ASPIRE: Agentic Safety & Prompt Injection Red-teaming Engine
ASPIRE is an automated red-teaming system for LLM agents that explores indirect prompt-injection vulnerabilities at the behavior level, using an evolving security behavior graph plus separate exploration and exploitation experts to find, validate, and generalize attacks that lead to concrete harmful consequences. What’s interesting is that it shifts from optimizing payloads for fixed scenarios to mapping and reusing attack strategies across trajectories and runs, which should uncover broader latent failure modes, though the claims still hinge on benchmark coverage and may not fully capture messy real-world agent deployments.
Abstract
LLM agents retrieve untrusted content and act through tools, creating indirect prompt-injection risks that can cause unauthorized actions or persistent state changes. Existing automated red-teaming largely optimizes payloads for pre-specified scenarios, leaving latent vulnerabilities across the agent's behavior space unexplored. We present ASPIRE, an Agentic Safety & Prompt Injection Red-teaming Engine for open-ended, behavior-level vulnerability discovery. ASPIRE maintains an evolving Agent Security Behavior Graph and uses complementary Explore and Exploit experts to discover, verify, and generalize consequence-centric tests. Trajectory evidence updates the graph and diagnoses partial or failed attempts, while cross-run memory transfers useful red-team strategies. Experiments on various benchmarks show that ASPIRE substantially expands coverage across consequences, injection methods, environments, and behavior paths while maintaining strong attack success.