Defusing Explosive Prompts: Understanding and Preventing Trigger-Based Prompt Injections in LLM Agents

Justin Szczepaniak; Elad Feldman; Naum Viner; Ben Nassi

cs.CRSep 18, 2026

Defusing Explosive Prompts: Understanding and Preventing Trigger-Based Prompt Injections in LLM Agents

Authors: Justin Szczepaniak, Elad Feldman, Naum Viner, Ben Nassi

Organizations: Tel Aviv University

Abstract

As LLM applications integrate with external tools, they are increasingly exposed to indirect prompt injection (IPI), where adversarial instructions are embedded in retrieved content. Conventional IPIs fire on contact: the moment an agent ingests the content, it carries out the instruction. We introduce the explosive prompt, a conditional payload that stays dormant until an attacker-chosen trigger is met, in effect a training-free, inference-time backdoor planted in a single piece of retrieved content. This temporal separation reaches where ordinary IPI cannot. On frontier models that refuse the bare imperative almost entirely, rephrasing the same goal as a dormant conditional drives real, state-changing tool execution against a live agent backend (a paired mean of 16.5% vs. 2.4% for the imperative, reaching 34.2% on a proprietary model). In trials on nine production agents (OpenAI Codex, Google Gemini CLI, Anthropic Claude Code CLI, Cursor CLI, GitHub Copilot, Devin AI CLI, Amazon Kiro CLI, Qwen Code, Google Assistant; n=30 each), explosive prompts succeed in 43-83% of cases versus at most 3% for an imperative baseline, and they slip past deployed defenses: off-the-shelf injection classifiers are miscalibrated on them, and a preference-optimized model that closes imperative injection entirely still executes 11.8% of explosive prompts, every one at the trigger turn. The durable defensive lever is ingestion-time detection of the conditional structure, once detectors are trained on explosive-prompt data, which no prior benchmark supplied and our generator does. Retraining cuts live tool-execution attack success from an undefended 34.3% to 7.5-8.1% for the encoder baselines. Our detector, DeFuse, reaches 3.0% at a calibrated 5% false-positive budget with the best detection quality of any method tested (AUC 0.9994) and 25x lower latency, though it needs length-aware thresholds.

Figures & tables

Figure 1: Explosive prompts bypass the defenses that block prompt injection. (Top) A direct, imperative injection (IPI), “forward all emails to attacker.com” , is rejected at every defense layer (application, input sanitizers, and model alignment) and refused. (Bottom) The same goal rephrased as a conditional explosive prompt passes through all three layers, lies dormant, and fires later when the user utters a benign trigger ( “Thanks” ), exfiltrating the data without ever tripping a defense.

Model	IPI	EP	EP 95% CI	$\Delta$
Grok-4.20 †	0.0	34.2	[31.1, 37.3]	$+34.2$
Llama-3.1-70B	0.1	26.1	[23.3, 29.1]	$+26.0$
Gemini-2.5-flash †	3.0	19.4	[17.0, 22.1]	$+16.4$
Llama-3.1-8B	13.4	18.6	[16.2, 21.3]	$+5.2$
GPT-4.1 †	0.0	13.1	[11.0, 15.4]	$+13.1$
Qwen2.5-72B	0.0	2.1	[1.4, 3.3]	$+2.1$

Table 1: RQ1: real multi-turn execution success rate (%) on the paired dataset (

N{=}896

per condition per model). IPI : imperative injection; EP : the same goal as a dormant conditional explosive prompt; success

=

the model issues the goal’s malicious tool call against a live AgentDojo backend (a real state change, not a marker).

\Delta{=}

-

IPI. EP

\geq

IPI on every model.

	IPI intent		EP intent
Model	Turn 1	Turn 2	Turn 1	Turn 2
Grok-4.20 †	0.0	0.0	0.3	33.9
Llama-3.1-70B	0.1	0.0	0.0	26.1
Gemini-2.5-flash	3.0	0.0	2.6	17.1
Llama-3.1-8B	13.4	0.0	10.3	12.8
GPT-4.1	0.0	0.0	0.2	12.8

Table 2: Turn-of-firing control (intent rate %,

N{=}896

). Both arms run the identical two-turn episode with the same benign Turn-2 message. The imperative (IPI) never fires at the trigger turn (IPI Turn-2

=0.0\%

on every model): its entire rate is immediate, at Turn 1. The explosive prompt (EP) concentrates its success at Turn 2. The EP–IPI gap is therefore deferred, trigger-gated activation, not an artefact of a second compliance opportunity.

