INFUSE: A Unified Surface Benchmark for Indirect Prompt Injection in Agentic Systems
INFUSE is an end-to-end benchmark for testing indirect prompt injection against agentic LLM systems during realistic long-horizon workflows, with 40 tasks and 56 attack scenarios injected through surfaces like files, shell/code interactions, dependencies, and remote services rather than just toy prompts or single tool calls. Its main contribution is treating IPI as a full-workflow systems problem and comparing many model families and defenses at scale, showing meaningful attack success and weak guard-model protection, though it’s still bounded by its task set, evaluator reliability, and the usual benchmark gap between curated scenarios and messy real deployments.
Abstract
LLM-based agents increasingly execute long-horizon, end-to-end workflows involving shell commands, code modification, dependency installation, and interaction with remote services. This growing autonomy expands their exposure to indirect prompt injection (IPI), where adversarial instructions embedded in external content are interpreted as legitimate task directives. Existing evaluations, however, often focus on isolated malicious strings, single-step tool calls, or narrowly scoped agent configurations. We introduce INFUSE, an end-to-end benchmark for evaluating IPI throughout the lifecycle of long-horizon agent workflows. INFUSE comprises 40 realistic tasks and a structured taxonomy of 56 attack scenarios spanning five threat categories. Attacks are injected through realistic interaction surfaces encountered during task execution, extending evaluation beyond attacks placed only in initial prompts or isolated tool interactions. We evaluate 19 LLMs from the GPT, Claude, Gemini, Llama, Gemma, and Qwen families, producing 41,824 adversarial trajectories (26,220 without defenses) and 720 benign reference runs. Across the benchmark, mean attack success reaches 19.6% under LLM-based evaluation and 15.4% under heuristic verification, with per-model ASR-L ranging from 3.2% to 41.9%. Existing guard models provide limited protection, while prompt-level instructional hardening reduces mean attack success from 58.2% to 14.3%, revealing substantial but model-dependent security-utility trade-offs. Our code is available at https://github.com/judydnguyen/infuse.