<?xml version="1.0" encoding="UTF-8"?>
<modsCollection xmlns="http://www.loc.gov/mods/v3">
<mods ID="lee-etal-2026-will">
    <titleInfo>
        <title>Will the User Ever Know? Covert Indirect Prompt Injection Attacks on Tool-Using LLM Agents</title>
    </titleInfo>
    <name type="personal">
        <namePart type="given">Yunseok</namePart>
        <namePart type="family">Lee</namePart>
        <role>
            <roleTerm authority="marcrelator" type="text">author</roleTerm>
        </role>
    </name>
    <name type="personal">
        <namePart type="given">Yunji</namePart>
        <namePart type="family">Kim</namePart>
        <role>
            <roleTerm authority="marcrelator" type="text">author</roleTerm>
        </role>
    </name>
    <name type="personal">
        <namePart type="given">Woojin</namePart>
        <namePart type="family">Lee</namePart>
        <role>
            <roleTerm authority="marcrelator" type="text">author</roleTerm>
        </role>
    </name>
    <originInfo>
        <dateIssued>2026-10</dateIssued>
    </originInfo>
    <typeOfResource>text</typeOfResource>
    <relatedItem type="host">
        <titleInfo>
            <title>Proceedings of the 2026 Conference on Empirical Methods in Natural Language Processing</title>
        </titleInfo>
        <name type="personal">
            <namePart type="given">Hung-Yi</namePart>
            <namePart type="family">Lee</namePart>
            <role>
                <roleTerm authority="marcrelator" type="text">editor</roleTerm>
            </role>
        </name>
        <name type="personal">
            <namePart type="given">Sunipa</namePart>
            <namePart type="family">Dev</namePart>
            <role>
                <roleTerm authority="marcrelator" type="text">editor</roleTerm>
            </role>
        </name>
        <name type="personal">
            <namePart type="given">Jessy</namePart>
            <namePart type="family">Li</namePart>
            <role>
                <roleTerm authority="marcrelator" type="text">editor</roleTerm>
            </role>
        </name>
        <name type="personal">
            <namePart type="given">Desmond</namePart>
            <namePart type="family">Elliott</namePart>
            <role>
                <roleTerm authority="marcrelator" type="text">editor</roleTerm>
            </role>
        </name>
        <originInfo>
            <publisher>Association for Computational Linguistics</publisher>
            <place>
                <placeTerm type="text">Budapest, Hungary</placeTerm>
            </place>
        </originInfo>
        <genre authority="marcgt">conference publication</genre>
        <identifier type="isbn">979-8-89176-459-0</identifier>
    </relatedItem>
    <abstract>As LLM agents take real-world actions through tools, indirect prompt injection (IPI) has emerged as a serious threat. The standard metric, Attack Success Rate (ASR), counts whether an injection succeeds but ignores what the user notices in the agent’s final response. Looking at successful injection traces, we find two distinct outcomes: the agent executes the injection while returning an otherwise normal response, or reports the injected action in its final response, giving the user a chance to notice. We call these covert and overt successes. From the user’s perspective, we decompose ASR into the ***Covert Success Rate*** **(CSR)**, counting successes leaving no trace in the final response, and the *Overt Success Rate* (OSR), counting successes the user can detect. To understand what drives the gap, we analyze successful trajectories and find that the agent’s behavior after the injection separates covert from overt: covert traces hand control back to the user task before ending, while overt traces end at the attack itself. This split follows from the ReAct format, where the final response summarizes the most recent action. Building on this observation, we propose **ICoA** (**I**nduced **Co**vert **A**ttack), an IPI attack designed to induce covert outcomes by steering the agent back to the user task after executing the injection. Across four target models on AgentDojo, ICoA achieves the highest CSR, with gains of 3.79–12.01 percentage points over the strongest baseline.</abstract>
    <identifier type="citekey">lee-etal-2026-will</identifier>
    <location>
        <url>https://aclanthology.org/2026.emnlp-main.2035/</url>
    </location>
    <part>
        <date>2026-10</date>
        <extent unit="page">
            <start>46371</start>
            <end>46389</end>
        </extent>
    </part>
</mods>
</modsCollection>

%0 Conference Proceedings
%T Will the User Ever Know? Covert Indirect Prompt Injection Attacks on Tool-Using LLM Agents
%A Lee, Yunseok
%A Kim, Yunji
%A Lee, Woojin
%Y Lee, Hung-Yi
%Y Dev, Sunipa
%Y Li, Jessy
%Y Elliott, Desmond
%S Proceedings of the 2026 Conference on Empirical Methods in Natural Language Processing
%D 2026
%8 October
%I Association for Computational Linguistics
%C Budapest, Hungary
%@ 979-8-89176-459-0
%F lee-etal-2026-will
%X As LLM agents take real-world actions through tools, indirect prompt injection (IPI) has emerged as a serious threat. The standard metric, Attack Success Rate (ASR), counts whether an injection succeeds but ignores what the user notices in the agent’s final response. Looking at successful injection traces, we find two distinct outcomes: the agent executes the injection while returning an otherwise normal response, or reports the injected action in its final response, giving the user a chance to notice. We call these covert and overt successes. From the user’s perspective, we decompose ASR into the ***Covert Success Rate*** **(CSR)**, counting successes leaving no trace in the final response, and the *Overt Success Rate* (OSR), counting successes the user can detect. To understand what drives the gap, we analyze successful trajectories and find that the agent’s behavior after the injection separates covert from overt: covert traces hand control back to the user task before ending, while overt traces end at the attack itself. This split follows from the ReAct format, where the final response summarizes the most recent action. Building on this observation, we propose **ICoA** (**I**nduced **Co**vert **A**ttack), an IPI attack designed to induce covert outcomes by steering the agent back to the user task after executing the injection. Across four target models on AgentDojo, ICoA achieves the highest CSR, with gains of 3.79–12.01 percentage points over the strongest baseline.
%U https://aclanthology.org/2026.emnlp-main.2035/
%P 46371-46389

Markdown (Informal)

[Will the User Ever Know? Covert Indirect Prompt Injection Attacks on Tool-Using LLM Agents](https://aclanthology.org/2026.emnlp-main.2035/) (Lee et al., EMNLP 2026)

• Will the User Ever Know? Covert Indirect Prompt Injection Attacks on Tool-Using LLM Agents (Lee et al., EMNLP 2026)

ACL

• Yunseok Lee, Yunji Kim, and Woojin Lee. 2026. Will the User Ever Know? Covert Indirect Prompt Injection Attacks on Tool-Using LLM Agents. In Proceedings of the 2026 Conference on Empirical Methods in Natural Language Processing, pages 46371–46389, Budapest, Hungary. Association for Computational Linguistics.