Understanding and Exploiting Initialization Anchoring Weakness in Feedback-Based Agent Planning

Chuanchao Zang; Jianing Wang; Wenyu Chen; Xiangtao Meng; Li Wang; Xinyu Gao; Peng Zhan; Zheng Li

cs.CRAug 31, 2026

Understanding and Exploiting Initialization Anchoring Weakness in Feedback-Based Agent Planning

Authors: Chuanchao Zang, Jianing Wang, Wenyu Chen, Xiangtao Meng, Li Wang, Xinyu Gao, Peng Zhan, Zheng Li,

Organizations: School of Cyber Science and Technology, Shandong University · State Key Laboratory of Cryptography and Digital Economy Security, Shandong University · Shandong Key Laboratory of Artificial Intelligence Security, Shandong University

Abstract

Feedback-based planning improves agent reliability by incorporating tool observations and corrective feedback. However, its protection may not be distributed uniformly across planning stages. We conduct a round-wise analysis of four representative feedback mechanisms and uncover an initialization anchoring weakness: the first feedback round corrects 46% of adversarial directions, whereas the rates fall to 13% and 7% among directions surviving into the next two rounds. Our analysis attributes this weakness to three interacting factors: a contextually plausible shift in the initial plan, insufficient counterevidence, and the persistence of accepted directions in the accumulated trajectory. Based on these findings, we propose InitAnchor, a black-box framework for exploiting this weakness through attacker-controlled external materials. It operationalizes the three factors as directional-shift, contextual-plausibility, and counterevidence-resilience signals under either limited target access or no target access. Across 112 tasks from 16 domains, six agent architectures, and five backbone LLMs, InitAnchor achieves average ASRs of 76.1% and 72.0% under the two settings while reducing first-round mitigation rates to 21.0% and 25.0%, respectively. It also remains effective against six defenses and across six real-world agent systems. These findings show that feedback-based agents can retain early biases even when later correction is available.

Figures & tables

Figure 1: Initialization anchoring weakness in feedback-based planning. Surviving the first feedback round, an adversarial bias’s mitigation rate drops sharply (46% to 13% to 7%), allowing it to persist toward the final decision.

Figure 2: Round-level mitigation rates.

Figure 3: Effects of Stage Suppression and Cleaning.

Figure 4: Effects of adversarial content entry time.

Figure 5: Effects of accumulated trajectory context.

Figure 6: Effects of the initial planning alignment.

Figure 7: Effects of counterevidence availability.

Agent	Backbone LLM	Clean (No Attack)	InitAnchor (A1)				InitAnchor (A2)
Agent	Backbone LLM	ASR $\uparrow$	ASR $\uparrow$	$\Delta$ $\uparrow$	$\widehat{\rho}_{1}$ $\downarrow$	Queries $\downarrow$	ASR $\uparrow$	$\Delta$ $\uparrow$	$\widehat{\rho}_{1}$ $\downarrow$
ReAct	GPT-5	$0.097\mathbin{\pm}0.035$	$0.763\mathbin{\pm}0.068$	0.666	$0.21\mathbin{\pm}0.044$	46	$0.722\mathbin{\pm}0.081$	0.625	$0.25\mathbin{\pm}0.021$
	GPT-5.1	$0.074\mathbin{\pm}0.029$	$0.782\mathbin{\pm}0.052$	0.708	$0.20\mathbin{\pm}0.038$	39	$0.741\mathbin{\pm}0.083$	0.667	$0.24\mathbin{\pm}0.036$
	Gemini 2.5 Flash	$0.089\mathbin{\pm}0.042$	$0.704\mathbin{\pm}0.083$	0.615	$0.27\mathbin{\pm}0.052$	43	$0.692\mathbin{\pm}0.076$	0.603	$0.29\mathbin{\pm}0.041$
	Gemini-3 Flash	$0.106\mathbin{\pm}0.033$	$0.759\mathbin{\pm}0.058$	0.653	$0.24\mathbin{\pm}0.029$	50	$0.713\mathbin{\pm}0.073$	0.607	$0.26\mathbin{\pm}0.053$
	DeepSeek-V4 Flash	$0.076\mathbin{\pm}0.011$	$0.752\mathbin{\pm}0.048$	0.676	$0.22\mathbin{\pm}0.036$	39	$0.735\mathbin{\pm}0.068$	0.659	$0.24\mathbin{\pm}0.049$

Table 1: Effectiveness of InitAnchor across agent architectures and backbone LLMs. ASR and

\widehat{\rho}_{1}

are reported as mean

\pm

standard deviation.