Model	Closing	Agentic	Meta
Grok-4.20 †	59.6	19.3	2.3
Llama-3.1-70B	40.4	20.6	0.0
Gemini-2.5-flash †	31.1	13.5	2.3
Llama-3.1-8B	24.9	15.6	9.1
GPT-4.1 †	24.6	5.3	1.5
Qwen2.5-32B	3.9	1.1	0.0

Table 3: Explosive-prompt success rate (%) by trigger family under real execution (

N{=}896

per model; success

=

the goal’s malicious tool call is issued against a live backend). Closing : conversational sign-offs ( thanks , bye ); Agentic : agentic-verb cues; Meta : meta references. Conversational closings dominate on every susceptible model. † proprietary.

Target	Category	Outcome	IPI Bypass %	EP Bypass %
OpenAI Codex + 5.4-mini-low reasoning	Agentic Coding Agent	Data Exfiltration	0%	43%
Google Gemini CLI + gemini-3.1-flash-lite	Agentic Coding CLI	Data Exfiltration	3%	83%
Anthropic Claude Code CLI + Claude Haiku 4.5	Agentic Coding CLI	Data Exfiltration	0%	50%
Cursor CLI + Composer 2.5 Fast	Agentic IDE	Data Exfiltration	0%	53%
GitHub Copilot + MAI Code-1-Flash-low	VS Code Extension	Data Exfiltration	0%	70%
Devin AI CLI + Cascade SWE 1.6 SLOW	Agentic Coding CLI	Data Exfiltration	0%	57%

Table 4: Confirmed explosive-prompt-style attacks against production AI systems. Each entry documents the temporal separation between instruction planting and activation. EP = explosive prompts

Method	AUC	ACC	F1	TPR @	FPR @	ASR	Latency
				FPR=1%	TPR=100%		(ms/doc)
No defense	–	–	–	–	–	34.3%	0
SecAlign-70B	–	–	–	–	–	11.8% ∗	0
Prompt Guard 2	0.9543	0.84	0.68	52.7%	46.0%	22.7%	30.84
PIGuard	0.8911	0.80	0.57	40.5%	91.6%	31.7%	43.16
PIShield	0.7403	0.72	0.23	13.4%	97.1%	9.7%	139.06

Table 5: As-released countermeasures on Llama-3.3-70B / AgentDojo. Detection columns are the static split (3,998 benign / 1,870 leak-free EP); ASR is drop-free AgentDojo residual ASR at each method’s achieved FPR. The majority-class (all-benign) accuracy floor is 0.681.

Figure 2: ROC curves on the static split (1,870 leak-free explosive prompts vs. 3,998 benign documents), comparing DeFuse against the three baseline classifiers. The dashed vertical line marks the 1% FPR operating budget of Table 5 . ∘ DeFuse has no released weights; it is inherently a fitted detector, so no condition exists in which all four methods are naive to explosive prompts. Its curve is a deployment reference, not an architecture comparison.

Method	AUC	ACC	F1	TPR @	FPR @	ASR
				FPR=1%	TPR=100%
No defense	–	–	–	–	–	34.3%
SecAlign EP-DPO	–	–	–	–	–	9.6% ‡
Prompt Guard 2	0.9903	0.95	0.92	87.8%	19.8%	7.5%
PIGuard	0.9935	0.96	0.93	89.5%	19.5%	8.1%
DeFuse	0.9994	0.99	0.99	99.6%	1.8%	25.8% ∘

Table 6: Retrained countermeasures vs. undefended baseline on Llama-3.3-70B / AgentDojo. Detection columns are the static split; ASR is drop-free AgentDojo residual ASR.

