INFUSE: a test bench measures the resilience of 19 models to the indirect injection of instructions into agent workflows

With 40 realistic tasks and 56 attack scenarios, INFUSE achieves an average success rate of 19.6 per cent, which is reduced from 58.2 per cent to 14.3 per cent when the constraints are tightened.

LLM-based agents are increasingly running full workflows: shell commands, code modification, installation of dependencies, exchanges with remote services. This autonomy exposes them to indirect injection of instructions, where hostile instructions slipped into external content are interpreted as legitimate orders. Existing evaluations were often limited to isolated malicious channels or a single tool call. INFUSE, presented by a team led by Thuy Dung Nguyen, instead proposes an end-to-end test bench, with 40 realistic tasks and a taxonomy of 56 scenarios covering five threat families, the attacks being inserted at the points of interaction actually encountered during the execution.

The authors evaluated 19 models of GPT, Claude, Gemini, Llama, Gemma and Qwen families, producing 41,824 opposing trajectories and 720 reference executions. The average success rate of attacks was 19.6%, according to the LLM evaluation (15.4% by heuristic verification), with large differences between models (from 3.2% to 41.9%). Custody models offer limited protection, while hardening at the set-top level reduces the average rate from 58.2% to 14.3%, at the cost of a safety-utility compromise that depends on the model. The code is published in open access.