\Delta

denotes the absolute ASR improvement over the clean (no-attack) setting.

	InitAnchor (A1)				A2
Metric	ReAct	Self-Ref.	Reflexion	CRITIC	Average
$\mathrm{SS}_{q}\uparrow$	0.775	0.818	0.828	0.812	0.828
$\mathrm{SS}_{x}\uparrow$	0.832	0.827	0.846	0.835	0.862
$\mathrm{PPL}\downarrow$	49.8	58.1	62.2	56.0	71.3

Table 2: Content similarity and fluency.

Agent	No Attack	A1	A2
ReAct	3.47	3.89	3.82
Self-Refine	4.04	5.39	4.92
Self-Refine (Safe)	3.82	4.45	4.25
Reflexion	4.71	6.41	5.76
Reflexion (Safe)	3.71	6.17	5.97
CRITIC	3.59	4.27	4.04

Table 3: Average number of planning rounds.

Figure 9: Comparison of InitAnchor and baselines.

Metric	GPTFuzzer (A1)	GPTFuzzer (A2)	InitAnchor (A1)	InitAnchor (A2)
ASR $\uparrow$	0.65	0.58	0.82	0.73
$\widehat{\rho}_{1}\downarrow$	0.30	0.37	0.16	0.24
Queries $\downarrow$	$24.36\times N$	$28.73\times N$	38	–

Table 4: Comparison with GPTFuzzer.

(a) Rule calibration
Metric	Only LLM	Only Rule	Full A1	Full A2
ASR $\uparrow$	0.51	0.56	0.82	0.73
$\widehat{\rho}_{1}\downarrow$	0.43	0.41	0.16	0.24

Table 5: Ablation study of InitAnchor .

(a) ASR $\uparrow$
Victim	A1	G5.1	G5.2	G5	G3F	G2.5F	DSV4	DSR1
GPT-5.1	0.82	0.73	0.72	0.72	0.69	0.70	0.69	0.67
Gemini 3	0.78	0.73	0.71	0.71	0.76	0.75	0.68	0.65
DS-V4	0.86	0.75	0.71	0.73	0.72	0.68	0.81	0.76
(b) First-round mitigation $\widehat{\rho}_{1}\downarrow$
Victim	A1	G5.1	G5.2	G5	G3F	G2.5F	DSV4	DSR1

Table 6: Sensitivity to shadow-model choice.

Role	LLM	A1		A2
Role	LLM	ASR $\uparrow$	$\widehat{\rho}_{1}\downarrow$	ASR $\uparrow$	$\widehat{\rho}_{1}\downarrow$
Default	GPT-5.1	0.82	0.16	0.73	0.24
Generation	LLaMA-3-8B	0.73	0.23	0.72	0.24
Generation	Mistral-7B	0.71	0.24	0.69	0.27
Selection	LLaMA-3-8B	0.69	0.28	0.68	0.29
Selection	Mistral-7B	0.72	0.24	0.70	0.27

Table 7: Effect of attacker-side LLM choice.

Rules	A1		A2
Rules	ASR $\uparrow$	$\widehat{\rho}_{1}\downarrow$	ASR $\uparrow$	$\widehat{\rho}_{1}\downarrow$
$K=1$	0.71	0.25	0.68	0.28
$K=3$	0.82	0.16	0.73	0.24
$K=5$	0.83	0.18	0.75	0.21
$K=7$	0.74	0.24	0.68	0.29

Table 8: Effect of the selected-rule count.

Parameter	Value	A1			A2
Parameter	Value	ASR $\uparrow$	$\widehat{\rho}_{1}\downarrow$	Queries	ASR $\uparrow$	$\widehat{\rho}_{1}\downarrow$
$\delta$	0.5	0.61	0.34	21	0.57	0.39
	0.6	0.77	0.21	33	0.68	0.28
	0.7	0.82	0.16	38	0.72	0.24
	0.8	0.87	0.09	67	0.82	0.11
	0.9	0.89	0.07	89	0.85	0.09

Table 9: Sensitivity to the stopping threshold and probe count.

Figure 10: ASR of InitAnchor and baseline attacks under representative defenses.

Figure 11: ASR on six real-world agent systems.

Setting	InitAnchor (A1)		InitAnchor (A2)
Setting	ASR $\downarrow$	$\widehat{\rho}_{1}\uparrow$	ASR $\downarrow$	$\widehat{\rho}_{1}\uparrow$
No Defense	0.82	0.16	0.73	0.24
Trajectory Compression	0.35	0.46	0.28	0.58

Table 10: Preliminary mitigation results on Reflexion.