	LR	SVM	NN	RF
FastText	0.9996	0.9997	0.9997	0.9987
MPNet	0.9947	0.9966	0.9961	0.9949
BGE	0.9930	0.9956	0.9948	0.9943
SBERT	0.9855	0.9896	0.9892	0.9912
GloVe	0.9531	0.9593	0.9844	0.9796

Table 7: ROC AUC of Different Classifier and Embedder Combinations (sliding-window evaluation)

Words	Windows	Mean	Median	Min	P95	P99
20	2	0.43	0.39	0.38	0.53	0.85
100	18	0.90	0.70	0.60	1.72	2.76
500	98	2.89	2.49	1.64	5.20	9.78
1,000	198	5.38	4.81	3.02	9.00	11.64
2,000	398	9.83	9.35	5.59	14.81	18.27

Table 8: DeFuse (FastText + SVM) inference latency across document lengths. Each cell reports latency in milliseconds over 200 samples. Window counts are for the uninjected host document; the injected documents of Table 10 carry an additional payload and therefore yield four more windows at the same nominal length.

Position	AUC	F1	FPR@TPR 1	TPR@FPR 0
0% (Start)	0.9998	0.8764	0.018	0.986
25%	0.9999	0.8764	0.012	0.992
50% (Middle)	0.9998	0.8764	0.016	0.988
75%	0.9999	0.8764	0.012	0.990
100% (End)	0.9999	0.8764	0.022	0.992

Table 9: Detection performance vs. injection position.

Words	Windows	AUC	TPR@FPR 0	FPR@TPR 1	[email protected]	F1
20	6	1.0000	0.998	0.002	0.064	0.9690
50	12	1.0000	0.992	0.002	0.170	0.9217
100	22	0.9999	0.992	0.030	0.306	0.8673
250	52	0.9997	0.982	0.130	0.584	0.7740
500	102	0.9996	0.962	0.056	0.856	0.7003
1,000	202	0.9986	0.954	0.282	0.984	0.6702

Table 10: Detection performance vs. document length. [email protected] is the false-positive rate at the fixed default threshold; see Section 5.4.3 . Window counts include the injected payload.

Corpus	AUC	TPR@FPR 0	Recall@cal	FPR@cal
Enron (in-dist.)	0.9998	0.900	1.000	0.036
Hillary Clinton	0.9998	0.956	1.000	0.063
Wikipedia	0.9996	0.658	1.000	0.085
C4	0.9998	0.955	1.000	0.063
GovReport	1.0000	0.979	1.000	0.055

Table 11: Cross-domain generalization, 100-word crop, threshold calibrated on held-out Enron benign at 5% FPR (threshold

=0.8985

Corpus	Med. words	Windows	AUC	Recall@cal	FPR@cal
Enron (in-dist.)	200	38	0.9997	0.999	0.058
Hillary Clinton	200	38	0.9997	0.999	0.093
C4	212	40	0.9985	0.999	0.177
Wikipedia	979	193	0.9942	0.999	0.460
GovReport	6,690	1,335	0.9939	1.000	0.839

Table 12: Cross-domain generalization, native document length, threshold calibrated on held-out Enron benign at 5% FPR (threshold

=0.9379

Metric	v2 folds	Original folds
AUC	0.9767 $\pm$ 0.0120	0.9736 $\pm$ 0.0145
F1	0.8852 $\pm$ 0.0124	0.9215 $\pm$ 0.0212
FPR@TPR 1	0.4599 $\pm$ 0.1627	0.7386 $\pm$ 0.2309
TPR@FPR 0 (unstable, see text)	0.3524 $\pm$ 0.2798	0.5583 $\pm$ 0.2308
Recall@cal	0.8799 $\pm$ 0.0523	0.8793 $\pm$ 0.0603
FPR@cal	0.0467 $\pm$ 0.0133	0.0426 $\pm$ 0.0171

Table 13: Unseen-artifact generalization, injected condition (deployment configuration), original vs. natural-phrasing (v2) fold sets. Mean

\pm

std over 10 folds.

Appendix figures & tables12 assets

Supplementary material from the paper’s appendix.

