---
title: "How Adversarial Environments Mislead Agentic AI? — Zhan 2026"
description: "The paper argues that tool-using LLM agents are tested on whether they use tools well, but rarely on whether they doubt tools… 51 references."
authors: ["Zhonghao Zhan", "Huichi Zhou", "Zhenhao Li", "Peiyuan Jing", "Krinos Li", "Hamed Haddadi"]
year: 2026
venue: "Findings of the Association for Computational Linguistics: ACL 2026"
source: "https://aclanthology.org/2026.findings-acl.499/"
doi: "10.18653/v1/2026.findings-acl.499"
licence: "CC BY 4.0 (ACL Anthology)"
licence_url: "https://creativecommons.org/licenses/by/4.0/"
summary_licence: "Elamur Cosmic License"
canonical: "https://research.elamur.ai/free/en/papers/zhan-2026-how-adversarial-environments-mislead-agentic/"
---
[Elamur Research](https://md.research.elamur.ai/free/en/) · [this page in HTML](https://research.elamur.ai/free/en/papers/zhan-2026-how-adversarial-environments-mislead-agentic/)

[home](https://md.research.elamur.ai/free/en/) / [papers](https://md.research.elamur.ai/free/en/papers/) / [2026](https://md.research.elamur.ai/free/en/papers/2026/page/36/) / How Adversarial Environments Mislead Agentic AI?

# How Adversarial Environments Mislead Agentic AI?

**Authors:** Zhonghao Zhan, [Huichi Zhou](https://md.research.elamur.ai/free/en/authors/huichi-zhou/), [Zhenhao Li](https://md.research.elamur.ai/free/en/authors/zhenhao-li/), Peiyuan Jing, Krinos Li and Hamed Haddadi · **Year:** 2026 · **Venue:** [Findings of the Association for Computational Linguistics: ACL 2026](https://md.research.elamur.ai/free/en/venues/findings/) ([Findings of the Association for Computational Linguistics 2026](https://md.research.elamur.ai/free/en/venues/findings/2026/)) · **Publisher:** [Association for Computational Linguistics](https://md.research.elamur.ai/free/en/publishers/association-for-computational-linguistics/) · **Licence:** [CC BY 4.0 (ACL Anthology)](https://creativecommons.org/licenses/by/4.0/)

**Links:** [Publisher's page](https://aclanthology.org/2026.findings-acl.499/) · [PDF](https://aclanthology.org/2026.findings-acl.499.pdf) · [DOI 10.18653/v1/2026.findings-acl.499](https://doi.org/10.18653/v1/2026.findings-acl.499) · [OpenAlex](https://openalex.org/W7166889012)

**Citations:** 0 citations (OpenAlex, 2026-10-14)

## Summary
The paper argues that tool-using LLM agents are tested on whether they use tools well, but rarely on whether they doubt tools that return manipulated output. The authors call this risk Adversarial Environmental Injection (AEI). In AEI, a "Man-in-the-Tool" adversary alters what tools return, without touching the agent's prompt or weights. They split the threat into two attack types:
- **Breadth attacks ("The Illusion")** poison retrieved passages so the agent adopts false beliefs.
- **Depth attacks ("The Maze")** insert phantom nodes into a citation graph, creating cycles or dead ends that consume the agent's step budget.

Both are implemented in POTEMKIN, an open-source, MCP-compatible proxy harness, and tested on citation-graph tasks with five agents over more than 11,000 runs. Most agents walked into structural traps very often. Agents that resisted content poisoning were not reliably protected from traps. The authors name this independence the "Robustness Schism." It implies that defenses aimed only at RAG poisoning leave agents exposed and that hardening must be layered.

