Toward Metacognitive One-Shot Indirect Prompt Injection: Strategy Abstraction Via Outcome-Conditioned Reflection

2026-08-09

AI Summary

This work addresses the realistic scenario where an adversary can interact with an unknown tool-augmented large language model agent only once. It proposes SAVOR, the first method to achieve single-query, indirect prompt injection without requiring feedback from the target. SAVOR decouples attack adaptation from online interaction by performing offline strategy distillation: it trains on result-conditioned reflective trajectories to extract and validate context-aware attack strategies, which are stored in a reusable strategy memory bank. At test time, it generates highly effective payloads with just a single query. The approach supports transfer across diverse defense mechanisms. Evaluated on Agent Security Bench and the newly introduced OpenClaw-IPI benchmark, SAVOR improves attack success rates by 2.5–11.8 percentage points over the strongest baseline and by over 23 percentage points compared to methods without strategic learning.

Abstract

Tool-using large language model (LLM) agents are vulnerable to indirect prompt injection (IPI), in which malicious instructions embedded in external observations manipulate subsequent agent decisions and actions. Most existing adaptive attacks rely on repeatedly querying and refining against the target agent, whereas realistic attackers may have only a single opportunity to interact with an unknown target agent. We propose SAVOR (Strategy Abstraction Via Outcome-Conditioned Reflection), which shifts attack adaptation from test-time iteration to offline strategy distillation. SAVOR performs outcome-conditioned reflection over successful and failed trajectories collected from disjoint training environments, validates context-conditioned candidate strategies, and iteratively consolidates them into a reusable strategy memory. At test time, the frozen memory guides the generation of a single payload for each unseen target, requiring only one target-agent query and no target-agent feedback. Across two benchmarks and three victim models, SAVOR attains the highest average attack success rate in all six settings, leading the strongest prior attack by 2.5 to 11.8 points and the same injection channel without strategy learning by 23.1 points on Agent Security Bench, which holds out attacker tools, and 28.6 points on OpenClaw-IPI, an executable benchmark we introduce that holds out attack goals and verifies attacks through tool interactions and execution receipts. A memory learned under one defense also transfers to another.

Problem

• indirect prompt injection
• one-shot attack
• tool-using LLM agents
• adaptive attack
• attack success rate

Innovation

• indirect prompt injection
• one-shot attack
• strategy abstraction
• outcome-conditioned reflection
• tool-using LLM agents