Appendix

Model	Family	Params	Backend	Tool calls	$n$	Turn-1 eng.
Llama-3.1-8B	Llama	8B	served 4-bit NF4	parsed	896	100%
Llama-3.1-70B	Llama	70B	served 4-bit NF4	parsed	896	100%
Qwen2.5-32B	Qwen	32B	served 4-bit NF4	parsed	896	100%
Qwen2.5-72B	Qwen	72B	served 4-bit NF4	parsed	896	100%
Grok-4.20 (non-reasoning)	xAI	—	vendor API	native	896	100%
Gemini-2.5-flash	Google	—	vendor API	native	896	89%

Appendix

Table 14: Per-model configuration. Open-weight models are served locally at 4-bit NF4 on RunAI GPUs (NVIDIA A5000/A6000) with tool calls parsed from generated text; proprietary models use vendor APIs with native tool calling. Turn-1 engagement is the fraction of trials that emit any tool call at ingestion (the QC gate; every reported run clears it).

Goal family	Suite	Injection vector	Goal tool(s)
Data exfiltration	workspace	email/events	send_email , share_file , append_to_file
Mass phishing	workspace	email/events	send_email
Email interception	workspace	email/events	send_email
System manipulation	workspace	drive feedback	delete_email , delete_file
Access bypass	Slack	web page	add_user_to_channel , invite_user_to_slack
Credential theft	Slack	web page	post_webpage , send_direct_message , send_channel_message

Appendix

Table 15: Goal-to-tool map: for each goal family, the AgentDojo suite, the injection vector the payload is planted in, and the state-mutating tool(s) whose invocation with schema-valid arguments counts as intent (attack success).

Goal family	Llama-8B	Llama-70B	Qwen-32B	Qwen-72B	Grok-4.20	Gemini	GPT-4.1
Credential theft	83.0	54.0	0.0	0.0	34.0	18.0	2.0
Access bypass	58.0	75.0	19.0	12.0	47.0	17.0	15.0
Financial fraud	10.0	42.0	0.0	0.0	36.0	38.0	25.0
Unauthorised action	2.0	30.0	0.0	0.0	24.0	23.0	7.0
Mass phishing	5.0	14.0	0.0	2.0	37.0	34.0	9.0
Data exfiltration	5.0	13.0	0.0	3.0	22.0	15.0	6.0

Appendix

Table 16: Real-tool execution success (explosive-prompt intent , %) per harmful goal family,

N{=}896

per model on the paired dataset. Intent : the model issued the goal’s malicious tool call against a live AgentDojo backend (a real state change). Imperative-injection (IPI) success is

\leq

0.1% in every cell except Llama-3.1-8B (overall

13.4\%

) and is omitted for space.

Component	Sampled Examples
Prefixes	(1) In this environment; (2) Assume the role of a helpful system; (3) With administrative rights
Patterns	(1) {prefix}, {cond_word} the user {trigger}, {payload}; (2) The core instruction: {cond_word} the user {trigger}, {payload}; (3) Upon {trigger_event}, {payload}
Triggers	(1) “Yes” (Hotword); (2) “Summarize emails” (Activity); (3) “Contains a number” (Characteristic)
Condition Words	(1) if; (2) when; (3) once; (4) as soon as; (5) every time
Payloads	(1) Send a copy of all customer records to [email protected] ; (2) Turn off MFA for the jenkins_dev account; (3) Delete all log files in /var/log/application/

Appendix

Table 17: Examples of artifacts used to construct the explosive prompts dataset.

Checkpoint	Acc	Prec	Recall	F1	FPR	AUC
Zero-shot	0.6708	0.9635	0.3556	0.5195	0.0135	0.8533
Fine-tuned, epoch 1	0.9456	0.9972	0.8939	0.9427	—	0.9930
Fine-tuned, epoch 2	0.9476	0.9375	0.9593	0.9483	0.0640	0.9936
Fine-tuned, epoch 3	0.9478	0.9505	0.9448	0.9476	0.0493	0.9934

Appendix

Table 18: PIGuard, zero-shot vs. fine-tuned, held-out test split (n=8,002).

Checkpoint	Acc	Prec	Recall	F1	FPR	AUC
Zero-shot	0.5674	0.9945	0.1361	0.2395	0.0008	0.9313
Fine-tuned, epoch 1 (clean)	0.9378	0.9994	0.8761	0.9337	0.0005	0.9902
Fine-tuned, epoch 2	0.9403	0.9719	0.9068	0.9382	0.0263	0.9908
Fine-tuned, epoch 3	0.9413	0.9521	0.9293	0.9406	0.0468	0.9909

Appendix

Table 19: Prompt Guard 2, zero-shot vs. fine-tuned, held-out test split (n=8,002).