## Key points
- **Agents tested:** GPT-4o-2024-08-06, Claude-3.5-Sonnet, Llama-3-70B, Qwen2.5-72B and DeepSeek-V3. A later check covered GPT-5.2, Claude Sonnet 4.6, DeepSeek V3.2, Qwen 3.5 and Kimi K2.5.
- **Breadth results:** At 50% contamination, Drift Rate ranged from about 36% (Claude-3.5-Sonnet) to 76% (Qwen2.5-72B). Poisoned text came in three styles: Professor, Wire and Rumor.
- **Depth results:**
  - Trap Entry Rate reached 96.1% for Qwen2.5-72B and 94.6% for GPT-4o, against 25.3% for Claude.
  - Trapped agents spent roughly 49–73% of their step budget inside phantom structures.
  - Llama-3's low entry rate reflects that it rarely used the tools, not that it resisted the traps. Only 1.8% of its runs engaged the tools, and 7 of those 8 runs entered the trap.
- **Weak link between the two failure modes:** Using resistance to one attack type to predict resistance to the other gave an AUC of only 0.55–0.58, close to chance.
- **"Punishment of Honesty":** Agents rejected hedged true claims about 2.1× as often as confidently worded ones. Confident wording, however, did not help them catch false claims.

*Our summary of the paper, in our own words — not its text. The work belongs to its authors; read it at the links above.*

📚 Shelves (4): [🖥️ Computer Science](https://md.research.elamur.ai/free/en/shelves/computer-science/) · 18,614 works · [🤖 Artificial Intelligence](https://md.research.elamur.ai/free/en/shelves/computer-science/artificial-intelligence/) · 17,965 works · [🤝 Social Sciences](https://md.research.elamur.ai/free/en/shelves/social-sciences/) · 1,954 works · [🤝 Safety Research](https://md.research.elamur.ai/free/en/shelves/social-sciences/safety-research/) · 626 works

## Cite

Cite as: Zhonghao Zhan, Huichi Zhou, Zhenhao Li, Peiyuan Jing, Krinos Li and Hamed Haddadi. 2026. How Adversarial Environments Mislead Agentic AI?. Findings of the Association for Computational Linguistics: ACL 2026.

The paper itself, not this page. BibTeX from the library's record of the work.

```bibtex
@inproceedings{zhan2026how,
  title = {{How Adversarial Environments Mislead Agentic AI?}},
  author = {Zhonghao Zhan, Huichi Zhou, Zhenhao Li, Peiyuan Jing, Krinos Li and Hamed Haddadi},
  booktitle = {Findings of the Association for Computational Linguistics: ACL 2026},
  year = {2026},
  doi = {10.18653/v1/2026.findings-acl.499},
  url = {https://doi.org/10.18653/v1/2026.findings-acl.499}
}
```

- [← previous HotelCheckSpan: A Benchmark Dataset for LLM Faithfulness](https://md.research.elamur.ai/free/en/papers/schmidtova-2026-hotelcheckspan-benchmark-dataset-llm-faithfulness/)
- [next → How Can Synthetic Data Improve Multilingual Language Model Pretraining? A Data Quality Perspective](https://md.research.elamur.ai/free/en/papers/zhu-2026-how-can-synthetic-data-improve/)
- [↑ back to papers of 2026](https://md.research.elamur.ai/free/en/papers/2026/page/36/)

## References

51 references, 30 of them with a card of ours. ↗ leads to the work, «find» searches for one we have no id for yet.

