Out of around 10,000 decisions and 15 US cases, false information misleads LLM agents far more effectively than traditional prompt injection: a 62 per cent success rate, compared with 14 per cent.
Agents based on large language models are already managing real money based on news feeds. Mengxiao Wang and Nitesh Saxena show that they are still unable to distinguish a made-up dispatch from a real one. Their testbed, published on arXiv, distinguishes between "information injection," which falsifies the elements on which the agent bases his decision, and prompt injection, which targets his instructions. It covers five attack vectors and seven types of events, out of about 10,000 decisions involving 15 U.S. actions.
Form matters more than substance
The result contradicts the usual intuition: prompt injection is only successful in 14% of cases, while fake news reaches 62%, and two 30-word patterns hit the nail on the head out of the 15 titles tested. It's the signs of credibility that do everything: removing the name of a source or the mention "BREAKING" drops the success rate from 100% to 0%, while the false claim remains the same. The agent's condition also matters: a fake indicator board deceives 91% of agents willing to hold a position, but only 12% of those about to buy.
Because these agents read the same feeds with similar strategies, a single fake post could cause them to place the same order at the same time. Attacks work regardless of the model's vendor, even if they are drowned out by a feed of real news. Traditional defenses mostly fail: larger models resist the crudest vectors, not the poisoning of facts, and having multiple agents debate doesn't help. Only hierarchical aggregation of decisions lowers the success rate.
Read the full article on the original source
Go to the source →