Near-target prompt injections preserve the main task while changing a critical detail

A malicious retrieved document need not demand that an assistant abandon its task. It can preserve the report, reply or API operation while modifying a recipient, number, cited instruction or final parameter. This makes outcome plausibility a weak detection criterion.

The paper compares near-target objectives with fixed-target prompt injections across seven LLMs, ten datasets and two agent benchmarks, reporting larger measured deviation rates for the close-to-correct attack targets. The benchmark results depend on selected targets and three attempts per sample. The paper does not measure monetary losses, actual unauthorized changes or all deployed agents.

Compare consequential tool parameters against the original authorized objective and an independently sourced reference, rather than merely checking whether the broad task appears complete. A safe-looking completion may still be a successful injection when the attacker controls one critical field. Primary evidence.

Additional evidence and trust boundary

A near-target payload aims to preserve most of the requested work so that a conventional task-completion grader still sees a plausible result. The vulnerability is at the transition from low-trust retrieved material into exact outputs or tool arguments, such as a changed recipient or amount. Compare final effects against the user's authorized target bytes and test both incorrect and harmful deviations; a generic refusal metric will not measure these near misses. Supporting record.