Rethinking Indirect Prompt Injection as a Test-Time Search Problem

Abstract

We formulate indirect prompt injection as a test-time search over a task-dependent attack surface induced by the environment, user task, and injection task. To operationalize this formulation, we introduce an agentic attacker with a dedicated search harness that performs environment reconnaissance, structured reasoning over attack strategies, and adaptive evaluation using victim-agent feedback. Across heterogeneous tasks, we find that increasing attacker test-time compute improves vulnerability

Categories

Framework mappings

Suggested from the entry's categories.

@misc{nguyen2026rethinking,
  title = {{Rethinking Indirect Prompt Injection as a Test-Time Search Problem}},
  author = {Duong M. Nguyen and Joon Sik Kim and Blazej Manczak and Vaikkunth Mugunthan},
  year = {2026},
  month = sep,
  eprint = {2609.04495},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.04495}
}