Search papers, labs, and topics across Lattice.
This paper introduces PIMiner, an agentic system designed for automatic prompt injection red teaming, addressing the significant security risks posed by prompt injection in LLM agents. Unlike existing methods that rely heavily on reinforcement learning and struggle with generalization, PIMiner builds a strategy library from training on diverse (dataset, target model) pairs, allowing it to effectively transfer learned strategies to unseen target LLMs with minimal queries. Experimental results show PIMiner achieving high attack success rates (ASR) across multiple models, including 76.2% against Gemini-2.5-Pro and 86.7% against Gemini-2.5-Pro in different testing environments.
PIMiner achieves impressive attack success rates against multiple LLMs with minimal query requirements, revolutionizing prompt injection red teaming.
Prompt injection poses significant security risks to LLM agents. Efficient and effective red-teaming is therefore critical, both for evaluating these risks and for collecting training data to improve defenses. Existing state-of-the-art prompt injection red-teaming methods primarily rely on reinforcement learning (RL), producing attacker models that often generalize poorly to new target LLMs. In this work, we develop PIMiner, an agentic system for prompt injection red-teaming. During training, PIMiner is trained on a sequence of (dataset, target model) pairs and builds a strategy library from scratch. At test time, the learned strategy library can be directly transferred to a previously unseen target LLM without additional training. PIMiner requires only a small number of queries to a target agent (e.g., 10) per test sample. Experimental results demonstrate that PIMiner achieves strong performance. On IPIArena, it attains a 76.2% ASR against Gemini-2.5-Pro, 61.9% ASR against GPT-5.1, and 42.9% ASR against Claude-Sonnet-4.5. On AgentDojo, it achieves an 86.7% ASR against Gemini-2.5-Pro, 53.3% ASR against GPT-5.1, and 40.0% ASR against Claude-Sonnet-4.5.