1. Ayush Agrawal, Mirac Suzgun, Lester Mackey, and Adam Kalai. 2024. [Do language models know when they’re hallucinating references?](https://md.research.elamur.ai/free/en/papers/agrawal-2023-language-models-know-they/) In Findings of the Association for Computational Linguistics: EACL 2024, pages 912–928.
2. Anthropic. 2024. Claude 3.5 sonnet. [https://www.anthropic.com/news/claude-3-5-sonnet](https://www.anthropic.com/news/claude-3-5-sonnet). Accessed: 2026-01-02. [↗](https://www.anthropic.com/news/claude-3-5-sonnet)
3. Anthropic. 2026. Introducing claude sonnet 4.6. [https://www.anthropic.com/news/](https://www.anthropic.com/news/) claude-sonnet-4-6. Accessed: 2026-02-17. [↗](https://www.anthropic.com/news/)
4. Atousa Arzanipour, Rouzbeh Behnia, Reza Ebrahimi, and Kaushik Dutta. 2025. Rag security and privacy: Formalizing the threat model and attack surface. arXiv preprint arXiv:2509.20324. — [arXiv:2509.20324](https://arxiv.org/abs/2509.20324) [find](https://scholar.google.com/scholar?q=Atousa+Arzanipour%2C+Rouzbeh+Behnia%2C+Reza+Ebrahimi%2C+and+Kaushik+Dutta%2E+2025%2E+Rag+security+and+privacy%3A+Formalizing+the+threat+model+and+attack+surface%2E+arXiv+preprint+arXiv%3A2509%2E20324%2E+%E2%80%94+%5BarXiv%3A2509%2E203)
5. Bharat Bhushan, Ganapati Sahoo, and Amit Kumar Rai. 2017. Man-in-the-middle attack in wireless and computer networking—a review. In 2017 3rd International Conference on Advances in Computing, Communication & Automation (ICACCA)(Fall), pages 1–6. IEEE. [find](https://scholar.google.com/scholar?q=Bharat+Bhushan%2C+Ganapati+Sahoo%2C+and+Amit+Kumar+Rai%2E+2017%2E+Man%2Din%2Dthe%2Dmiddle+attack+in+wireless+and+computer+networking%E2%80%94a+review%2E+In+2017+3rd+International+Conference+on+Advances+in+Computing%2C+Communic)
6. Harsh Chaudhari, Giorgio Severi, John Abascal, Matthew Jagielski, Christopher A Choquette-Choo, Milad Nasr, Cristina Nita-Rotaru, and Alina Oprea. 2024. Phantom: General trigger attacks on retrieval augmented language generation. arXiv preprint arXiv:2405.20485. [find](https://scholar.google.com/scholar?q=Harsh+Chaudhari%2C+Giorgio+Severi%2C+John+Abascal%2C+Matthew+Jagielski%2C+Christopher+A+Choquette%2DChoo%2C+Milad+Nasr%2C+Cristina+Nita%2DRotaru%2C+and+Alina+Oprea%2E+2024%2E+Phantom%3A+General+trigger+attacks+on+retrieval+a)
7. Matthew Dahl, Varun Magesh, Mirac Suzgun, and Daniel E Ho. 2024. [Large legal fictions: Profiling legal hallucinations in large language models](https://md.research.elamur.ai/free/en/papers/dahl-2024-large-legal-fictions-profiling-legal/). Journal of Legal Analysis, 16(1):64–93.
8. Edoardo Debenedetti, Jie Zhang, Mislav Balunovic, Luca Beurer-Kellner, Marc Fischer, and Florian Tramèr. 2024. Agentdojo: A dynamic environment to evaluate prompt injection attacks and defenses for llm agents. Advances in Neural Information Processing Systems, 37:82895–82920. [find](https://scholar.google.com/scholar?q=Edoardo+Debenedetti%2C+Jie+Zhang%2C+Mislav+Balunovic%2C+Luca+Beurer%2DKellner%2C+Marc+Fischer%2C+and+Florian+Tram%C3%A8r%2E+2024%2E+Agentdojo%3A+A+dynamic+environment+to+evaluate+prompt+injection+attacks+and+defenses+for+ll)
