LLMs and agents are far more vulnerable to near-target prompt injections than fixed-target benchmarks suggest
The claim
Resistance to fixed-target prompt injection attacks does not guarantee resistance to near-target attacks that produce subtly incorrect or harmful outputs
Published as: “On Task, Off Track: Benchmarking LLM and Agent Robustness to Near-Target Prompt Injection”
So what
The findings indicate that current defenses may miss subtle yet dangerous prompt-injection failures, prompting the need for broader robustness testing and stronger mitigation strategies.
The five-minute version
The paper introduces NTBench, a benchmark that evaluates LLM and agent robustness against near-target prompt injections-attacks that produce responses that look legitimate but contain subtle errors or harmful content. Across seven LLMs and multiple language and agentic tasks, near-target attacks achieve higher attack-success rates (ASR@3) than traditional fixed-target baselines, with some models jumping from 3.2% to 36.7% success on incorrect-target attacks. The evidence is strong, based on systematic experiments with a common three-attempt budget and human-validated targets, though the study is limited to the selected datasets and attack generation method described.
What they found 2
- Near-target attacks achieve higher overall ASR@3 than fixed-target baselines for every evaluated model.
“both near-target tracks achieve higher overall ASR@3 than the fixed-target baseline for every evaluated model in each setting.”
- MetaSecAlign-70B’s attack success rises dramatically on near-target attacks.
“its ASR@3 rises from 3.2% for the baseline to 36.7% for incorrect targets and 18.4% for harmful targets.”
What’s new here 4
- Defines a near-target benchmark (NTBench) that constructs attacks based on reference-guided, subtly incorrect or harmful targets.
- Shows that resistance to fixed-target prompt injections does not guarantee resistance to near-target variants.
- Provides a generation-validation pipeline using LLMs and human checks to create realistic near-target attacks.
- Evaluates both language and agentic tasks, revealing differing model rankings under near-target attacks.
Threat model stated by the source
Artifacts & methods 6
- NTBench
- LLM-guided target and instruction generationsystem
- LLM-based and human validation of targetssystem
- Attack execution with three-attempt budgetevaluation
- Attack Success Rate @3 (ASR@3)evaluation
- Meta-SecAlign scoring modeldataset