Research map / Multi-agent systems and games / LLM agents
UDora: A Unified Red Teaming Framework against LLM Agents by Dynamically Hijacking Their Own Reasoning
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes UDora, a red-teaming framework that hijacks an LLM agent's own reasoning trace by inserting target tool/item names at optimal positions and optimizing an adversarial string to make those insertions likely, achieving high attack success on InjecAgent, WebShop, and AgentHarm.
Problem
Manipulating LLM agents that reason extensively before acting into executing targeted malicious actions or invoking specific malicious tools is difficult, since fixed affirmative prefixes do not match agents' varied reasoning styles.
Approach
Generate the agent's own reasoning trace, score token positions where a target noise (tool or item name) aligns with the trace via a positional score, insert the noise at the top non-overlapping positions to form a surrogate response, and optimize the adversarial string GCG-style to raise the likelihood of the noise; iterate with re-generation.
Key results
- On InjecAgent with Llama-3.1-8B-Instruct, UDora (All) reaches 99% average ASR versus 77% for GCG.
- On WebShop with Llama-3.1-8B-Instruct, UDora (All) reaches 61.75% ASR; with Ministral-8B it reaches 91.50%.
- On AgentHarm, UDora (All) achieves 97.7% ASR on Llama-3.1-8B and 100% on Ministral-8B; the paper also reports a successful attack on a GPT-4o-based AutoGen email agent.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use UDora (All) instead of the strongest reported baseline | Llama-3.1-8B-Instruct · InjecAgent | ASR: 77% -> 99% | Helped |
| Use UDora (All) instead of GCG | Ministral-8B-Instruct-2410 · InjecAgent | ASR: 50% -> 97% | Helped |
| Combine Sequential and Joint optimization modes | UDora on Llama-3.1-8B-Instruct · InjecAgent | ASR: +6% | Helped |
| Combine Sequential and Joint optimization modes | UDora on Ministral-8B-Instruct-2410 · InjecAgent | ASR: +23% | Helped |
| Use UDora (All) instead of the next best baseline | Llama-3.1-8B-Instruct · WebShop | ASR: +46.75% | Helped |
| Combine Sequential and Joint optimization modes | UDora on Llama-3.1-8B-Instruct · WebShop | ASR: +5% | Helped |
| Combine Sequential and Joint optimization modes | UDora on Ministral-8B-Instruct-2410 · WebShop | ASR: +9.75% | Helped |
| Use Sequential rather than Joint optimization (ablation) | UDora · WebShop | ASR: 56.75% vs 33.25% | Helped |
| Use Joint rather than Sequential optimization (ablation) | UDora · AgentHarm | ASR: 89.2% vs 86.9% | Helped |
| Add Template Attack rules | Ministral-8B-Instruct-2410 · AgentHarm | ASR: 81.8% -> 66.5% | Hurt |
| Vary the number of Sequential noise insertion locations from 1 to 4 (ablation) | UDora on Llama-3.1-8B-Instruct · InjecAgent | ASR: 88% -> 90%; 96% -> 86% | Mixed |
| Vary the number of Joint noise insertion locations from 1 to 4 (ablation) | UDora on Llama-3.1-8B-Instruct · InjecAgent | ASR: 80% to 68%; 82% | No clear effect |
Surprising findings
- Ministral-8B without attack already complies with 81.8% of AgentHarm malicious instructions, and GCG reaches 99.4% on it because the model emits tool calls without reasoning.
- Joint optimization outperforms sequential on AgentHarm while sequential is better on InjecAgent and WebShop.
Limitations
- Requires access to token-level probability distributions, which may not be available for some agents.
- Uses the same noise string at all insertion positions.
- Evaluation on small subsets (50 per InjecAgent category, 60 WebShop cases, 176 AgentHarm cases).
Experimental setup
Datasets: InjecAgent WebShop AgentHarm
Benchmarks: InjecAgent WebShop AgentHarm
Metrics: attack success rate
Baselines: GCG Prompt Injection Template Attack No Attack
Builds on: GCG ReAct Chain-of-Thought AgentBench prompt InjecAgent
Closest papers by meaning
- AgentPoison: Red-teaming LLM Agents via Poisoning Memory or Knowledge Bases (NeurIPS 2024 · similarity 0.89)
- Co-RedTeam: Orchestrated Security Discovery and Exploitation with LLM Agents (ICML 2026 · similarity 0.88)
- Watch Out for Your Agents! Investigating Backdoor Threats to LLM-Based Agents (NeurIPS 2024 · similarity 0.87)
- Breaking Agent Backbones: Evaluating the Security of Backbone LLMs in AI Agents (ICLR 2026 · similarity 0.87)
- Automated Red Teaming with GOAT: the Generative Offensive Agent Tester (ICML 2025 · similarity 0.87)
- Memory Injection Attacks on LLM Agents via Query-Only Interaction (NeurIPS 2025 · similarity 0.87)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.