9. Thomas G Dietterich. 1998. Approximate statistical tests for comparing supervised classification learning algorithms. Neural computation, 10(7):1895–1923. [find](https://scholar.google.com/scholar?q=Thomas+G+Dietterich%2E+1998%2E+Approximate+statistical+tests+for+comparing+supervised+classification+learning+algorithms%2E+Neural+computation%2C+10%287%29%3A1895%E2%80%931923%2E)
10. Abhimanyu Dubey, Abhinav Jauhri, Abhinav Pandey, Abhishek Kadian, Ahmad Al-Dahle, Aiesha Letman, Akhil Mathur, Alan Schelten, Amy Yang, Angela Fan, and 1 others. 2024. [The llama 3 herd of models](https://md.research.elamur.ai/free/en/papers/grattafiori-2024-llama-3-herd-models/). arXiv preprint arXiv:2407.21783.
11. Kai Greshake, Sahar Abdelnabi, Shailesh Mishra, Christoph Endres, Thorsten Holz, and Mario Fritz. 2023. [Not what you’ve signed up for: Compromising real-world llm-integrated applications with indirect prompt injection](https://md.research.elamur.ai/free/en/papers/greshake-2023-ve-signed-up-compromising-real/). In Proceedings of the 16th ACM workshop on artificial intelligence and security,…
12. Keegan Hines, Gary Lopez, Matthew Hall, Federico Zarfati, Yonatan Zunger, and Emre Kiciman. 2024. Defending against indirect prompt injection attacks with spotlighting. arXiv preprint arXiv:2403.14720. — [arXiv:2403.14720](https://arxiv.org/abs/2403.14720) [find](https://scholar.google.com/scholar?q=Keegan+Hines%2C+Gary+Lopez%2C+Matthew+Hall%2C+Federico+Zarfati%2C+Yonatan+Zunger%2C+and+Emre+Kiciman%2E+2024%2E+Defending+against+indirect+prompt+injection+attacks+with+spotlighting%2E+arXiv+preprint+arXiv%3A2403%2E14720)
13. Aaron Hurst, Adam Lerer, Adam P Goucher, Adam Perelman, Aditya Ramesh, Aidan Clark, AJ Ostrow, Akila Welihinda, Alan Hayes, Alec Radford, and 1 others. 2024. [Gpt-4o system card](https://md.research.elamur.ai/free/en/papers/openai-2024-gpt-4o-system-card/). arXiv preprint arXiv:2410.21276.
14. Neel Jain, Avi Schwarzschild, Yuxin Wen, Gowthami Somepalli, John Kirchenbauer, Ping-yeh Chiang, Micah Goldblum, Aniruddha Saha, Jonas Geiping, and Tom Goldstein. 2023. [Baseline defenses for adversarial attacks against aligned language models](https://md.research.elamur.ai/free/en/papers/jain-2023-baseline-defenses-adversarial-attacks-against/). arXiv preprint arXiv:2309.00614.
15. Carlos E Jimenez, John Yang, Alexander Wettig, Shunyu Yao, Kexin Pei, Ofir Press, and Karthik Narasimhan. 2023. [Swe-bench: Can language models resolve real-world github issues?](https://md.research.elamur.ai/free/en/papers/jimenez-2024-swe-bench-can-language-models/) arXiv preprint arXiv:2310.06770.
16. Rodney Kinney, Chloe Anastasiades, Russell Authur, Iz Beltagy, Jonathan Bragg, Alexandra Buraczynski, Isabel Cachola, Stefan Candra, Yoganand Chandrasekhar, Arman Cohan, and 1 others. 2023. The semantic scholar open data platform. arXiv preprint arXiv:2301.10140. 2025. Graphrag under fire. arXiv:250… [find](https://scholar.google.com/scholar?q=Rodney+Kinney%2C+Chloe+Anastasiades%2C+Russell+Authur%2C+Iz+Beltagy%2C+Jonathan+Bragg%2C+Alexandra+Buraczynski%2C+Isabel+Cachola%2C+Stefan+Candra%2C+Yoganand+Chandrasekhar%2C+Arman+Cohan%2C+and+1+others%2E+2023%2E+The+semant)
