<?xml version="1.0" encoding="UTF-8"?>
<modsCollection xmlns="http://www.loc.gov/mods/v3">
<mods ID="liu-etal-2026-logicinception">
    <titleInfo>
        <title>LogicInception: Discourse-Level Indirect Prompt Injection via Causal Chain Construction</title>
    </titleInfo>
    <name type="personal">
        <namePart type="given">Mingshuai</namePart>
        <namePart type="family">Liu</namePart>
        <role>
            <roleTerm authority="marcrelator" type="text">author</roleTerm>
        </role>
    </name>
    <name type="personal">
        <namePart type="given">Yijie</namePart>
        <namePart type="family">Peng</namePart>
        <role>
            <roleTerm authority="marcrelator" type="text">author</roleTerm>
        </role>
    </name>
    <name type="personal">
        <namePart type="given">Chen</namePart>
        <namePart type="family">Dongxian</namePart>
        <role>
            <roleTerm authority="marcrelator" type="text">author</roleTerm>
        </role>
    </name>
    <name type="personal">
        <namePart type="given">Mingfeng</namePart>
        <namePart type="family">Li</namePart>
        <role>
            <roleTerm authority="marcrelator" type="text">author</roleTerm>
        </role>
    </name>
    <name type="personal">
        <namePart type="given">Xin</namePart>
        <namePart type="family">Li</namePart>
        <role>
            <roleTerm authority="marcrelator" type="text">author</roleTerm>
        </role>
    </name>
    <originInfo>
        <dateIssued>2026-10</dateIssued>
    </originInfo>
    <typeOfResource>text</typeOfResource>
    <relatedItem type="host">
        <titleInfo>
            <title>Proceedings of the 2026 Conference on Empirical Methods in Natural Language Processing</title>
        </titleInfo>
        <name type="personal">
            <namePart type="given">Hung-Yi</namePart>
            <namePart type="family">Lee</namePart>
            <role>
                <roleTerm authority="marcrelator" type="text">editor</roleTerm>
            </role>
        </name>
        <name type="personal">
            <namePart type="given">Sunipa</namePart>
            <namePart type="family">Dev</namePart>
            <role>
                <roleTerm authority="marcrelator" type="text">editor</roleTerm>
            </role>
        </name>
        <name type="personal">
            <namePart type="given">Jessy</namePart>
            <namePart type="family">Li</namePart>
            <role>
                <roleTerm authority="marcrelator" type="text">editor</roleTerm>
            </role>
        </name>
        <name type="personal">
            <namePart type="given">Desmond</namePart>
            <namePart type="family">Elliott</namePart>
            <role>
                <roleTerm authority="marcrelator" type="text">editor</roleTerm>
            </role>
        </name>
        <originInfo>
            <publisher>Association for Computational Linguistics</publisher>
            <place>
                <placeTerm type="text">Budapest, Hungary</placeTerm>
            </place>
        </originInfo>
        <genre authority="marcgt">conference publication</genre>
        <identifier type="isbn">979-8-89176-459-0</identifier>
    </relatedItem>
    <abstract>Existing indirect prompt injection (IPI) attacks commonly face a stealth-effectiveness tradeoff: features that make payloads effective can also make them detectable because attack intent is localized in a single payload. LogicInception moves IPI to discourse-level inference: attack logic is decomposed into register-matched declarative fragments distributed across tool outputs and linked by fabricated causal dependencies that the agent reconstructs through reasoning. To our knowledge, it is the first IPI framework to demonstrate successful unauthorized tool execution with no directive instruction anywhere in the injected content. No fragment contains a command or exploits instruction-following; the attack emerges from the agent’s own inference. We observe an empirical capability-safety amplification pattern: discourse-level amplification correlates with task capability across the evaluated models. On 1,139 scenarios with 5 defenses, LogicInception achieves 42.9-48.8% ASR at 88% per-fragment stealth, while all baselines remain below 8% composite success. The three prompt-level defenses reduce baseline ASR by up to 72% but reduce LogicInception by less than 7%; we trace this asymmetry to three architectural factors that motivate discourse-level rather than content-level countermeasures. This defense asymmetry is larger for higher-utility models in our evaluation, suggesting a tension between reasoning capability and safety.</abstract>
    <identifier type="citekey">liu-etal-2026-logicinception</identifier>
    <location>
        <url>https://aclanthology.org/2026.emnlp-main.1831/</url>
    </location>
    <part>
        <date>2026-10</date>
        <extent unit="page">
            <start>41686</start>
            <end>41702</end>
        </extent>
    </part>
</mods>
</modsCollection>

%0 Conference Proceedings
%T LogicInception: Discourse-Level Indirect Prompt Injection via Causal Chain Construction
%A Liu, Mingshuai
%A Peng, Yijie
%A Dongxian, Chen
%A Li, Mingfeng
%A Li, Xin
%Y Lee, Hung-Yi
%Y Dev, Sunipa
%Y Li, Jessy
%Y Elliott, Desmond
%S Proceedings of the 2026 Conference on Empirical Methods in Natural Language Processing
%D 2026
%8 October
%I Association for Computational Linguistics
%C Budapest, Hungary
%@ 979-8-89176-459-0
%F liu-etal-2026-logicinception
%X Existing indirect prompt injection (IPI) attacks commonly face a stealth-effectiveness tradeoff: features that make payloads effective can also make them detectable because attack intent is localized in a single payload. LogicInception moves IPI to discourse-level inference: attack logic is decomposed into register-matched declarative fragments distributed across tool outputs and linked by fabricated causal dependencies that the agent reconstructs through reasoning. To our knowledge, it is the first IPI framework to demonstrate successful unauthorized tool execution with no directive instruction anywhere in the injected content. No fragment contains a command or exploits instruction-following; the attack emerges from the agent’s own inference. We observe an empirical capability-safety amplification pattern: discourse-level amplification correlates with task capability across the evaluated models. On 1,139 scenarios with 5 defenses, LogicInception achieves 42.9-48.8% ASR at 88% per-fragment stealth, while all baselines remain below 8% composite success. The three prompt-level defenses reduce baseline ASR by up to 72% but reduce LogicInception by less than 7%; we trace this asymmetry to three architectural factors that motivate discourse-level rather than content-level countermeasures. This defense asymmetry is larger for higher-utility models in our evaluation, suggesting a tension between reasoning capability and safety.
%U https://aclanthology.org/2026.emnlp-main.1831/
%P 41686-41702

Markdown (Informal)

[LogicInception: Discourse-Level Indirect Prompt Injection via Causal Chain Construction](https://aclanthology.org/2026.emnlp-main.1831/) (Liu et al., EMNLP 2026)

• LogicInception: Discourse-Level Indirect Prompt Injection via Causal Chain Construction (Liu et al., EMNLP 2026)

ACL

• Mingshuai Liu, Yijie Peng, Chen Dongxian, Mingfeng Li, and Xin Li. 2026. LogicInception: Discourse-Level Indirect Prompt Injection via Causal Chain Construction. In Proceedings of the 2026 Conference on Empirical Methods in Natural Language Processing, pages 41686–41702, Budapest, Hungary. Association for Computational Linguistics.