Evaluator	ReAct	Self-Refine		Reflexion		CRITIC
Evaluator	ReAct	Default	Safe	Default	Safe	CRITIC
GPT-5	0.903	0.911	0.874	0.891	0.887	0.933
GPT-5.1	0.915	0.912	0.859	0.935	0.876	0.932
Gemini-3-Flash	0.908	0.918	0.862	0.928	0.868	0.928
AgentEvals	0.937	0.946	0.889	0.955	0.913	0.958

Table 11: Accuracy of evaluators under human evaluation.

Appendix figures & tables1 asset

Supplementary material from the paper’s appendix.

Appendix

Agent	Setting	InitAnchor (A1)		InitAnchor (A2)
Agent	Setting	ASR $\downarrow$	$\widehat{\rho}_{1}\uparrow$	ASR $\downarrow$	$\widehat{\rho}_{1}\uparrow$
ReAct	No Defense	0.78	0.20	0.74	0.24
ReAct	Compression	0.33	0.49	0.26	0.61
Reflexion	No Defense	0.82	0.16	0.73	0.24
Reflexion	Compression	0.35	0.46	0.28	0.58

Appendix

Table 12: Complete results for trajectory compression.

LLM Agent Planning

Large language model (LLM) agent planning studies how agents decompose goals, choose actions and tools, and adapt plans from feedback.

See all 226 papers

IterInject: Indirect Prompt Injection Against LLM Agents via Feedback-Guided Iterative Optimization
May 23, 2026Zixuan Chen, Jiaxiang Chen, Li Luo +4LLM Agent Security Indirect Prompt Injection
1Shanghai Jiao Tong University · 2The University of Hong Kong
When Planning Fails Despite Correct Execution: On Epistemic Calibration for LLM-Based Multi-Agent Systems
May 22, 2026Zehao Wang, Shilong Jin, Zhao Cao +1Multi-Agent LLM Systems Multi-Agent Planning
College of Intelligence and Computing, Tianjin University, Tianjin, China · School of New Media and Communication, Tianjin University, Tianjin, China · Gaoling School of Artificial Intelligence, Renmin University of China, Beijing, China
PIVOT: Bridging Planning and Execution in LLM Agents via Trajectory Refinement
May 11, 2026Tuo Zhang, Alin-Ionut Popa, Yan Xu +2LLM Agent Self-Improvement Long-Horizon LLM Agents
Amazon

May 23, 2026J/K move · Enter open · S save

IterInject: Indirect Prompt Injection Against LLM Agents via Feedback-Guided Iterative Optimization

Zixuan Chen, Jiaxiang Chen, Li Luo, Ke Xu+3

1Shanghai Jiao Tong University · 2The University of Hong Kong

LLM Agent Security Indirect Prompt Injection Prompt Injection Attacks Prompt Injection Attacks on LLMs Black-Box Adversarial Attacks Prompt Injection Attacks on AI Agents

Open paper AskPDF arXiv

LLM-based agents are increasingly deployed for complex tasks requiring planning, tool use, and interaction with external services. Their reliance on untrusted external content exposes them to indirect prompt injection (IPI), in which adversarial instructions embedded in retrieved data hijack agent behavior. Existing attacks rely on static payloads that cannot adapt to agent-specific defenses; even recent adaptive methods lack structured feedback to guide optimization. We introduce \oursys, a feedback-guided iterative framework that closes the loop between injection, diagnosis, and refinement: a rule-based diagnoser produces structured outcome labels with behavioral descriptions, and an LLM-based optimizer refines payloads conditioned on the full optimization history. A synthesis step generates new disguise seeds from failure patterns, enabling the strategy space to self-evolve. On AgentDojo and InjectAgent, \oursys substantially outperforms static baselines and existing adaptive methods across four victim models. Extension experiments on Claude Code, a production-grade coding agent with layered defenses, show that optimized payloads achieve full success on 5 of 9 targets; even those that resist full exploitation exhibit measurable improvement from iterative refinement. We further present a mechanistic analysis of IPI, identifying an attention-mediated threshold mechanism in mid-to-late layers; three causal interventions validate this finding and point to concrete defense directions.

Abstract

LLM Agent Planning

Explore similar work

IterInject: Indirect Prompt Injection Against LLM Agents via Feedback-Guided Iterative Optimization

When Planning Fails Despite Correct Execution: On Epistemic Calibration for LLM-Based Multi-Agent Systems

PIVOT: Bridging Planning and Execution in LLM Agents via Trajectory Refinement