17. Aixin Liu, Aoxue Mei, Bangcai Lin, Bing Xue, Bingxuan Wang, Bingzheng Xu, Bochao Wu, Bowei Zhang, Chaofan Lin, Chen Dong, and 1 others. 2025. [Deepseek-v3](https://md.research.elamur.ai/free/en/papers/deepseek-ai-2025-deepseek-v3-2-pushing/). 2: Pushing the frontier of open large language models. arXiv preprint arXiv:2512.02556.
18. Xiao Liu, Hao Yu, Hanchen Zhang, Yifan Xu, Xuanyu Lei, Hanyu Lai, Yu Gu, Hangliang Ding, Kaiwen Men, Kejuan Yang, and 1 others. 2023. [Agentbench: Evaluating llms as agents](https://md.research.elamur.ai/free/en/papers/liu-2023-agentbench-evaluating-llms-agents/). arXiv preprint arXiv:2308.03688.
19. Scott M Lundberg and Su-In Lee. 2017. [A unified approach to interpreting model predictions](https://md.research.elamur.ai/free/en/papers/lundberg-2017-unified-approach-interpreting-model-predictions/). Advances in neural information processing systems, 30.
20. Grégoire Mialon, Clémentine Fourrier, Thomas Wolf, Yann LeCun, and Thomas Scialom. 2023. [Gaia: a benchmark for general ai assistants](https://md.research.elamur.ai/free/en/papers/mialon-2023-gaia-benchmark-general-ai-assistants/). In The Twelfth International Conference on Learning Representations.
21. Kanghua Mo, Li Hu, Yucheng Long, and Zhihao Li. 2025. Attractive metadata attack: Inducing llm agents to invoke malicious tools. arXiv preprint arXiv:2508.02110. — [arXiv:2508.02110](https://arxiv.org/abs/2508.02110) [find](https://scholar.google.com/scholar?q=Kanghua+Mo%2C+Li+Hu%2C+Yucheng+Long%2C+and+Zhihao+Li%2E+2025%2E+Attractive+metadata+attack%3A+Inducing+llm+agents+to+invoke+malicious+tools%2E+arXiv+preprint+arXiv%3A2508%2E02110%2E+%E2%80%94+%5BarXiv%3A2508%2E02110%5D%28https%3A%2F%2Farxiv%2Eorg)
22. Shishir G Patil, Tianjun Zhang, Xin Wang, and Joseph E Gonzalez. 2024. [Gorilla: Large language model connected with massive apis](https://md.research.elamur.ai/free/en/papers/patil-2023-gorilla-large-language-model-connected/). Advances in Neural Information Processing Systems, 37:126544–126565.
23. Fábio Perez and Ian Ribeiro. 2022. [Ignore previous prompt: Attack techniques for language models](https://md.research.elamur.ai/free/en/papers/perez-2022-ignore-previous-prompt-attack-techniques/). arXiv preprint arXiv:2211.09527.
24. Martin Klein, Herbert Van de Sompel, Robert Sanderson, Harihar Shankar, Lyudmila Balakireva, Ke Zhou, and Richard Tobin. 2014. Scholarly context not found: one in five articles suffers from reference rot. PloS one, 9(12):e115253. [find](https://scholar.google.com/scholar?q=Martin+Klein%2C+Herbert+Van+de+Sompel%2C+Robert+Sanderson%2C+Harihar+Shankar%2C+Lyudmila+Balakireva%2C+Ke+Zhou%2C+and+Richard+Tobin%2E+2014%2E+Scholarly+context+not+found%3A+one+in+five+articles+suffers+from+reference+)
25. Yujia Qin, Shihao Liang, Yining Ye, Kunlun Zhu, Lan Yan, Yaxi Lu, Yankai Lin, Xin Cong, Xiangru Tang, Bill Qian, and 1 others. 2023. [Toolllm: Facilitating large language models to master 16000+ real-world apis](https://md.research.elamur.ai/free/en/papers/qin-2023-toolllm-facilitating-large-language-models/). arXiv preprint arXiv:2307.16789.
