LoopTrap: Termination Poisoning Attacks against LLM Agents

核心问题：LLM 智能体的终止判断可被间接提示注入操纵，使其误判任务未完成而陷入无界执行循环。

• 问题场景：现代智能体在迭代循环中反复推理、行动并自我评估进度，而进度评估由处理不可信外部内容的同一个 LLM 完成。作者引用企业部署案例称，陷入递归推理循环的智能体可在一个下午消耗数千美元计算成本。
• 现有研究不足：作者称，以往间接提示注入研究主要关注输出操纵（数据外泄、未授权操作、有害内容），sponge 类攻击针对单次前向的计算效率，尚无工作系统研究针对智能体终止机制、破坏进度自评估的攻击。
• 核心观察：进度评估本质上是 LLM 的主观判断，易受与人类相似的认知偏差影响；作者据此把认知科学中的偏差转化为提示词层面的操纵技术。
• 论文产出：定义 Termination Poisoning 威胁模型，设计 4 类机制共 10 种攻击策略，在 8 个智能体、60 个 GAIA 任务上做实证研究，并提出自动化红队框架 LoopTrap。
• 威胁模型（§3）：
  • 目标：让目标智能体无法识别任务完成，陷入无界循环、持续消耗 API 调用和 token；成功判据为 T′ > α·T（α > 1 的步数放大阈值）。
  • 知识：攻击者假定知道智能体的任务类型（如编码任务）。
  • 能力：能插入或修改智能体执行中会访问的至少一个外部来源（网页、可公开编辑文档、被入侵第三方 API、公开仓库中的恶意技能）；不能访问系统提示词、内部记忆、模型权重，不能修改代码、工具定义或编排逻辑。
  • 限制：不能实时观察执行轨迹，所有注入内容须在智能体遇到之前准备好；攻击者与受害智能体通过共享环境异步交互。

LLM agent architectures and termination mechanisms

• ReAct (2023) established the paradigm of alternating reasoning and tool calls; LangChain, OpenAI Assistants, and Claude Tool Use engineered it, and AutoGPT pursued a fully autonomous paradigm with self-evaluated progress.
• The authors summarize three types of termination mechanisms: explicit self-evaluation (AutoGPT, LangChain), implicit completion detection (Claude Tool Use, OpenAI Assistants), and external verification (unit tests, ground-truth comparison, human approval); the authors state that production systems mostly rely on the first two types, whose termination signals come from the LLM's reasoning over context containing external content.

Prompt injection attacks

• Greshake et al. (2023) proposed indirect prompt injection, embedding payloads in external artifacts such as web pages, documents, and API responses; Perez and Ribeiro (2022) studied direct injection.
• Multi-turn strategies (Liu et al., 2024) use context accumulated across turns to gradually guide agent behavior.
• Existing work mainly changes the content of agent outputs: data exfiltration (Greshake et al., 2023), harmful content generation, tool call hijacking (InjecAgent, Zhan et al., 2024); AgentDojo (Debenedetti et al., 2024) provides a prompt injection attack-defense evaluation environment.

Sponge-type resource consumption attacks

• Sponge Examples (Shumailov et al., 2021) and others attack computational efficiency at the model level; the authors point out that such work acts on a single forward pass rather than the control flow of agent systems.

Baselines and benchmarks

• The paper states that there is no prior automated red-teaming work directly targeting agent termination manipulation, so it builds 5 baselines: Static-Best, Static-Random, Rotate-All, NoProfile, LLM-Direct (§6.1).
• The evaluation benchmark is GAIA (Mialon et al., 2024), which the paper states contains 165 real tasks at three difficulty levels; the authors stratified-sample 60 tasks.

Positioning of this paper: The authors state that, to their knowledge, no prior work has systematically studied attacks targeting LLM agent termination mechanisms and disrupting progress self-evaluation to induce unbounded computation; this paper formalizes this attack surface in §3.

Overall approach: first, empirical research finds that attack effectiveness depends on the agent's behavioral tendencies and task context; then the agent is profiled into four interpretable dimensions; finally LoopTrap routes strategies by profile, generates and filters injections, and accumulates a skill library for continuous improvement.