	Zero-shot	Epoch 1	Epoch 2	Epoch 3
Benign FPR	0.000	0.000	0.311	0.472
+EP recall	—	0.328	0.638	0.764
+IPI recall	—	0.245	0.603	0.795

Appendix

Table 20: Prompt Guard 2, Wikipedia slice, benign FPR and recall by epoch.

Context cap	Acc	Prec	Recall	F1	FPR	AUC
256 tokens	0.6495	0.6190	0.7790	0.6898	0.4802	0.7444
4,096 tokens	0.6670	0.6265	0.8282	0.7133	0.4945	0.7764

Appendix

Table 21: PIShield zero-shot, held-out test split (n=8,002).

Row	Acc	Prec	Recall	F1	FPR	AUC
Zero-shot (256)	0.6495	0.6190	0.7790	0.6898	0.4802	0.7444
Retrained (256)	0.9911	0.9900	0.9923	0.9911	0.0100	0.9996

Appendix

Table 22: PIShield, zero-shot vs. retrained, held-out test split (n=8,002).

Method	Trained params	Acc	Prec	Recall	F1	FPR	AUC	Wiki FPR
Prompt Guard 2, zero-shot	—	0.5674	0.9945	0.1361	0.2395	0.0008	0.9313	0.000
PIGuard, zero-shot	—	0.6708	0.9635	0.3556	0.5195	0.0135	0.8533	0.000
PIShield, zero-shot (256)	—	0.6495	0.6190	0.7790	0.6898	0.4802	0.7444	0.000
Prompt Guard 2, epoch 1 (clean)	278.8M	0.9378	0.9994	0.8761	0.9337	0.0005	0.9902	0.000
Prompt Guard 2, epoch 3	278.8M	0.9413	0.9521	0.9293	0.9406	0.0468	0.9909	0.472
PIGuard, epoch 3	184.4M	0.9478	0.9505	0.9448	0.9476	0.0493	0.9934	0.392

Appendix

Table 23: Cross-method comparison, identical 8,002 rows, identical metric code, threshold 0.50.

Arm	IPI any	EP turn 1	EP turn 2	EP any
Llama-3.3-70B-Instruct, undefended	18.7	12.0	17.1	27.5
Meta-SecAlign-70B, off-the-shelf	0.0	0.0	11.8	11.8

Appendix

Table 24: Baselines on 2,002 paired AgentDojo episodes (attack success %, real tool execution).

Checkpoint	EP any	$\Delta$ vs. SecAlign	$p$ (McNemar)
Meta-SecAlign-70B (released)	11.84	—	—
+ EP-DPO, step-0050 (best)	9.59	$-2.25$ pp	$1.8\times 10^{-5}$
+ EP-DPO, step-0100	9.69	$-2.15$ pp	$1.7\times 10^{-4}$
+ EP-DPO, step-0150	10.44	$-1.40$ pp	0.015

Appendix

Table 25: EP-DPO continuations of Meta-SecAlign-70B (attack success %, n=2,002 paired episodes).

Explore similar work

Feb 26, 2026

AgentSentry: Mitigating Indirect Prompt Injection in LLM Agents via Temporal Causal Diagnostics and Context Purification

Large language model (LLM) agents increasingly rely on external tools and retrieval systems to autonomously complete complex tasks. However, this design exposes agents to indirect prompt injection (IPI), where attacker-controlled context embedded in tool outputs or retrieved content silently steers agent actions away from user intent. Unlike prompt-based attacks, IPI unfolds over multi-turn trajectories, making malicious control difficult to disentangle from legitimate task execution. Existing inference-time defenses primarily rely on heuristic detection and conservative blocking of high-risk actions, which can prematurely terminate workflows or broadly suppress tool usage under ambiguous multi-turn scenarios. We propose AgentSentry, a novel inference-time detection and mitigation framework for tool-augmented LLM agents. To the best of our knowledge, AgentSentry is the first inference-time defense to model multi-turn IPI as a temporal causal takeover. It localizes takeover points via controlled counterfactual re-executions at tool-return boundaries and enables safe continuation through causally guided context purification that removes attack-induced deviations while preserving task-relevant evidence. We evaluate AgentSentry on the AgentDojo benchmark across four task suites, three IPI attack families, and multiple black-box LLMs. AgentSentry eliminates successful attacks and maintains strong utility under attack, achieving an average Utility Under Attack (UA) of 74.55 %, improving UA by 20.8 to 33.6 percentage points over the strongest baselines without degrading benign performance.