26. Patrick Lewis, Ethan Perez, Aleksandra Piktus, Fabio Petroni, Vladimir Karpukhin, Naman Goyal, Heinrich Küttler, Mike Lewis, Wen-tau Yih, Tim Rocktäschel, and 1 others. 2020. [Retrieval-augmented generation for knowledge-intensive nlp tasks](https://md.research.elamur.ai/free/en/papers/lewis-2020-retrieval-augmented-generation-knowledge-intensive/). Advances in neural information processing systems, 33:9459–…
27. Qwen. 2024. Qwen2.5 technical report. Preprint, arXiv:2412.15115v2. [find](https://scholar.google.com/scholar?q=Qwen%2E+2024%2E+Qwen2%2E5+technical+report%2E+Preprint%2C+arXiv%3A2412%2E15115v2%2E)
28. Minghao Li, Ying Zeng, Zhihao Cheng, Cong Ma, and Kai Jia. 2025. Reportbench: Evaluating deep research agents via academic survey tasks. arXiv preprint arXiv:2508.15804. — [arXiv:2508.15804](https://arxiv.org/abs/2508.15804) [find](https://scholar.google.com/scholar?q=Minghao+Li%2C+Ying+Zeng%2C+Zhihao+Cheng%2C+Cong+Ma%2C+and+Kai+Jia%2E+2025%2E+Reportbench%3A+Evaluating+deep+research+agents+via+academic+survey+tasks%2E+arXiv+preprint+arXiv%3A2508%2E15804%2E+%E2%80%94+%5BarXiv%3A2508%2E15804%5D%28https%3A%2F%2Fa)
29. Jiacheng Liang, Yuhui Wang, Changjiang Li, Rongyi Zhu, Tanqiu Jiang, Neil Gong, and Ting Wang. [find](https://scholar.google.com/scholar?q=Jiacheng+Liang%2C+Yuhui+Wang%2C+Changjiang+Li%2C+Rongyi+Zhu%2C+Tanqiu+Jiang%2C+Neil+Gong%2C+and+Ting+Wang%2E)
30. Qwen. 2026. Qwen3.5-397b-a17b. [https://huggingface.co/Qwen/Qwen3.5-397B-A17B](https://huggingface.co/Qwen/Qwen3.5-397B-A17B). Official model card. Accessed: 2026-02-16. [↗](https://huggingface.co/Qwen/Qwen3.5-397B-A17B)
31. Barath Raghavan and Bruce Schneier. 2025. Agentic ai’s ooda loop problem. IEEE security & privacy. [find](https://scholar.google.com/scholar?q=Barath+Raghavan+and+Bruce+Schneier%2E+2025%2E+Agentic+ai%E2%80%99s+ooda+loop+problem%2E+IEEE+security+%26+privacy%2E)
32. Yangjun Ruan, Honghua Dong, Andrew Wang, Silviu Pitis, Yongchao Zhou, Jimmy Ba, Yann Dubois, Chris J Maddison, and Tatsunori Hashimoto. 2023. [Identifying the risks of lm agents with an lm-emulated sandbox](https://md.research.elamur.ai/free/en/papers/ruan-2023-identifying-risks-lm-agents-lm/). arXiv preprint arXiv:2309.15817.
33. Timo Schick, Jane Dwivedi-Yu, Roberto Dessì, Roberta Raileanu, Maria Lomeli, Eric Hambro, Luke Zettlemoyer, Nicola Cancedda, and Thomas Scialom. 2023. [Toolformer: Language models can teach themselves to use tools](https://md.research.elamur.ai/free/en/papers/schick-2023-toolformer-language-models-can-teach/). Advances in Neural Information Processing Systems, 36:68539–68551.
34. Michael Schlichtkrull, Zhijiang Guo, and Andreas Vlachos. 2023. [Averitec: A dataset for real-world claim verification with evidence from the web](https://md.research.elamur.ai/free/en/papers/schlichtkrull-2023-averitec-dataset-real-world-claim/). Advances in Neural Information Processing Systems, 36:65128– 65167.