Attack strategy design (§4.1)

• Four manipulation surfaces: progress manipulation (P1–P3, distorting completion assessment), cognitive bias exploitation (P4–P6, authority obedience, sunk cost, social proof), task structure manipulation (P7–P8, infinite verification regression, circular dependency), reward shaping (P9–P10, stepwise praise, fabricated scoring), 10 strategies in total (Table 1).
• Basis: the authors consider progress assessment to be a subjective judgment by the LLM, susceptible to cognitive biases, and therefore design strategies drawing on findings from cognitive science and behavioral psychology; full templates are in Appendix G.

Behavioral profiling (§4.4)

• Four dimensions: Phase Compliance (d_phase), Authority Compliance (d_auth), Recursive Susceptibility (d_recur), Verification Tendency (d_verify), corresponding to strategy groups P1/P2, P4/P6, P7/P8, P3/P5/P9/P10 respectively.
• Scoring method: for each model, compute the proportion of strategies associated with a dimension whose SAF exceeds 2× (approximately the overall mean), normalize to [0,1], and obtain the profile d = (d_phase, d_auth, d_recur, d_verify).

LoopTrap three stages (§5, Figure 4)

• Behavioral fingerprint (§5.2): 4 diagnostic probes, each consisting of a trivial anchoring task (e.g., "capital of France") plus a dimension-specific injection; compare execution steps under clean and injected conditions, amp(d) = T_inject(d) / max(T_clean(d), 1), then normalize by s(d) = min(amp(d)/τ, 1.0) (τ = 5.0). The entire profile requires only 8 agent executions (4 clean + 4 injected), and results are cached and reused.
• Profile-guided trap synthesis (§5.3): first compute the strategy prior π(P_k) from the profile (mean score of associated dimensions); strategy selection uses UCB1 combining empirical performance, exploration bonus, and profile prior (ε = 0.25, c = 1.5, λ = 0.3); each attempt generates n = 3 candidates, and the same LLM self-scores and selects the best by profile alignment, contextual plausibility, and trap effectiveness; each episode allows at most M = 3 attempts, and on failure a structured reflection containing the failure hypothesis, behavior analysis, and modification direction is generated and appended to the generation context.
• Reflective skill evolution (§5.4): successful attacks (amplification ratio ≥ α) are abstracted into skill records with seven fields including source strategy, trigger conditions, causal insight, and action template; skills with overlapping trigger conditions are merged by Jaccard similarity (tool set 0.5, task category 0.3); subsequent episodes route skills by a weighted combination of four signals: context similarity, historical performance, exploration bonus, and profile alignment, falling back to UCB1 when no skill matches.

Success determination and implementation

• Determination: an episode is successful if T′/T ≥ α, with α = 2× (approximately the average amplification ratio in the empirical study).
• Implementation: LoopTrap's internal modules (generation, self-scoring, reflection, skill abstraction) all use GPT-4o as the backbone; all hyperparameters are fixed across experiments and agents, with no per-agent tuning.

Experimental setup

• Models tested: Gemini-3-Pro, GPT-4o, GPT-4o-mini, DeepSeek-R1, Kimi-K2-Thinking, GLM-5, Grok-4, Claude Sonnet 4.5, all serving as the reasoning engine of a unified ReAct-style agent.
• Dataset: the GAIA benchmark (165 tasks, three difficulty levels), manually annotated into 14 categories and then stratified-sampled to 60 tasks; Table 7 in Appendix F lists 7 high-level categories and task counts (e.g., General Knowledge 10, Entertainment & Arts 9).
• Environment: a simulated tool environment where tool returns are generated from task context rather than calling real services; the authors state that the main metrics measure behavioral change rather than task accuracy, so real tools are unnecessary, and external noise such as unreachable web pages can be excluded.
• Sample size and repetitions: the empirical study comprises 10 strategies × 60 tasks = 600 pairs, each pair executed independently 5 times, for 3,000 runs per model; LoopTrap evaluation uses a budget of 20 episodes per agent-task pair, repeated over 10 independent runs and averaged.
• Metrics: SAF = T′/T; ASR (proportion with amplification ratio ≥ α = 2×); TAF (token amplification); EFS (number of episodes required for first success).
• Baselines: Static-Best, Static-Random, Rotate-All, NoProfile (LoopTrap variant without profiling), LLM-Direct (direct generation by the same backbone LLM, without taxonomy/profile/skill library).