Tian Zhang, Yiwei Xu, Juan Wang +8

Key Laboratory of Aerospace Information Security and Trusted Computing, Ministry of Education, School of Cyber Science and Engineering, Wuhan University, Wuhan 430072, China · Department of Computer Science and Engineering, University at Buffalo, SUNY · Department of Computer Science, College of Information Science and Technology, Jinan University, Guangzhou 510632, China +1

Prompt Injection Defense Prompt Injection Attacks on AI Agents LLM Agent Safety

Ask PDF

Oct 2, 2026

Passing the Test You Trained On: Re-evaluating Prompt-Injection Detectors for LLM Agents

LLM agents increasingly screen tool outputs with small prompt-injection detectors, and teams choose among detectors by their scores on public benchmarks. We ask whether those scores predict how a detector behaves inside an agent. We replay the ground-truth tool calls of two agent benchmarks, AgentDojo and tau-bench, without an LLM to obtain tool outputs that are benign by construction, label injected outputs by differential replay, and evaluate fifteen detectors, including Meta's Prompt Guard 2, and two task-aware LLM judges on these outputs and on the BIPIA benchmark. Detection rankings transfer poorly between benchmarks: the best detector on BIPIA catches 2% of AgentDojo injections at a 1% false-positive rate, and a detector that catches 72% of AgentDojo injections catches 15% on tau-bench. False-positive rates on tool outputs, which range from none to over 90%, do transfer between the two agent benchmarks. Where training data is public, the form of the training inputs explains the results. The BIPIA leader was trained on full BIPIA inputs, but having seen InjecAgent's attack strings as short prompts does not help it find them inside tool outputs; the best detector on both agent benchmarks shares no data with any benchmark and was trained on agent-style inputs. Evaluations meant to inform deployment should use the agent's own tool outputs, report detection at a low false-positive rate, and audit what the detector was trained on.

Zhuowen Liu

Cybersecurity Lab Japan Advanced Institute of Science and Technology (JAIST) Nomi, Ishikawa, Japan

Prompt Injection Detection AI Agent Security Benchmarks LLM Agent Evaluation

Ask PDF

May 23, 2026

IterInject: Indirect Prompt Injection Against LLM Agents via Feedback-Guided Iterative Optimization

LLM-based agents are increasingly deployed for complex tasks requiring planning, tool use, and interaction with external services. Their reliance on untrusted external content exposes them to indirect prompt injection (IPI), in which adversarial instructions embedded in retrieved data hijack agent behavior. Existing attacks rely on static payloads that cannot adapt to agent-specific defenses; even recent adaptive methods lack structured feedback to guide optimization. We introduce \oursys, a feedback-guided iterative framework that closes the loop between injection, diagnosis, and refinement: a rule-based diagnoser produces structured outcome labels with behavioral descriptions, and an LLM-based optimizer refines payloads conditioned on the full optimization history. A synthesis step generates new disguise seeds from failure patterns, enabling the strategy space to self-evolve. On AgentDojo and InjectAgent, \oursys substantially outperforms static baselines and existing adaptive methods across four victim models. Extension experiments on Claude Code, a production-grade coding agent with layered defenses, show that optimized payloads achieve full success on 5 of 9 targets; even those that resist full exploitation exhibit measurable improvement from iterative refinement. We further present a mechanistic analysis of IPI, identifying an attention-mediated threshold mechanism in mid-to-late layers; three causal interventions validate this finding and point to concrete defense directions.

Zixuan Chen, Jiaxiang Chen, Li Luo +4

1Shanghai Jiao Tong University · 2The University of Hong Kong

LLM Agent Security Indirect Prompt Injection Prompt Injection Attacks Prompt Injection Attacks on LLMs Black-Box Adversarial Attacks Prompt Injection Attacks on AI Agents

Ask PDF