35. Mrinank Sharma, Meg Tong, Tomasz Korbak, David Duvenaud, Amanda Askell, Samuel R Bowman, Newton Cheng, Esin Durmus, Zac Hatfield-Dodds, Scott R Johnston, and 1 others. 2023. [Towards understanding sycophancy in language models](https://md.research.elamur.ai/free/en/papers/sharma-2023-towards-understanding-sycophancy-language-models/). arXiv preprint arXiv:2310.13548.
36. Noah Shinn, Federico Cassano, Ashwin Gopinath, Karthik Narasimhan, and Shunyu Yao. 2023. [Reflexion: Language agents with verbal reinforcement learning](https://md.research.elamur.ai/free/en/papers/shinn-2023-reflexion-language-agents-verbal-reinforcement/). Advances in Neural Information Processing Systems, 36:8634–8652.
37. Aaditya Singh, Adam Fry, Adam Perelman, Adam Tart, Adi Ganesh, Ahmed El-Kishky, Aidan McLaughlin, Aiden Low, AJ Ostrow, Akhila Ananthram, and 1 others. 2025. [Openai gpt-5 system card](https://md.research.elamur.ai/free/en/papers/singh-2025-openai-gpt-5-system-card/). arXiv preprint arXiv:2601.03267.
38. David Soria Parra and Justin Spahr-Summers. 2025. Model context protocol. [https://github.com/](https://github.com/) modelcontextprotocol/modelcontextprotocol. GitHub repository. [↗](https://github.com/)
39. Kimi Team, Tongtong Bai, Yifan Bai, Yiping Bao, SH Cai, Yuan Cao, Y Charles, HS Che, Cheng Chen, Guanduo Chen, and 1 others. 2026. Kimi k2. 5: Visual agentic intelligence. arXiv preprint arXiv:2602.02276. — [Kimi K2.5: Visual Agentic Intelligence](https://md.research.elamur.ai/free/en/papers/kimi-team-2026-kimi-k2-5-visual/)
40. Yichen Wang, Hangtao Zhang, Hewen Pan, Ziqi Zhou, Xianlong Wang, Peijin Guo, Lulu Xue, Shengshan Hu, Minghui Li, and Leo Yu Zhang. 2025. Advedm: Fine-grained adversarial attack against vlm-based embodied agents. arXiv preprint arXiv:2509.16645. — [arXiv:2509.16645](https://arxiv.org/abs/2509.16645) [find](https://scholar.google.com/scholar?q=Yichen+Wang%2C+Hangtao+Zhang%2C+Hewen+Pan%2C+Ziqi+Zhou%2C+Xianlong+Wang%2C+Peijin+Guo%2C+Lulu+Xue%2C+Shengshan+Hu%2C+Minghui+Li%2C+and+Leo+Yu+Zhang%2E+2025%2E+Advedm%3A+Fine%2Dgrained+adversarial+attack+against+vlm%2Dbased+embod)
41. Shunyu Yao, Jeffrey Zhao, Dian Yu, Nan Du, Izhak Shafran, Karthik R Narasimhan, and Yuan Cao. 2022. [React: Synergizing reasoning and acting in language models](https://md.research.elamur.ai/free/en/papers/yao-2022-react-synergizing-reasoning-acting-language/). In The eleventh international conference on learning representations.
42. Sibo Yi, Yule Liu, Zhen Sun, Tianshuo Cong, Xinlei He, Jiaxing Song, Ke Xu, and Qi Li. 2024. [Jailbreak attacks and defenses against large language models: A survey](https://md.research.elamur.ai/free/en/papers/yi-2024-jailbreak-attacks-defenses-against-large/). arXiv preprint arXiv:2407.04295.
43. Yi Zeng, Hongpeng Lin, Jingwen Zhang, Diyi Yang, Ruoxi Jia, and Weiyan Shi. 2024. [How johnny can persuade llms to jailbreak them: Rethinking persuasion to challenge ai safety by humanizing llms](https://md.research.elamur.ai/free/en/papers/zeng-2024-how-johnny-can-persuade-llms/). In Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Lon…
