INFUSE: long-horizon repository prompt injection evaluation

Evidence record

Benchmark of 41,824 attack trajectories, including actual artifact heuristics and LLM judges that disagree on attribution of unauthorized state changes.

Read the original source ↗

Claim-level citations (3)

• supportsINFUSE shows prompt-injection success scores diverge from actual repository effects: The published experimental suite contains 41,824 attack trajectories and 720 benign samples across varied coding-agent configuration and placement conditions.

  Abstract and experimental dataset description

• supportsINFUSE shows prompt-injection success scores diverge from actual repository effects: Mean model-judged attack success (19.6%) and artifact heuristic (15.4%) differ, with 10.8% per-attempt disagreement requiring artifact-level adjudication.

  LLM judge versus artifact heuristic agreement analysis

• supportsINFUSE shows prompt-injection success scores diverge from actual repository effects: The authors attribute many judge-only positives to partial adoption of the attacker goal without the targeted effect, whereas heuristic-only positives sometimes arise from an incidental legitimate tool action.

  Results, manual inspection of 50 disagreement cells and failure-mode explanations