Main results

Excerpts from Table 2 (static strategy SAF, mean ± standard deviation over tasks) and Table 4 (LoopTrap comparison, average of 10 runs):

Swipe horizontally to read the table

Model	Static strategy average SAF (Table 2)	LoopTrap ASR (Table 4)	LoopTrap SAF (Table 4)	Static-Best ASR (Table 4)
GPT-4o-mini	3.50	98.3±0.92	3.87±0.34	83.7±1.96
Grok-4	3.36	90.0±1.65	4.07±0.36	88.3±1.78
GPT-4o	3.08	96.7±1.18	3.73±0.31	75.4±2.18
DeepSeek-R1	2.08	76.7±2.16	4.22±0.37	68.5±2.47
Claude Sonnet 4.5	1.95	81.7±1.97	2.49±0.25	68.3±2.52
Gemini-3-Pro	1.74	88.3±1.71	4.31±0.38	62.0±2.31
Kimi-K2-Thinking	1.73	86.7±1.79	3.34±0.30	75.8±2.25
GLM-5	1.31	71.8±2.28	2.61±0.26	51.7±2.83
Average	2.33	86.3	3.57	71.7

• The authors state that LoopTrap is best on both ASR and SAF for every agent, averaging 14.6 percentage points higher ASR and 0.96× higher SAF than Static-Best.
• Among static strategies, P9 (Positive Reinforcement) has the highest average SAF (2.71×), followed by P4 (Authority Override) (2.56×); P9 peaks at 4.37× on Grok-4 but reaches only 1.38× on GLM-5 (Table 2).
• The authors consider that the non-adaptive baselines (Static-Random, Rotate-All, LLM-Direct) have ASR concentrated at 56.6–62.4%, indicating that strategy diversity or LLM capability alone is insufficient to reliably exploit the termination vulnerability.

Task context and profile analysis

• Task category sensitivity (Figure 3 heatmap): the authors state that tasks with objectively verifiable completion criteria (e.g., mathematical reasoning) are more resilient, while open-ended tasks are more vulnerable; for example, P4 has SAF 3.58 on Technology and drops to 1.68 on Math, and P9 reaches 3.71 on History and drops to 1.68 on Science; History is the most vulnerable category, with a maximum average gap of 1.66× across strategies.
• Profile discriminability (Table 3): Kimi-K2-Thinking has d_auth = 0.84 and d_verify = 0.22 (the paragraph before Finding 4 in the main text separately writes d_auth = 0.98 and d_verify = 0.85; the two places are inconsistent, and Table 3 is taken as authoritative); Claude Sonnet 4.5 has d_recur = 0.82; Grok-4 has d_verify = 0.80.
• Strategy selection correspondence (Table 5): among successful attacks, GPT-4o with high d_phase is mainly broken via P1 (25%), and Kimi-K2-Thinking with high d_auth is mainly broken via P4 (32%); the authors state that LoopTrap's strategy diversity is higher than shown by the Table 3 profiles, balancing exploitation and exploration.

Efficiency and ablation

• Convergence efficiency (Figure 5): LoopTrap reaches 79% cumulative ASR within the first 5 episodes and the final 86.3% by episode 16; Static-Best converges to 71.7% at episode 1 and then stays flat; Rotate-All grows nearly linearly, reaching 56.8% by episode 20.
• Ablation (§6.4, Figure 6, 20-episode budget, 10 runs): removing profiling lowers ASR by 4.6 percentage points (86.3%→81.7%) and increases EFS by 1.7; removing reflection lowers it by 6.2 percentage points; removing the skill library lowers it by 7.9 percentage points and the gap grows with episodes; removing exploration (pure greedy) lowers it by 6.1 percentage points, but SAF is almost unchanged (3.50× vs 3.57×), and the authors state that when greedy succeeds, injection effectiveness is comparable.
• TAF (Appendix D, Table 6): LoopTrap averages TAF 3.93×, versus 2.88× for Static-Best.