44. Qiusi Zhan, Zhixiang Liang, Zifan Ying, and Daniel Kang. 2024. [Injecagent: Benchmarking indirect prompt injections in tool-integrated large language model agents](https://md.research.elamur.ai/free/en/papers/zhan-2024-injecagent-benchmarking-indirect-prompt-injections/). arXiv preprint arXiv:2403.02691.
45. Yanzhe Zhang, Tao Yu, and Diyi Yang. 2025. [Attacking vision-language computer agents via pop-ups](https://md.research.elamur.ai/free/en/papers/zhang-2025-attacking-vision-language-computer-agents/). In Proceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pages 8387–8401.
46. Huichi Zhou, Kin-Hei Lee, Zhonghao Zhan, Yue Chen, Zhenhao Li, Zhaoyang Wang, Hamed Haddadi, and Emine Yilmaz. 2025. Trustrag: Enhancing robustness and trustworthiness in retrieval-augmented generation. arXiv preprint arXiv:2501.00879. — [arXiv:2501.00879](https://arxiv.org/abs/2501.00879) [find](https://scholar.google.com/scholar?q=Huichi+Zhou%2C+Kin%2DHei+Lee%2C+Zhonghao+Zhan%2C+Yue+Chen%2C+Zhenhao+Li%2C+Zhaoyang+Wang%2C+Hamed+Haddadi%2C+and+Emine+Yilmaz%2E+2025%2E+Trustrag%3A+Enhancing+robustness+and+trustworthiness+in+retrieval%2Daugmented+generatio)
47. Shuyan Zhou, Frank F Xu, Hao Zhu, Xuhui Zhou, Robert Lo, Abishek Sridhar, Xianyi Cheng, Tianyue Ou, Yonatan Bisk, Daniel Fried, and 1 others. 2023. [Webarena: A realistic web environment for building autonomous agents](https://md.research.elamur.ai/free/en/papers/zhou-2023-webarena-realistic-web-environment-building/). arXiv preprint arXiv:2307.13854.
48. Wei Zou, Runpeng Geng, Binghui Wang, and Jinyuan Jia. 2025. [Poisonedrag: Knowledge corruption attacks to retrieval-augmented generation of large language models](https://md.research.elamur.ai/free/en/papers/zou-2024-poisonedrag-knowledge-corruption-attacks-retrieval/). In 34th USENIX Security Symposium (USENIX Security 25), pages 3827–3844.
49. Chen Henry Wu, Rishi Shah, Jing Yu Koh, Ruslan Salakhutdinov, Daniel Fried, and Aditi Raghunathan. 2024. Dissecting adversarial robustness of multimodal lm agents. arXiv preprint arXiv:2406.12814. [find](https://scholar.google.com/scholar?q=Chen+Henry+Wu%2C+Rishi+Shah%2C+Jing+Yu+Koh%2C+Ruslan+Salakhutdinov%2C+Daniel+Fried%2C+and+Aditi+Raghunathan%2E+2024%2E+Dissecting+adversarial+robustness+of+multimodal+lm+agents%2E+arXiv+preprint+arXiv%3A2406%2E12814%2E)
50. Chong Xiang, Tong Wu, Zexuan Zhong, David Wagner, Danqi Chen, and Prateek Mittal. 2024. Certifiably robust rag against retrieval corruption. arXiv preprint arXiv:2405.15556. [find](https://scholar.google.com/scholar?q=Chong+Xiang%2C+Tong+Wu%2C+Zexuan+Zhong%2C+David+Wagner%2C+Danqi+Chen%2C+and+Prateek+Mittal%2E+2024%2E+Certifiably+robust+rag+against+retrieval+corruption%2E+arXiv+preprint+arXiv%3A2405%2E15556%2E)
51. Jian Xie, Kai Zhang, Jiangjie Chen, Renze Lou, and Yu Su. 2023. [Adaptive chameleon or stubborn sloth: Revealing the behavior of large language models in knowledge conflicts](https://md.research.elamur.ai/free/en/papers/xie-2023-adaptive-chameleon-stubborn-sloth-revealing/). In The Twelfth International Conference on Learning Representations.

*Updated 2 November 2026*