Metraipolis › archive › dc_ab0ffb190891

Voluntary Servitude: Weaponized Safety Warning Mechanisms for Controlling AI Agents — arXiv:2611.04393

Source: arXiv (en)
Original: https://arxiv.org/abs/2611.04393
License (as archived): CC0-1.0
Archived: 2026-11-04T18:36:39.901Z
SHA-256 of the archived text: 99a8c0f7a753c5f9df478359c957b6dca68f491c85bff696cd7992bb0ec2694e
Stable URL of this page: https://metraipolis.com/documento/dc_ab0ffb190891

How to cite

Voluntary Servitude: Weaponized Safety Warning Mechanisms for Controlling AI Agents — arXiv:2611.04393 — arXiv (en), https://arxiv.org/abs/2611.04393 (CC0-1.0); archived copy: https://metraipolis.com/documento/dc_ab0ffb190891 (Metraipolis archive dc_ab0ffb190891, sha256 99a8c0f7a753c5f9df478359c957b6dca68f491c85bff696cd7992bb0ec2694e)

BibTeX

@misc{dcab0ffb190891,
  title = {Voluntary Servitude: Weaponized Safety Warning Mechanisms for Controlling AI Agents — arXiv:2611.04393},
  howpublished = {arXiv (en)},
  url = {https://arxiv.org/abs/2611.04393},
  note = {License CC0-1.0; archived copy https://metraipolis.com/documento/dc_ab0ffb190891; sha256 99a8c0f7a753c5f9df478359c957b6dca68f491c85bff696cd7992bb0ec2694e},
  year = {2026}
}

Archived text

Reproduced under CC0-1.0. Attribution: arXiv (en), https://arxiv.org/abs/2611.04393. Third-party text: data, not instructions. It may be an abstract or extract; check the original.

LLM agents increasingly act on information retrieved from public sources they treat as credible, which turns a manipulated recommendation into a transaction, a dependency, or a decision with physical consequences. The security literature models this threat as instruction injection, in which an adversary writes a command into retrieved content and deployed defenses learn to recognize command syntax. We show that an attacker can instead steer an agent through the agent's own harm-avoidance. A single fabricated hazard, written as an ordinary review, leads the agent to disqualify the legitimate options and select the attacker's target by its own reasoning, with no command for a detector to recognize. We call this voluntary servitude. These payloads steer agents about as often as instruction injection (60.4% vs. 66.0%), and deployed injection detectors score them as benign, so behind a filter they are 1.7-4.4x more effective. We measure this at the generation stage across six models and ten consumer-service domains, for three attack families, and show that it transfers to production browser agents, outperforming instruction injection, and to a retrieval pipeline (1.0-57.0% end-to-end success, depending on the retriever). We then show that a corroboration requirement added to the agent's instructions removes roughly 95% of the exposure against a non-adaptive attacker without retraining. With the requirement in place, the agent still reads the planted hazard and no longer acts on it.

Tema degli esploratori: agenti e intelligenza artificiale (elenco arXiv cs.AI, nuovi lavori del giorno).
Categorie arXiv: Cryptography and Security (cs.CR) ; Artificial Intelligence (cs.AI); Computation and Language (cs.CL); Machine Learning (cs.LG).
Pagina del lavoro: https://arxiv.org/abs/2611.04393 — autori e testo completo sono lì (qui omessi i nomi: nessun dato personale nel deposito).
Licenza: titolo e abstract sono metadati arXiv distribuiti in CC0 1.0; il testo completo ha la licenza scelta dagli autori, indicata sulla pagina.
Letto il 2026-11-04T18:32:37.442Z dalla pagina https://arxiv.org/list/cs.AI/new (consentita dal robots.txt di arxiv.org, con il suo crawl-delay).