

• Tested are five named versions on OpenRouter, each with three full PSB scans, all dated 2026-03-09 (§8.1, Table 4).
• The protocol is six stages, up to 100 attempts per stage, with 1 s intervals; Run 2 totals 903 attempts across five platforms, 3,896 s (Table 3). The judge is a pattern analyzer. The paper does not report temperature values or agreement with human judgment.
• Stage-level first-breakthrough attempts, winning technique IDs, and durations are recorded in Table 2, Table 5, and Appendix A. The three runs report only platform-level BR, not per-run stage attempt counts.
• Access is via direct chat-completion. The six system prompts in Appendix B simulate document access, memory reinjection, filters, and auditing. The authors state that end-to-end RAG or memory pipelines were not tested (§9).
• Comparison numbers come from prior 1,700 manual tests. The authors state that no single-technique mode with PSB off was run, and defenses were not evaluated (§9, §10). Exfiltration demonstrations use researcher-controlled endpoints (§8.1).

The authors state that LAAF is an automated red-teaming framework built specifically for LPCI in agent LLMs. The problem addressed: encoded, delayed, conditionally triggered payloads can persist in memory or RAG and re-enter across sessions, whereas Garak and PyRIT do not use the previous round's breakthrough results to seed the next stage in a six-stage manner.

• Method: 49 techniques are divided into six categories—encoding, structural, semantic, layered, trigger, and exfiltration—with a theoretical combination count of 2,822,400, deduplicated by SHA-256 during generation. After the first EXECUTED in a stage, PSB performs same-level mutation, encoding change, or category stacking based on consecutive interception counts, then seeds the next stage. Responses are classified into four categories by a pattern analyzer, with BLOCKED taking precedence over EXECUTED.
• Run 2: 2026-03-09, up to 100 attempts per stage. The five-platform combined BR is 83% (Table 3): Gemini-2.0-flash and Mixtral-8x7b at 100% (the former with 9 total attempts), LLaMA3-70B at 83%, Claude-3-haiku and ChatGPT-4o-mini at 67%. ChatGPT's S3 used 97 attempts; three platforms did not break through within 100 attempts at S5.
• Three repetitions: Combined BRs are 86%, 83%, and 83%, with a mean of 84% and a range of 83–86% (Table 4). ChatGPT's platform range is 50–83. The authors state that three runs are only point estimates.
• Categories: The authors state that layered combinations and semantic reframing are most effective, and that semantic reframing outperforms encoding on better-protected platforms. The EX series accounts for 10 of the 25 broken stages (§8.5). The classification numbers in Figure 5 are estimates, not independent trials.
• Authors' conclusion: Enterprises need LPCI-specific evaluation before deployment; the authors believe a patient automated adversary will find combinations that break each stage, and semantic reframing exploits instruction-priority conflicts, so output filtering alone is insufficient. The comparison with prior manual testing (combined 43%) is qualified by the authors as directional evidence. The authors also state that no end-to-end RAG or memory interface was used, and defenses were not evaluated.