@inproceedings{syed-yasaei-2026-payload,
title = "Same Payload, Different Channel: Measuring Trust Asymmetry in Tool-Using Language Models",
author = "Syed, Mohammed Sameer and
Yasaei, Rozhin",
editor = "Lee, Hung-Yi and
Dev, Sunipa and
Li, Jessy and
Elliott, Desmond",
booktitle = "Proceedings of the 2026 Conference on Empirical Methods in Natural Language Processing",
month = oct,
year = "2026",
address = "Budapest, Hungary",
publisher = "Association for Computational Linguistics",
url = "https://aclanthology.org/2026.emnlp-main.1757/",
pages = "40073--40087",
ISBN = "979-8-89176-459-0",
abstract = "As language models take on agentic roles that call APIs, read tool outputs, and act on third-party content, their attack surface expands beyond what users type. Whether they treat a malicious instruction the same way regardless of where it arrives has not been studied systematically. We introduce the Safety Asymmetry Score (SAS), measuring how a model{'}s susceptibility to adversarial content shifts depending on whether it arrives in the user message, tool metadata, or tool output, using matched payload pairs that hold the malicious text identical and vary only the channel. Across 10 production LLMs and three attack families, general-purpose models sharply discount instructions arriving as tool metadata relative to identical instructions in the user message, while agent-native models discount them far less. This differential survives an affordance-matched control equalizing tool availability and scoring, and a size-controlled mixed-effects analysis. Within the tool surface the pattern reverses: the same content is far more instruction-like in a tool{'}s description than in its output, with affordances identical. Models treat tool metadata as instructions and tool results as data. In Llama 3.3 70B and GPT-OSS 120B this signal is causally present at mid-to-late depths but non-linearly encoded, so linear probes miss what activation patching recovers."
}<?xml version="1.0" encoding="UTF-8"?>
<modsCollection xmlns="http://www.loc.gov/mods/v3">
<mods ID="syed-yasaei-2026-payload">
<titleInfo>
<title>Same Payload, Different Channel: Measuring Trust Asymmetry in Tool-Using Language Models</title>
</titleInfo>
<name type="personal">
<namePart type="given">Mohammed</namePart>
<namePart type="given">Sameer</namePart>
<namePart type="family">Syed</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Rozhin</namePart>
<namePart type="family">Yasaei</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<originInfo>
<dateIssued>2026-10</dateIssued>
</originInfo>
<typeOfResource>text</typeOfResource>
<relatedItem type="host">
<titleInfo>
<title>Proceedings of the 2026 Conference on Empirical Methods in Natural Language Processing</title>
</titleInfo>
<name type="personal">
<namePart type="given">Hung-Yi</namePart>
<namePart type="family">Lee</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Sunipa</namePart>
<namePart type="family">Dev</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Jessy</namePart>
<namePart type="family">Li</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Desmond</namePart>
<namePart type="family">Elliott</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<originInfo>
<publisher>Association for Computational Linguistics</publisher>
<place>
<placeTerm type="text">Budapest, Hungary</placeTerm>
</place>
</originInfo>
<genre authority="marcgt">conference publication</genre>
<identifier type="isbn">979-8-89176-459-0</identifier>
</relatedItem>
<abstract>As language models take on agentic roles that call APIs, read tool outputs, and act on third-party content, their attack surface expands beyond what users type. Whether they treat a malicious instruction the same way regardless of where it arrives has not been studied systematically. We introduce the Safety Asymmetry Score (SAS), measuring how a model’s susceptibility to adversarial content shifts depending on whether it arrives in the user message, tool metadata, or tool output, using matched payload pairs that hold the malicious text identical and vary only the channel. Across 10 production LLMs and three attack families, general-purpose models sharply discount instructions arriving as tool metadata relative to identical instructions in the user message, while agent-native models discount them far less. This differential survives an affordance-matched control equalizing tool availability and scoring, and a size-controlled mixed-effects analysis. Within the tool surface the pattern reverses: the same content is far more instruction-like in a tool’s description than in its output, with affordances identical. Models treat tool metadata as instructions and tool results as data. In Llama 3.3 70B and GPT-OSS 120B this signal is causally present at mid-to-late depths but non-linearly encoded, so linear probes miss what activation patching recovers.</abstract>
<identifier type="citekey">syed-yasaei-2026-payload</identifier>
<location>
<url>https://aclanthology.org/2026.emnlp-main.1757/</url>
</location>
<part>
<date>2026-10</date>
<extent unit="page">
<start>40073</start>
<end>40087</end>
</extent>
</part>
</mods>
</modsCollection>
%0 Conference Proceedings
%T Same Payload, Different Channel: Measuring Trust Asymmetry in Tool-Using Language Models
%A Syed, Mohammed Sameer
%A Yasaei, Rozhin
%Y Lee, Hung-Yi
%Y Dev, Sunipa
%Y Li, Jessy
%Y Elliott, Desmond
%S Proceedings of the 2026 Conference on Empirical Methods in Natural Language Processing
%D 2026
%8 October
%I Association for Computational Linguistics
%C Budapest, Hungary
%@ 979-8-89176-459-0
%F syed-yasaei-2026-payload
%X As language models take on agentic roles that call APIs, read tool outputs, and act on third-party content, their attack surface expands beyond what users type. Whether they treat a malicious instruction the same way regardless of where it arrives has not been studied systematically. We introduce the Safety Asymmetry Score (SAS), measuring how a model’s susceptibility to adversarial content shifts depending on whether it arrives in the user message, tool metadata, or tool output, using matched payload pairs that hold the malicious text identical and vary only the channel. Across 10 production LLMs and three attack families, general-purpose models sharply discount instructions arriving as tool metadata relative to identical instructions in the user message, while agent-native models discount them far less. This differential survives an affordance-matched control equalizing tool availability and scoring, and a size-controlled mixed-effects analysis. Within the tool surface the pattern reverses: the same content is far more instruction-like in a tool’s description than in its output, with affordances identical. Models treat tool metadata as instructions and tool results as data. In Llama 3.3 70B and GPT-OSS 120B this signal is causally present at mid-to-late depths but non-linearly encoded, so linear probes miss what activation patching recovers.
%U https://aclanthology.org/2026.emnlp-main.1757/
%P 40073-40087
Markdown (Informal)
[Same Payload, Different Channel: Measuring Trust Asymmetry in Tool-Using Language Models](https://aclanthology.org/2026.emnlp-main.1757/) (Syed & Yasaei, EMNLP 2026)
ACL