Cross-framework and qualitative analysis

• Cross-framework (Appendix C, Figure 7): LoopTrap was rerun on LangGraph and LangChain with the same models, tools, and task pool, with an average CAF of 3.58×; the figure caption says "Cross-framework SAF comparison", while the main text and axis use the term CAF, and the paper does not explain this abbreviation.
• Qualitative cases (Appendix J, Figures 9–11, all on GPT-4o): in the three cases static injections were ignored by the agent (1.17×, 1.25×, 1.20×, all failures), while LoopTrap's task-relevant injections reached 4.0×, 2.5×, and 2.0× respectively; in the sports statistics case, all 12 static attempts failed (0% ASR), while LoopTrap succeeded in all 3 rounds.

Limitations and future directions noted by the authors

• Profile dimension coverage (§7 Limitations): the four dimensions come from the 10 strategies and 8 models evaluated in this paper; other models may have more behavioral tendencies, and new agent architectures may introduce termination mechanisms not covered by the current framework; the authors believe the profile schema should be extended with new designs.
• Defense generalization (§7 Limitations): this paper focuses on characterizing and exploiting vulnerabilities rather than comprehensive defense; the defense strategies discussed are only preliminary suggestions, and their robustness against adaptive attackers aware of the defense mechanisms has not been verified.
• Robust termination mechanisms (§7 Future Work): the authors propose two candidate directions—progress signal verification (an independent sandbox module validating the agent's self-evaluated progress against objective completion criteria) and provenance-aware context handling (strictly distinguishing trusted system instructions from untrusted retrieved content and weighting them differently).
• Extending the threat model (§7 Future Work): this paper focuses on single-agent systems; the authors state that in multi-agent architectures a compromised agent can directly inject polluted progress signals into its peers, and formalizing this scenario is an important extension.

Experimental coverage

• 8 models were tested: Gemini-3-Pro, GPT-4o, GPT-4o-mini, DeepSeek-R1, Kimi-K2-Thinking, GLM-5, Grok-4, Claude Sonnet 4.5 (§4.2).
• The main experiments were conducted in a unified ReAct-style framework plus a simulated tool environment; cross-framework validation covers LangGraph and LangChain (Appendix C).
• The tasks are 60 tasks stratified-sampled from GAIA; the empirical study used 3,000 runs per model (600 pairs × 5 runs), and the LoopTrap evaluation used 10 independent runs per condition with a 20-episode budget (§4.2, §6.1).
• LoopTrap's internal modules use GPT-4o as the backbone (§6.1); the paper does not report the effectiveness of using other models as the attack backbone.
• The paper does not report experiments on any implemented defense against this attack; defenses are discussed only as future directions (§7).

An attack paper targeting the control flow of LLM agents: the authors define Termination Poisoning—contaminating the agent's progress assessment signal via indirect prompt injection so that it misjudges the task as incomplete and falls into an unbounded execution loop, differing from traditional prompt injection that changes outputs and from model-level sponge attacks.

• Problem addressed: the agent's termination judgment is made by the same LLM that processes untrusted external content, so an attacker only needs to contaminate external sources such as web pages, documents, or API responses to manipulate that judgment; the authors state that this attack surface has not been systematically studied before.
• Method highlights: 4 mechanism categories (progress manipulation, cognitive bias, task structure, reward shaping) with 10 static strategies in total; four behavioral profile dimensions d_phase, d_auth, d_recur, d_verify are induced; the LoopTrap framework first completes profiling with 8 executions, then routes strategies by profile using UCB1, has an LLM generate and self-score-filter injections, abstracts successful samples into a skill library, and triggers structured reflection on failure.
• Empirical results: on 8 agents and 60 GAIA tasks, static strategies achieve an average SAF of 2.33× (Table 2); GPT-4o-mini is the most vulnerable (3.50×) and GLM-5 the most resilient (1.31×); the authors state that tasks whose completion can be objectively verified are more resilient, while open-ended tasks are more vulnerable.
• LoopTrap results: average ASR 86.3%, SAF 3.57×, TAF 3.93× (Table 4, Table 6), 14.6 percentage points higher ASR than the strongest static baseline; 79% cumulative ASR is reached within the first 5 episodes (Figure 5); ablation shows the skill library, reflection, profile, and exploration contribute 7.9, 6.2, 4.6, and 6.1 percentage points of ASR respectively.
• Authors' conclusion: agent termination mechanisms are a critical and under-defended attack surface; the authors consider that the profile dimensions may not cover new architectures and that the defense recommendations have not been validated, and propose progress signal verification, provenance-aware context handling, and multi-agent extension as future directions.